Privacy policy

This privacy policy informs you, pursuant to Art. 13 GDPR, which personal data FreierTermin processes, for what purpose, on which legal basis and for how long. In short:

• No tracking and no advertising. Optional services (Google Maps, statistics) are only loaded if they are enabled and you agree.
• We do not sell data and do not transfer personal data to authorities or their booking systems. Booking always takes place on the official website.
• You can export your data and delete your account completely at any time.

• Ferhat Mert Kaya (Kaya Bytes)
• c/o SourceArt · VM-00001706, Fritz-Thiele-Straße 3, 28279 Bremen-Obervieland, Germany
• Phone: +49 1522 2486244
• E-mail: [email protected]

Data protection officer: none appointed at present. [REVIEW]

When you visit FreierTermin, our server processes technically necessary data: IP address, date and time, requested address, browser identifier (user agent) and error messages. Without this data we cannot deliver the site or protect it against attacks.

To prevent abuse we count requests per sender. For this we do not use the IP address itself but a hash created with a secret key, which expires automatically after a few minutes.

• Legal basis: Art. 6(1)(f) GDPR (legitimate interest in a secure, functioning service).
• Retention of server logs at the hosting provider: [insert period] [REVIEW]

For an account we process first name, last name, e-mail address, language and your password – the password only as an Argon2id hash, never in plain text. To confirm your e-mail address and after you sign out, we send you a six-digit code; codes are stored hashed and only for a few minutes.

If you set up a passkey, we only store the public key and technical attributes. Your fingerprint or face never leaves your device.

For each signed-in session we store the IP address and browser identifier so that you can see your active sessions and end them individually. We remove a session’s IP address automatically after 7 days; sessions expire after 30 days at the latest and are then deleted.

• Legal basis: Art. 6(1)(b) GDPR (terms of use); security measures additionally Art. 6(1)(f) GDPR.
• Retention: until you delete your account; sessions at most 30 days.

For an alert we store what and where you are looking for an appointment (service, place or authority, optionally starting point and radius), period, weekdays, times and the channels you want. Our system checks official booking pages bundled per authority – not per person – and matches new appointments with your alerts on our server. Your data is never transferred to the authority or its booking system.

Please do not enter details about nationality, residence status or health. We do not need them for notifications. Certain requests (for example at the immigration office) may still allow inferences; we therefore treat alerts confidentially and do not use them for statistics or advertising.

• Legal basis: Art. 6(1)(b) GDPR. [REVIEW: whether Art. 9 GDPR is affected for certain requests and explicit consent would be needed]
• Retention: alerts and saved authorities until you delete them or your account; expired alerts remain visible in your account until you delete them. Your recent searches are deleted automatically after 90 days.

If you store a booked appointment in FreierTermin, we store the authority, location, service, date, time, your notes and optionally the booking reference and cancellation link. Booking reference and cancellation link are stored encrypted (AES-256-GCM). We schedule reminders from this information.

• Legal basis: Art. 6(1)(b) GDPR.
• Retention: until you delete the appointment or your account. Past appointments are marked as “past” and deleted automatically 12 months after the appointment date.

We send you the e-mails you requested: confirmation codes, security notices, alerts and reminders. These e-mails contain no advertising. We only send a newsletter if you explicitly subscribed; you can unsubscribe at any time via the link in every e-mail or in your profile.

For every e-mail sent we log recipient address, template, subject and delivery status to avoid duplicates and fix errors. Addresses that permanently bounce or have complained are added to a suppression list.

• Legal basis: Art. 6(1)(b) GDPR; newsletter: Art. 6(1)(a) GDPR; suppression list: Art. 6(1)(f) GDPR.
• Retention: e-mail log 90 days, 180 days for failed or bounced deliveries. In-app notifications: read ones 90 days after reading; unread ones after 12 months at the latest. [REVIEW: set a maximum period for the suppression list]

Depending on configuration we send e-mails through an SMTP provider or through Resend (Resend, Inc., USA). The provider processes recipient address and content on our behalf (Art. 28 GDPR).

• SMTP provider: [insert name, location and data processing agreement]
• Resend: transfer to the USA possible. [REVIEW: server region, EU-US Data Privacy Framework certification or standard contractual clauses, DPA]

You only receive push notifications if you explicitly allow them in your browser. We then store the push address (endpoint) generated by the browser, the associated keys, browser identifier and platform. The content is encrypted according to the Web Push standard and delivered through the push service of your browser vendor – for example Google (Chrome), Mozilla (Firefox), Apple (Safari) or Microsoft (Edge). These services may be located outside the EU.

Notifications may contain the name of the service and the authority and may be visible on your lock screen.

• Legal basis: Art. 6(1)(b) GDPR; access to your device: § 25(2) no. 2 TDDDG (service requested by you). [REVIEW]
• Retention: until you unsubscribe from push, delete your account or the push service reports the address as invalid.

A postcode or place name is enough for searching. We only store a home location in your profile with your explicit consent; you can remove it at any time. There is no continuous location tracking.

We first resolve postcodes and places using our own directory. Depending on configuration we query a geocoding service. Our server makes this request: the service only receives the search term, not your IP address.

