Privacy policy

This is a convenience translation. The legally binding version of this document is the German original; in case of any discrepancy, the German version prevails.

This privacy policy informs you, in accordance with Art. 13 and 14 of the General Data Protection Regulation (GDPR), about which personal data we process when you use Camperada, for which purposes, on which legal basis, to whom we disclose it and for how long we store it. It applies to the website camperada.de, the route planner at planer.camperada.de, the conversion planner at ausbau.camperada.de and the Camperada app for iOS and Android (together “Camperada” or “the services”).

1. Controller

The controller within the meaning of Art. 4(7) GDPR is:

osnabyte.
Owner: Jan Gloger
Albert-Einstein-Straße 1
49076 Osnabrück
Deutschland
Phone: +49 (0)541 44 38 33
Email: [email protected]

Camperada is a service of osnabyte.. The full provider identification can be found in the legal notice. No data protection officer has been designated because the requirements of Art. 37 GDPR are not met. Please direct enquiries about data protection to the postal or email address above.

2. Overview

• All planning features of the trip planner can be used without an account. An account is voluntary; only with an account can a saved plan later be changed, made private or deleted.
• Your planning data initially exists only in your browser. A trip plan is stored on our servers only once you secure it with a save code or save it while signed in.
• We do not use any third-party advertising or tracking services. Audience measurement is carried out with self-hosted software, without cookies and without any link to an account or trip plan; the same goes for technical error reports, which carry no IP address.
• Camperada itself sets only one technically necessary session cookie, and only if you use an account; in addition, our network provider Cloudflare may set technically necessary cookies (section 4.2). A consent banner is therefore not required.
• Your browser loads map tiles directly from OpenFreeMap. All other specialist services (place search, route calculation, weather) are queried by our server without passing on your IP address.
• For campsites that a partner portal lists as bookable, and for ferry connections that Direct Ferries lists, the planner shows a labelled booking link (partner link). Before you leave, a notice opens that states what is transmitted; data flows to the partner network and the portal only when you continue from there. Your route is not transmitted in the process, at most the site or connection selected and, if your plan has a travel date, at the portals that preselect the dates (currently camping.info and PiNCAMP) the travel dates for this site and, if you have stated in the overview who is travelling, the number of adults and the ages of the children (section 16).
• All services are delivered via the network of Cloudflare, which fends off attacks and speeds up delivery. The servers themselves are located in the European Union.

3. Terms and legal bases

We use the terms “personal data”, “processing”, “controller”, “processor” and “recipient” with the meaning given in Art. 4 GDPR. Where we process data, we do so on one of the following legal bases:

• Art. 6(1)(b) GDPR (performance of a contract): for providing the features you request, in particular route calculation, saving trip plans and the optional account.
• Art. 6(1)(f) GDPR (legitimate interest): for secure and stable operation, the prevention of misuse, audience measurement, needs-based further development and the financing of the free services. We name the specific interest with each individual processing operation.
• Section 25(2) no. 2 TDDDG (German Telecommunications Digital Services Data Protection Act): for storing information on your terminal device insofar as this is strictly necessary to provide a feature you have expressly requested.

No processing based on consent (Art. 6(1)(a) GDPR) currently takes place. We do not process special categories of personal data (Art. 9 GDPR).

4. Provision of the services, server log data and infrastructure

4.1 Hosting and server log data

The website, the planner and the conversion planner are operated on servers of Hetzner Online GmbH, Industriestraße 25, 91710 Gunzenhausen, Germany; the servers are located in the Nuremberg and Falkenstein data centres (Germany). Hetzner acts for us as a processor under Art. 28 GDPR. With every request, the server processes the following data, which your browser transmits for technical reasons: IP address, date and time of the request, the address requested, HTTP status code and browser and operating system identifier (user agent).

• Purpose: delivery of the pages, ensuring operational security, detecting and fixing errors.
• Legal basis: Art. 6(1)(f) GDPR; legitimate interest in secure and stable operation.
• Storage period: the logs are limited in size and continuously overwritten. They are not linked to accounts or saved trip plans and are not analysed, except to investigate an attack or a fault.

4.2 Delivery via Cloudflare

All requests to the website, the planner, the conversion planner, the interfaces used by the app and the audience measurement (section 5) are routed through the network of Cloudflare (Cloudflare, Inc., 101 Townsend Street, San Francisco, CA 94107, USA). Cloudflare acts as an upstream proxy and content delivery network: it fends off automated attacks, enforces encrypted connections and delivers website content from a cache. In doing so, Cloudflare processes the connection data of each request (IP address, address requested, headers, any cookies transmitted) on the server of its network closest to your location; according to its own information, Cloudflare processes metadata about this traffic in data centres in the USA and in Europe. To fend off automated access, Cloudflare may set technically necessary cookies with a lifetime of 30 minutes (“__cf_bm”, and after a security check “cf_clearance”); they serve solely the security of the connection (Section 25(2) no. 2 TDDDG).

• Purpose: protection against attacks and overload, encryption, fast delivery.
• Legal basis: Art. 6(1)(f) GDPR; legitimate interest in the security and availability of the services.
• Recipient and third country: Cloudflare acts for us as a processor (Art. 28 GDPR). Cloudflare is certified under the EU-US Data Privacy Framework; in addition, the standard contractual clauses of the European Commission apply (Art. 45, Art. 46(2)(c) GDPR). Further details in the Cloudflare privacy policy: cloudflare.com/privacypolicy.

4.3 Protection against overload and misuse

To protect the services and the specialist services we use against overload, we limit the number of requests per sender. For this purpose, your IP address is compared only transiently in the working memory of the server; it is neither stored nor logged for this purpose (Art. 6(1)(f) GDPR; legitimate interest in the availability of the services).

4.4 Data security

All connections to Camperada are encrypted with TLS. We store passwords exclusively as a cryptographic hash (scrypt), never in plain text. Databases are reachable only from the internal network of the servers. Email addresses are masked in error logs.

4.5 Error reports (GlitchTip)

If a technical error occurs on the website, in the planner, in the conversion planner or in the Camperada app, we send an error report to the software GlitchTip. It is self-hosted on our own servers in the EU; no data flows to a provider. Errors in your browser or in the app first go to our server, which checks the report and passes it on; your browser does not talk to GlitchTip itself. A report contains the kind of error, the error message, the location in the program code, the page on which it occurred (without address parameters), the time and, for errors in the browser, the browser family with major version and the operating system (such as “Safari 17, iOS”). If route calculation falls back to another service, the report contains the reason, the number of waypoints, a rough route length (such as “300 to 1000 km”) and whether vehicle dimensions and route preferences were set, but no places. Save codes, email addresses and IP addresses are made unrecognisable before sending. Reports do not contain your IP address, cookies, inputs, the contents of your trip plans or any identifier that would make you or your device recognisable; they are not linked to an account or a saved trip plan. Nothing is stored on your device for this. The embedded view on other websites sends no error reports.

• Purpose: solely to find and fix errors.
• Legal basis: Art. 6(1)(f) GDPR; legitimate interest in error-free and secure operation. You can object at any time (section 23).
• Storage period: 90 days.

5. Audience measurement with Umami

5.1 Usage statistics

To understand which pages and features are used, we use the analytics software Umami on the website, the planner and the conversion planner. Umami runs exclusively on our own servers in the European Union; no data is transmitted to a provider of analytics services. Like all other requests, they are routed through Cloudflare (section 4.2). Umami sets no cookies and stores nothing on your terminal device. The counting script does, however, read the screen size and the language setting in the browser and checks the local storage for whether counting has been switched off for this browser (entry “umami.disabled”).

What is recorded is the page visited (only the path, without parameters; the addresses of shared trip plans are masked before counting), the page title (replaced by a neutral text for shared trip plans), the referring page, browser and device type, screen size and language setting, the approximate origin derived from the IP address (country, region) and individual feature events of the website, the planner and the conversion planner, such as “route calculated” with the number of stops and the rounded distance, “plan saved”, “export created”, “partner or ferry link clicked”, “planner opened” (from the website, with page and language) or “layout saved”. Events contain neither places nor save codes nor the name of a site. The IP address itself is not stored. Related requests are grouped by a pseudonymous identifier that changes monthly and cannot be traced back to a person; within a calendar month, repeat visits from the same browser can therefore be recognised. We delete the individual requests and events after 13 months; for longer periods, only daily totals without any identifier remain. None of this is linked to saved trip plans or an account. No audience measurement takes place in the Camperada app.

• Legal basis: Art. 6(1)(f) GDPR; legitimate interest in data-minimising measurement of usage and in improving the services.
• Objection: if the “Do Not Track” setting is active in your browser, we treat this as an objection and do not count your visit. In addition, you have the right to object under section 23.

5.2 Click and scroll maps on the website

Only on the website camperada.de (not in the planner, not in the conversion planner and not in the app) do we additionally record where on a page clicks occur and how far the page is scrolled. For this, the website embeds a second Umami script that transmits the position of clicks, the scroll depth reached, the window size and the address of the page to our Umami instance. Inputs, text or other content on your screen are not recorded; individual sessions are neither recorded nor made replayable. From these points, an aggregated click and scroll map (“heatmap”) is created per page. Assignment to a visit uses the same pseudonymous identifier as in section 5.1, without cookies and without storing the IP address.

• Legal basis: Art. 6(1)(f) GDPR; legitimate interest in improving the structure and content of the pages.
• Storage period: we delete the raw data (individual click and scroll points) after 30 days; only the aggregated map is retained.
• Objection: if “Do Not Track” is active, the script is not loaded and nothing is collected.