• Legal basis: place search Art. 6(1)(b) GDPR; stored home location Art. 6(1)(a) GDPR (withdrawable at any time).
• Possible geocoding services: Nominatim (OpenStreetMap Foundation, United Kingdom), Photon (komoot) or Google Geocoding (Google, including USA). [REVIEW: UK adequacy decision, role of providers]

By default we show maps with MapLibre and map data from OpenStreetMap. Your browser loads the map tiles directly from OpenFreeMap; for technical reasons the operator receives your IP address. No cookies are set for this.

• Legal basis: Art. 6(1)(f) GDPR (showing authority locations). [REVIEW: OpenFreeMap operator details; whether consent or a self-hosted solution is preferable]

If we have enabled Google Maps as the map provider, we only load the map after you agreed to the “Maps” category. Then, among other things, your IP address, device information and the displayed map area are transferred to Google. The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland; a transfer to Google LLC in the USA is possible.

• Legal basis: Art. 6(1)(a) GDPR and § 25(1) TDDDG; withdraw at any time under “Cookie settings”.
• Third-country transfer: based on the adequacy decision for the EU-US Data Privacy Framework (10 July 2023), insofar as Google is certified. [REVIEW: current certification, Google’s role under the Google Maps Platform EEA terms]

If enabled, we count page views with Plausible Analytics – without cookies, without cross-device profiles and without storing full IP addresses. We only load the script after you agreed to the “Statistics” category. We do not analyse the requests, alerts or authority visits of individual people.

• Provider: Plausible Insights OÜ, Estonia [REVIEW: provider details, server location, DPA]
• Legal basis: Art. 6(1)(a) GDPR; withdraw at any time under “Cookie settings”.

We log security-relevant events in your account (e.g. sign-in, failed sign-in, password change, new passkeys, ended sessions) with event type, time, browser identifier and a hash of your IP address. Passwords, codes and tokens never end up in this log.

An external error monitoring service (e.g. Sentry) is currently not integrated. Should this change, we will update this policy beforehand.

• Legal basis: Art. 6(1)(f) GDPR and Art. 32 GDPR (security of processing).
• Retention: 180 days.

When registering you accept the terms of use and confirm that you have read this privacy policy. We store consents (e.g. newsletter, home location, statistics) with type, version, time, a hash of the IP address and the browser identifier so that we can prove them. Withdrawals are recorded as well.

• Legal basis: Art. 6(1)(c) GDPR in conjunction with Art. 7(1) GDPR.
• Retention: until your account is deleted. [REVIEW: whether records must be kept beyond account deletion]

In your profile you can request an export of all data stored about you (JSON). The download is available for 7 days; afterwards we delete the export content.

When you delete your account, we remove it with all associated data: sessions, passkeys, profile, consents, alerts, notifications, saved appointments and reminders, push subscriptions, exports and security events. Scheduled reminders are cancelled. We send you a confirmation e-mail; its delivery log (with your address) is deleted after 90 days. What remains is a “account deleted” security event without any link to your account, deleted after 180 days.

Database backups are overwritten after [insert period]. [REVIEW]

If you write to us, we process your message and contact details to reply. Our contact form only opens your own e-mail program; nothing is stored on our website.

• Legal basis: Art. 6(1)(b) or (f) GDPR.
• Mailbox provider: [insert provider] [REVIEW]
• Retention: until the request is resolved, unless statutory retention obligations apply.

We only share personal data insofar as necessary for operating the service. Authorities and operators of booking systems receive no personal data from us.

In principle we process data in the EU. Data may reach third countries (in particular the USA) if you allow Google Maps, receive push notifications through your browser vendor’s service, or if we use Resend or Google Geocoding. The basis is then the European Commission’s adequacy decision for the EU-US Data Privacy Framework, insofar as the recipient is certified, otherwise standard contractual clauses (Art. 46 GDPR). [REVIEW]

Non-personal availability data of authorities is kept briefly: check results 7 days, individual slots 48 hours.

• Access (Art. 15 GDPR) – also directly via the data export in your profile
• Rectification (Art. 16 GDPR)
• Erasure (Art. 17 GDPR) – also directly via account deletion in your profile
• Restriction of processing (Art. 18 GDPR)
• Data portability (Art. 20 GDPR)
• Objection to processing based on legitimate interests (Art. 21 GDPR)
• Withdrawal of consent with effect for the future (Art. 7(3) GDPR), e.g. under “Cookie settings”

Write to us at [email protected]. You also have the right to lodge a complaint with a data protection supervisory authority. You may contact any supervisory authority, in particular the one where you live. [REVIEW: determine the authority competent for us by main establishment – Cologne (LDI NRW) or Bremen (LfDI Bremen) – and name it here with its address.]

We only use cookies and local storage that are strictly necessary for the service you requested (§ 25(2) no. 2 TDDDG). Optional services are only loaded after your consent (§ 25(1) TDDDG). The complete list is available under “Cookie settings”.

You are not obliged to provide data. Without an e-mail address and password, however, we cannot create an account or notify you. Matching your alerts with new appointments is automated but has no legal or similarly significant effect within the meaning of Art. 22 GDPR. No profiling takes place.

We update this policy when FreierTermin or the legal situation changes. We inform registered users in advance of material changes.