6. Storage of settings in your browser

The planner stores some details persistently in the local storage of your browser (localStorage), and only there: your language setting, display states (for instance which stops are expanded, which map layers are shown, which updates you have read and whether you have already seen the welcome notice) and, if you enter them, your starting point (“Home”, often a private address, as place name and coordinate) and who is travelling (number of adults and ages of children). These details are not transmitted to our servers as settings and are not part of a saved trip plan. The starting point enters the calculations you trigger only as a coordinate (see section 8).

The conversion planner stores nothing in the browser’s storage (section 12). After sign-in, the Camperada app stores a session token (section 13). Planning data that earlier versions of Camperada stored in the browser is taken over once on your first visit and removed from the browser as soon as you save the plan for the first time.

• Legal basis: Section 25(2) no. 2 TDDDG. The storage is strictly necessary to provide the feature you have requested; it contains no identifier by which you could be recognised.
• Deletion: at any time by you via the settings of your browser (delete website data) or by signing out of the app.

7. Map display (OpenFreeMap)

To display the map in the planner and the example map on the home page, your browser loads map tiles, map style and map fonts directly from the servers of OpenFreeMap (Hyperknot Software Kft., Petőfi Sándor utca 48, 2724 Újlengyel, Hungary). For technical reasons, your IP address and the map section displayed are transmitted to these servers. According to the provider, IP addresses are not stored in the regular server logs, and neither cookies nor tracking technologies are used.

• Legal basis: Art. 6(1)(f) GDPR; legitimate interest in a high-performance map display without operating our own tile server.
• Recipient: OpenFreeMap. Privacy notice: openfreemap.org/privacy.

8. Planning features: place search, route calculation, clearance check, weather, fuel prices, sites and sights

When you search for places in the planner, calculate a route or retrieve weather and price information, your browser sends the details required for this to our servers: search terms, the coordinates of your stops and your starting point, your vehicle profile (dimensions, weight, consumption), route settings, the map section and, where applicable, your departure date. Our server processes these details and passes on only what is necessary to the following specialist services. In doing so, it acts under its own identifier; we do not pass your IP address on to any of these services.

• Place search and place naming:first our own search service (Photon) with data from OpenStreetMap on our servers; nothing leaves our infrastructure in the process. Only if this service is unavailable does our server query Nominatim, operated by the OpenStreetMap Foundation, St John’s Innovation Centre, Cowley Road, Cambridge CB4 0WS, United Kingdom. What is transmitted is the search term or the coordinate to be named.
• Route calculation: first our own routing service (GraphHopper) on our servers; nothing leaves our infrastructure in the process. Only if this service is unavailable or does not cover the area does our server query OpenRouteService (HeiGIT gGmbH, Schloss-Wolfsbrunnenweg 33, 69118 Heidelberg). What is transmitted are the coordinates of the route, the vehicle profile and the route settings.
• Clearance check: which recorded height, width, weight or length restrictions lie on your route is checked by our server against its own dataset, regularly refreshed from OpenStreetMap. Your route is not passed to any external service for this.
• Weather forecast: MET Norway (Meteorologisk institutt, Henrik Mohns plass 1, 0371 Oslo, Norway). What is transmitted are the coordinates of your stops, rounded to about one kilometre.
• Fuel prices: the national averages the trip plan uses to estimate fuel costs come from the European Commission’s weekly Oil Bulletin and are held as a dataset on our servers; no request to an external service is made for them.
• Campsites and stopovers: come from our own dataset on our servers, regularly refreshed from OpenStreetMap. Your map section is not transmitted to any external service for the site search.
• Sights: which places lie along your route is likewise answered by our own dataset. Only when you open the detail card of a place does our server retrieve the introductory text of the Wikipedia article and the photo from Wikimedia Commons (Wikimedia Foundation, Inc., 1 Sansome Street, Suite 1895, San Francisco, CA 94104, USA). What is transmitted in the process is exclusively the title of the article and the file name of the photo, not your route, your location or your IP address. Our server also loads the photo and passes it on to your browser, so that your browser establishes no connection to Wikimedia.
• Rules on the road: what applies at a border and which low emission zones your route touches is worked out by our server from its own datasets. Route and departure date are not passed to any external service for this, and nothing is stored.

Caching. To spare the specialist services and to speed up repetitions, we keep responses briefly in the working memory of the server (minutes to hours; introductory texts and photos of sights up to seven days). The result of a route calculation, that is the course of the route with its key figures, we additionally retain in a database for up to 90 days after the last retrieval, stored under a checksum of the request. It is linked neither to an account nor to your IP address nor to any other identifier; who calculated a route cannot be discerned from it. As a route begins at your starting point, such a route course may also begin at your starting point; however, it is not stored there as a starting point or address.

Reach. If you ask how far you can get from your starting point or a stop in a given driving time, your browser sends this point, rounded to about 100 metres, to our server. The calculation is performed exclusively with our own routing service. We keep the result in working memory for up to 24 hours, stored under the point rounded to about one kilometre, and never in a database.

• Legal basis: Art. 6(1)(b) GDPR (provision of the requested feature); for caching, Art. 6(1)(f) GDPR, legitimate interest in the sparing use of external services and our own computing time.
• Third country: see section 20.
• Sources and licences: which service plays which role, together with its licence, is stated on the page About Camperada.

9. Location request

Camperada requests your device location only if you select the feature “Use my location” and grant location access in your browser or operating system. The coordinates are then sent to our server like other route coordinates and named there, alternatively via Nominatim (section 8, without your IP address). As a starting point, they subsequently remain stored only in your browser (section 6). No continuous location tracking takes place.

10. Saved trip plans (save code)

10.1 Storage and content

Only when you choose “Save” is your trip plan stored in a database on our server and made accessible via a random save code. What is stored are the stops with overnight stays and excursion destinations, the travel period, vehicle, fuel and, where applicable, rental details, route settings, ticked items of the departure checklist, a title and the course of the route. Your starting point (“Home”) is not part of this. An account is not required for saving; without an account, the plan is not linked to a name, email address or similar details.

For each plan we also record when it was created, last changed and last opened and which of our routing services last calculated it. The time of last opening is updated at most every 15 minutes; no history of who opened it when and from where is created. These details control automatic deletion (section 10.3) and show us whether our route calculation works reliably and which features are used.

10.2 Access and sharing

The save code is a read key. A plan saved without an account, as well as a plan that you expressly share from your account, can be opened and copied as their own route by anyone who knows the code or the link. Without such sharing, plans in an account can be opened only from within the account. A plan can only be changed, renamed or deleted from the account it belongs to; a plan saved without an account is thus unchangeable. Continuing to plan creates a new route with its own code. A shared plan can also be placed on another website with the embed code; that site’s visitors then load the view from our servers, without cookies and without a map service, and we process only the server log data described in section 4.

The shared view of a shared plan is excluded from indexing by search engines. For previews in messengers and social networks, we deliver a preview image with the title of the plan, the names of the first stops and key figures of the trip; such previews may be cached by the respective services. Please treat code and link like the plan itself.

10.3 Storage period and legal basis

• Legal basis: Art. 6(1)(b) GDPR for the plan itself; Art. 6(1)(f) GDPR for the accompanying technical details (timestamps, routing service), legitimate interest in a functioning and needs-based service.
• Storage period: we automatically delete plans without an account if they have not been opened for six months; every opening in the planner and every call of the shared or the embedded view resets this period. Plans in an account remain stored until you delete them or your account.
• Deletion on request: we delete a plan secured by code upon an informal email to the address given in section 1, stating the code.

11. Optional account

11.1 Registration and master data

An account is not required to use Camperada. If you create one, we process your email address, the name you provide and your password (exclusively as a cryptographic hash) in order to provide you with the features “My routes”, “My motorhomes”, “Support” and the saving of conversion layouts. Routes saved while signed in, vehicle data (designation, dimensions, weight, consumption, tank size) and layouts are assigned to your account. The name is voluntary; if you leave the field empty, we use your email address as your display name. The legal basis is Art. 6(1)(b) GDPR.

You can change your name, email address and password yourself at any time (in the account under “Settings”). When you change your email address, for security reasons we first send a confirmation email to your previous address, which names the new address, and only after your confirmation one to the new address; the new address is stored only once both steps have been completed. If your previous address has not yet been confirmed, the first step is omitted.

If you open What’s new in the planner while signed in, we store on your account the identifiers of the updates you have seen, so that the notification disappears on all your devices. We do not store when you read an update (Art. 6(1)(b) GDPR). This information is deleted together with your account. Without an account, only your browser remembers what you have read (section 6).

11.2 Confirmation and password emails

After registration we send you an email with which you confirm your address (link valid for 24 hours). If you have forgotten your password, we send you a reset link on request (valid for one hour). These emails go exclusively to the address you provided (Art. 6(1)(b) GDPR). We do not send newsletters or advertising emails.

An account whose address was never confirmed and under which nothing is stored (no routes, vehicles, layouts or feedback) is deleted automatically once it has not been used for 30 days, at the earliest 30 days after registration.

11.3 Sessions

For sign-in, Camperada sets a technically necessary session cookie (Section 25(2) no. 2 TDDDG). A session is valid for seven days and is extended on use. For each session we store the IP address, insofar as it can be technically determined, and the browser identifier in order to secure sessions against misuse (Art. 6(1)(f) GDPR; legitimate interest in the security of your account). A daily clean-up run deletes expired sessions including these details; at the latest, they are deleted together with your account.

11.4 Usage metrics of the account

For your account we record when it was last used and on how many days in total. For this we store exactly two values, a timestamp and a counter, which are updated at most every 15 minutes. What you do, which page you open or from where you access is not recorded; no history and no usage profile is created. We need these values to recognise whether and how regularly Camperada is used and to align further development accordingly (Art. 6(1)(f) GDPR; legitimate interest in needs-based further development). If you object to this counting (section 23), we switch it off for your account and delete both values; your account continues to work unchanged.

11.5 Deletion of the account

You can delete your account yourself at any time (in the account under “Settings”, confirmed by entering your email address). This deletes the account, your saved routes, vehicles, conversion layouts and sessions; shared links to your routes stop working afterwards. Feedback and support histories are retained without assignment to your account, and we remove any email addresses stored with them in the process (section 14). Alternatively, an informal email from your account address to the address given in section 1 suffices.

If you withdraw from the contract on the account with the “Withdraw from contract” function (also under “Settings”), we send a confirmation of receipt to the account address with the content of your declaration (your name, the account, date and time of receipt) and then delete the account as described above. The legal basis for the confirmation is Art. 6(1)(c) GDPR in conjunction with Section 356a of the German Civil Code (BGB). We store no further data about the withdrawal; like all account emails, the confirmation is sent via Mailjet (section 15).

12. Conversion planner

The conversion planner works without a database of its own. Without an account, it stores nothing: your layouts then exist only while the tab is open; they are neither transmitted to any server nor kept in your browser’s storage, and they are lost when you close the tab or reload the page. Storage happens only in your account: if you are signed in, the conversion planner saves your layouts there so that they are available on every device; if you sign in while already planning, what you created in the tab up to then is taken over. The layouts are held in the same database as your routes and vehicles and contain what you have entered: the name of the layout, the dimensions of your vehicle and, if you enter them, its name, weights and axle loads, the build-out allowance of floor, walls and ceiling, the chosen surfaces, the furniture with dimensions, weights and colours, and your notes and links relating to them; if you link a layout to a vehicle from “My motorhomes”, this link as well (Art. 6(1)(b) GDPR). You can delete individual layouts in the conversion planner at any time; they are deleted together with the account.

The conversion planner is open to everyone as a beta. To recognise whether you are signed in, it asks the planner: on loading and, as long as you are not signed in, each time you return to its tab, so that it notices a sign-in in another tab. If you are signed in, your session cookie is transmitted to the planner in the process, which responds with the identifier of your account and your role; this request counts towards the usage metrics of your account like any other signed-in request (section 11.4). If you are not signed in, no personal reference arises beyond the server log data. In all other respects, sections 4 and 5 apply.

13. Camperada app

If you use Camperada as an app, the sections on the planner apply accordingly, with the following particularities: instead of the session cookie, a session token is stored in the local storage of the app after sign-in and removed on sign-out (Section 25(2) no. 2 TDDDG). On start-up, the app asks our server whether an updated interface is available and, if so, loads it from there; what is transmitted in the process are the platform, the version and the identifier of the installed interface package (Art. 6(1)(b) GDPR). Only our own servers and the delivery described in section 4.2 are involved. No audience measurement takes place in the app, and no partner links are displayed. If a technical error occurs in the app, it sends an error report (section 4.5). Apple is responsible for the processing by Apple in connection with the App Store, and Google for the processing by Google in connection with Google Play (in each case download, updates, ratings).

14. Feedback and support

In the planner you can send us feedback (bug, idea, question). An account is not required for this. What is stored are the text you enter, the category chosen, the time and technical details that make it easier for us to trace the matter: the view open at the time (only the path, without parameters), the save code of a route currently open, if any, and the shortened browser identifier. The content of your trip plan is not transmitted. If you are signed in, we assign the feedback to your account. For processing, the operator may create internal notes on a piece of feedback.

If you are signed in, we answer your feedback in your account under “Support”; there you can see the history and reply, and we store your replies in this history as well. Providing an email address is voluntary. With an account, it serves solely to notify you that a reply is available; the notification quotes your original feedback but does not contain the text of our reply. Without an account, the address serves our reply by email; without an address, we cannot reply. If you are signed in, the address field is pre-filled with your account address; if you remove it, no address is stored.

• Legal basis: Art. 6(1)(f) GDPR, legitimate interest in fixing errors, improving the services and answering enquiries; for signed-in users additionally Art. 6(1)(b) GDPR.
• Storage period: we delete feedback including its history automatically 18 months after the last message in a case, and earlier at your request. When your account is deleted, they are separated from it and any stored email addresses are removed.
• Protection against misuse: the number of feedback messages and replies per connection or account is limited; for this, the IP address is compared only transiently in working memory (section 4.3).

15. Email dispatch (Mailjet)

To send the confirmation, password and address-change emails, the confirmation of receipt of a withdrawal (section 11.5), our replies to feedback without an account and the notifications about replies in the account, we use Mailjet (Mailjet GmbH, Alt Moabit 2, 10557 Berlin, a company of the Sinch group). Mailjet acts for us as a processor under Art. 28 GDPR. What is transmitted are your email address, your display name for the salutation and the content of the respective message; for replies and notifications, this includes the text of your original feedback, which we quote, but not the text of our reply in the account. Mailjet also processes technical delivery information such as the time of dispatch and the delivery status. According to the provider, the data is processed in data centres in Frankfurt am Main and Saint-Ghislain (Belgium).

• Legal basis: Art. 6(1)(b) GDPR (provision of the account) or Art. 6(1)(f) GDPR (answering your feedback).
• Mailjet privacy notice: mailjet.com/de/rechtliches/datenschutzerklaerung.

16. Booking links to partner portals (partner links)

16.1 How they work and labelling

For campsites that one of the partner portals named in section 16.4 lists as bookable, the planner shows a booking link in the detail card of the site, such as “Bookable online at camping.info”. If several partner portals list the same site, their links appear side by side with equal rank, in a fixed alphabetical order. If you searched for the site for a stop or a night on the way and your plan has a travel date, the planner only shows the partner portals whose page already has these travel dates preselected (currently camping.info and PiNCAMP), so that you do not book different dates by mistake. Each of these links is a partner link and is labelled as such directly at the link: if you book via it, we receive a commission from the partner portal. Whether a site receives a booking link depends solely on whether the partner portal lists it as bookable (at Eurocampings only pitches for your own vehicle), whether we can match it reliably and, if your plan has a travel date, whether the partner portal preselects these dates. Which sites the planner shows and in which order does not depend on this; bookable sites are labelled as such, highlighted in colour on the map and can be filtered by you. No partner links are displayed in the Camperada app.

When you select a booking link, the planner first opens a notice before you leave Camperada. It names the partner portal, which details from your plan will already be filled in there and which you need to enter yourself, and what is transmitted when you continue. Only the “Continue to …” button in this notice is the partner link; opening the notice transmits nothing.

For ferries, the planner shows a link “Prices and sailings at Direct Ferries” in the trip plan, in the expanded row of the crossing, if Direct Ferries lists this connection and we can match both ports reliably. It is also a partner link, labelled “Advertisement” at the link. The Direct Ferries page does not take over a travel date; if your plan has one, the planner states the day of the crossing below the link. The link to the ferry operator’s website remains alongside it and is not a partner link.

16.2 Data processing when you click

As long as you do not click a partner link (the “Continue to …” button in the notice), no data is transmitted for it: which sites are bookable and which ferry connections Direct Ferries lists is held as a list without personal reference on our server; we refresh it regularly from the product data feed of the respective partner programme or from the public pages of Direct Ferries. No scripts, tracking pixels or cookies of the partner network or the partner portal are embedded in Camperada.

If you click a partner link, your browser first opens an address of the partner network, which registers the click and immediately redirects you to the page of the site on the partner portal. In the process, the partner network and the partner portal receive the connection data of your browser (including IP address, browser identifier and time), the site selected, our identifier as a partner and, as the referrer, exclusively the address of our planner (planer.camperada.de), without path and without parameters. If your plan has a travel date and you searched for the site for a stop or a night on the way, the links to camping.info and PiNCAMP also pass on the travel dates for this site (arrival and departure) and, if you have stated in the overview who is travelling, the number of adults and the ages of the children, so that the site’s page can prefill its availability search with them. These details are part of the destination address and therefore also visible to the partner network. Direct Ferries runs its partner programme itself: the link leads without a partner network to the page of the connection at Direct Ferries, which receives the ferry connection (port of departure and arrival) instead of a site, together with our identifier, and registers the click itself. Your route, your stops, a save code or details from your account are not transmitted. To be able to attribute a later booking to the click, the partner network adds a click identifier to the redirect and may set cookies on its own domains or recognise your device by a combination of technical attributes (TradeTracker names both in its privacy notice, section 16.4); the partner portal may also set cookies on its site. We receive reports from the partner network (from Direct Ferries in its case) that, when and with which commission bookings were made via our links. Per booking, these reports may also contain a hash of the IP address, the country derived from it, the device type at click and booking, the portal’s order number and whether the portal counts the person booking as a new or existing customer (this is what Awin’s documentation lists). We do not receive the name, address or contact details of the person booking, and we cannot identify the person from the reports. The individual reports remain on the platform of the respective network; we do not copy them into files of our own. We keep only the statements the network issues to us for our remuneration (credit notes), as accounting records under Section 147 of the German Fiscal Code (AO) (section 21). In our audience measurement (section 5.1) we count the click as an event without recording the site or the connection.

16.3 Responsibility and legal basis

The partner network and the partner portal are the controllers for the processing that begins with the call of the address of the partner network (at Direct Ferries with the call of its website); details are governed by their privacy notices linked in section 16.4. In its terms for partners, the partner network Awin classifies the processing of click data as joint controllership of Awin and the linking partner (Art. 26 GDPR); the partner network TradeTracker states in its privacy notice that it may be a joint controller with advertisers and partners. Insofar as this applies, the following holds for both networks: the network fulfils the information obligations for this processing in its privacy notice; you may assert your rights both against the network and against us; however, only the network can provide access to click and booking data because we do not receive this data.

Apart from the pseudonymous count described in section 5.1, we ourselves process no personal data when you click. Insofar as providing the link constitutes processing, it is based on Art. 6(1)(f) GDPR; our legitimate interest is the financing of the free services through commissions, without ad banners and without passing on user data. We process the reports and statements described in section 16.2 to check and settle the commissions (Art. 6(1)(f) GDPR; legitimate interest in verifying our remuneration); we retain the statements because tax law requires it (Art. 6(1)(c) GDPR in conjunction with Section 147 AO and Section 14b of the German VAT Act (UStG)).

16.4 Partners and partner networks

The following partnerships currently exist (as at 29. Oktober 2026). This list is exhaustive; if a partner is added, it will be added here.

• camping.info (Camping.info GmbH, Oranienburger Straße 27, 10117 Berlin), booking portal for campsites; partner links “Bookable online at camping.info”. Privacy notice: camping.info/en/info/privacy-policy. Brokered via the partner network Awin.
• ACSI Eurocampings (ACSI Publishing BV, Geurdeland 9, 6673 DR Andelst, Netherlands), booking portal for campsites; partner links “Bookable online at Eurocampings”, for pitches only. Privacy notice: eurocampings.co.uk/extra-information/privacy. Brokered via the partner network TradeTracker.
• PiNCAMP (PiNCAMP GmbH, Hansastraße 19, 80686 Munich, Germany), ADAC’s booking portal for campsites; partner links “Bookable online at PiNCAMP”. Privacy notice: pincamp.de/datenschutz. Brokered via the partner network TradeTracker.
• Direct Ferries(Direct Ferries Limited, Units 2 & 3, Three Rivers Business Centre, Felixstowe Road, Foxhall, Ipswich IP10 0BF, United Kingdom; representative in the EU: The DPO Centre Europe Ltd, Alexandra House, 3 Ballsbridge Park, Dublin D04 C7H2, Ireland), booking portal for ferries with its own partner programme; partner links “Prices and sailings at Direct Ferries” in the trip plan. Privacy notice: directferries.com/privacy.htm.
• Awin (AWIN AG, Otto-Ostrowski-Straße 1A, 10249 Berlin), partner network that registers clicks, redirects them and settles commissions; according to its own information, Awin stores tracking data for up to three years. Privacy notice: awin.com/gb/privacy.
• TradeTracker (TradeTracker International B.V., De Strubbenweg 7, 1327 GA Almere, Netherlands), partner network that registers clicks, redirects them and settles commissions; according to its own information, TradeTracker keeps a record of the journey from one website to the next for up to 365 days, may recognise your device by device IDs or a combination of device attributes, and allows its partners to process data outside the EU as well, safeguarded by standard data protection clauses (section 20). Privacy notice: tradetracker.com/privacy-policy.

17. External links without commission

At various points, Camperada links to third-party websites, for instance to the website of a site or a ferry operator from OpenStreetMap, to the official vignette shops of individual countries or to Wikipedia articles. We receive no remuneration for these links. They are set so that your browser transmits no referrer address when you click. Clicks on the website of a site or a ferry operator are counted by our audience measurement (section 5.1) as an event, without recording the site or the operator. Data flows to the respective provider only with the click; that provider alone is responsible for the processing on the destination page.

18. No third-party advertising or tracking services

Camperada embeds no advertising networks, advertising banners, paid placements or third-party tracking services and sells no data. The only links for which we receive remuneration are the labelled partner links described in section 16; they transmit nothing before you click them. The only cookies that Camperada itself sets are the session cookie of the account (section 11.3) and, where applicable, the security cookies of Cloudflare (section 4.2); both are technically necessary and exempt from consent under Section 25(2) no. 2 TDDDG. The fonts of the pages are embedded locally; no connection to Google Fonts is made when a page is loaded. Only the lettering of the maps is loaded by your browser from OpenFreeMap, together with the map data (section 7).

19. Recipients and access to data

We disclose personal data only insofar as described in this policy. The recipients are:

• Processors (Art. 28 GDPR): Hetzner Online GmbH (hosting, section 4.1), Cloudflare (section 4.2) and Mailjet (section 15).
• Specialist services that our server queries without your IP address (section 8), and OpenFreeMap, which your browser calls directly (section 7).
• Partner network and partner portal, exclusively after you click a partner link (section 16).

Within Camperada, only the operator has access to stored data. To administer the services and to process feedback, deletion requests and abuse reports, the operator may view account data, saved trip plans (including those not shared), vehicles, layouts and feedback. Disclosure to authorities takes place only where we are legally obliged to do so.

20. Transfers to third countries

Our own servers and the processors for hosting and email dispatch process your data within the European Union. In the following cases, data is transferred to countries outside the European Economic Area:

• Cloudflare (USA): delivery via the Cloudflare network (section 4.2) is safeguarded by the certification of Cloudflare under the EU-US Data Privacy Framework (adequacy decision of the European Commission, Art. 45 GDPR) and additionally by standard contractual clauses (Art. 46(2)(c) GDPR).
• United Kingdom: the OpenStreetMap Foundation (Nominatim, section 8) has its seat in the United Kingdom. An adequacy decision of the European Commission exists for the United Kingdom (Implementing Decision (EU) 2021/1772, renewed until 27 December 2031). Moreover, your IP address never goes to Nominatim, only the request of our server. Direct Ferries (section 16.4) is also based in the United Kingdom; data reaches it not from us but from your browser when you click the partner link.
• USA (Wikimedia): the Wikimedia Foundation (section 8) is queried exclusively by our server, and only with the title of the article and the file name of the photo. No transfer of personal data therefore takes place.
• TradeTracker (partners outside the EU): the partner network TradeTracker (section 16.4) states in its privacy notice that its partners may process personal data outside the EU as well, safeguarded by standard data protection clauses (Art. 46(2)(c) GDPR). This processing begins only with your click on a partner link to Eurocampings or PiNCAMP; data reaches it not from us but from your browser.

If a processor exceptionally accesses data from another third country in the course of maintenance or support, this is safeguarded by the standard contractual clauses of the European Commission (Art. 46(2)(c) GDPR). You can obtain a copy of the respective safeguards on request via the address given in section 1.

21. Storage period

• Server log data: limited in size, continuously overwritten (section 4.1).
• Audience measurement: individual requests and events 13 months, after that only daily totals without any identifier; raw data of the click and scroll maps 30 days (section 5).
• Error reports: 90 days (section 4.5).
• Caches of the specialist services: minutes to hours, sights up to seven days; route results without personal reference 90 days after the last retrieval; reach calculations up to 24 hours (section 8).
• Trip plans without an account: six months after last opening (section 10.3).
• Trip plans, vehicles, layouts and account data: until deletion by you or at your request (sections 10 to 12).
• Sessions and confirmation links: until expiry, then a daily clean-up run (section 11).
• Never confirmed, unused accounts: 30 days without use, at the earliest 30 days after registration (section 11.2); daily clean-up run.
• Feedback and support histories: 18 months after the last message in a case, earlier at your request (section 14); daily clean-up run.
• Statements of the partner networks: eight years from the end of the calendar year in which they were issued (Section 147(3) AO, Section 14b UStG; section 16.2). The individual booking reports remain on the platform of the respective network under its own periods (section 16.4).

Apart from that, there are no statutory retention obligations for this data. Backup copies of the database are kept for 30 days and then deleted. Deleted data may still be contained in them until then; backup copies are used exclusively for recovery after a failure.

22. Your rights

You have the following rights against us with regard to the personal data concerning you:

• right of access (Art. 15 GDPR),
• right to rectification (Art. 16 GDPR),
• right to erasure (Art. 17 GDPR),
• right to restriction of processing (Art. 18 GDPR),
• right to data portability (Art. 20 GDPR),
• right to object (Art. 21 GDPR, see section 23).

This concerns the data actually held by us: saved trip plans, the data of an account, feedback together with any address provided with it and our replies, and the server log data. You rectify the name, email address and password of your account yourself in the account settings; you change trip plans and vehicles in the planner; you delete your account yourself (section 11.5). For all other matters, an informal email to the address given in section 1 suffices. To protect against unauthorised requests, we answer requests concerning an account only to the account address and requests concerning a save code only to persons who state the code; for plans that are assigned to an account and not shared, the account address alone applies. On request, we provide your trip plans and vehicle data in a machine-readable format; for routes, the GPX and KML export of the planner is also available to you at any time.

23. Right to object (Art. 21 GDPR)

24. Right to lodge a complaint with a supervisory authority

Without prejudice to any other remedy, you have the right to lodge a complaint with a data protection supervisory authority, in particular in the Member State of your habitual residence, place of work or place of the alleged infringement (Art. 77 GDPR). The authority competent for the seat of the controller is:

Der Landesbeauftragte für den Datenschutz Niedersachsen (State Commissioner for Data Protection of Lower Saxony)
Prinzenstraße 5
30159 Hannover
Phone: 0511 120-4500
Email: [email protected]

25. Obligation to provide data

You are neither legally nor contractually obliged to provide personal data. However, without an email address and password we cannot create an account, without your coordinates we cannot calculate a route, and without an email address we cannot answer feedback sent without an account. Failure to provide data has no further consequences.

26. No automated decision-making

No automated decision-making, including profiling, within the meaning of Art. 22 GDPR takes place.

27. Changes to this privacy policy

We adapt this privacy policy when Camperada, the services used or the legal situation change. The current version is available on this page. The German version is authoritative; the English version is a translation of the same version.

Version: 29. Oktober 2026 (same version as the German original)