Privacy policy for the RADar! reporting platform

A. Controller in the sense of the General Data Protection Regulation (GDPR)

The controller pursuant to Article 4(7) GDPR for the responsible for processing of your personal data when you use the RADar! reporting platform is:

Klima-Bündnis der europäischen Städte mit indigenen Völkern der Regenwälder Services GmbH
Eschborner Landstraße 42-50
60489 Frankfurt am Main
Germany

Tel.: +49 69 717139-0
info@klimabuendnis-services.org

Klima-Bündnis der europäischen Städte mit indigenen Völkern der Regenwälder | Alianza del Clima e. V. is the 100% shareholder of Klima-Bündnis der europäischen Städte mit indigenen Völkern der Regenwälder Services GmbH.

As we operate the RADar! reporting platform together with the participating municipalities and they may use the processed data for their own purposes as described below, we are jointly responsible for the processing of data together with the municipality for which you have registered (e.g. the municipality in which you live). We have concluded an agreement on joint responsibility with the participating municipalities in accordance with Article 26 GDPR.

We have appointed a data protection officer. They can be reached at the following address or via email:

Jota Rechtsanwälte PartG mbB
Dr. Christian Velten
Schiffenberger Weg 61
35394 Gießen
Germany

Tel.: +49 641 97 27 668
info@datenschutz-mittelhessen.de
 

B. What data do we process and for what purposes?

When you register on the RADar! website or app, or when you serve as a local RADar! coordinator for a participating municipality, we will process your personal data. Which personal data this is and what purposes we process it for may vary depending on the specific use. In the following, we would like to provide an overview of which uses are possible and which personal data we process in this case. We also explain the purpose of data processing and the respective legal basis. It essentially follows the typical process when the various participation options are used, from registration through to deletion of the data.

I. Data processing during registration on the RADar! website or app

You must register if you actively want to use the RADar! reporting platform and RADar! app. You can either register in the app or online via the RADar! website.

The following personal data is collected when you register to use the RADar! reporting platform:

• first name
• last name
• email address
• username
• password (encrypted)
• form of address
• municipality (optional)

This data is processed pursuant to Article 6(1)(a) GDPR in conjunction with Article 7 GDPR based on the voluntary consent you gave while registering in the RADar! app or on the RADar! website. The purpose of data collection is to enable you to actively use the RADar! reporting platform via the RADar! website and app.

II. Processing of the personal data of local coordinators

If you manage the RADar! reporting platform as the local coordinator for a municipality, we process the following personal data:

• first name
• last name
• email address
• username
• password (encrypted)
• municipality
• function
• department/division (optional)
• telephone number
• address

This data is collected to enable you to manage the reporting platform for your municipality as the local coordinator and, if necessary, to also use the reporting platform yourself as a cyclist. The data is processed based on a legitimate interest pursuant to Art 6(1)(f) GDPR, namely the smooth management of the reporting platform for the participating municipalities. We need local coordinators for this, who serve as the contact persons for participating cyclists and manage the reporting platform locally. If you actively use the RADar! reporting platform as a cyclist, the data processing detailed in sections III to VI also applies.

All data collected during the registration of cyclists and local coordinators is automatically stored on the servers of our service providers, Timme Hosting GmbH & Co. KG and Hetzner Online GmbH. We have concluded an order processing contract with the service providers within the sense of Article 28 GDPR.

III. Data processing while using the RADar! app

In addition to our website, we offer a mobile app that you can download to your mobile device. When you download the mobile app, the required information is transmitted to the app stores. Specifically, your username, email address and the customer number for your account, time of download, payment information where applicable and your unique device identification number. The app stores also collect various data independently and provide you with analysis results. We have no influence whatsoever on this data processing and are not responsible for it. We only process the data to the extent necessary to download the mobile app to your mobile device.

Using the RADar! app allows you to easily and conveniently report issues with the cycling infrastructure directly. The same data is collected as for use via the website:

• GPS coordinates (longitude and latitude, altitude, date, time, accuracy)
• time of report (date, time)
• time of last change (date, time)
• address
• report category/reason
• report coordinates (longitude and latitude)
• report status (not yet processed, currently being processed, processed, neutral, positive)
• first name of the reporting person
• last name of the reporting person
• username of the reporting person
• email address of the reporting person
• municipality/regional key (AGS/ARS)

You additionally have the option of providing the following information:

• description of the issue
• up to 3 photos of the issue
• comments on your own and other people’s reports

We use the interactive map provided by the Open Street Map service. The following personal data will be processed:

• IP address
• longitude and latitude of the pin

For more information on the handling of user data, see OSM’s privacy policy:
https://wiki.osmfoundation.org/wiki/Privacy_Policy

The data is processed pursuant to Article 6(1)(a) GDPR based on the voluntary consent you gave during registration. With regard to processing of the content of the request, access status, operating system, device ID and type of smartphone used, there is also a legitimate interest in data processing, as we need this data to be able to provide the technical features of the app and to optimise the display for your smartphone model and operating system as well as to ensure the security of our app. As such, the legal basis is Article 6(1)(f) GDPR.

IV. Data processing while using the RADar! website

As an alternative to using the RADar! app, you can submit reports via the RADar! website (radar-online.net).

For technical reasons, Climate Alliance automatically collects and saves information in its server log files that has been transmitted by the user’s browser. This includes the following information:

• browser type/version
• operating system used
• referrer URL (page previously visited)
• host name of the accessing computer (IP address)
• date and time of the server query
• files viewed
• data volume sent

Climate Alliance is not able to link this data to a specific person. Nor is this data combined with any other data sources. It will be deleted following a statistical analysis.

We use the interactive map provided by the Open Street Map service. The following personal data will be processed:

• IP address
• longitude and latitude of the pin

For more information on the handling of user data, see OSM’s privacy policy: 
https://wiki.osmfoundation.org/wiki/Privacy_Policy

We collect the following information when RADar! reports are submitted:

• time of report (date, time)
• time of last change (date, time)
• address
• report category/reason
• report coordinates (longitude and latitude)
• report status (not yet processed, currently being processed, processed, neutral, positive)
• first name of the reporting person
• last name of the reporting person
• username of the reporting person
• email address of the reporting person
• municipality/regional key (AGS/ARS)

You additionally have the option of providing the following information:

• description of the issue
• up to 3 photos of the issue
• comments on your own and other people’s reports

We process the following information when comments are submitted about a particular RADar! report:

• first name of the commenting person
• last name of the commenting person
• email address of the commenting person
• username of the commenting person
• time of comment

This data is collected when you submit your comment and is automatically stored on the servers of our service providers, Timme Hosting GmbH & Co. KG and Hetzner Online GmbH. We have concluded an order processing contract with the service providers within the sense of Article 28 GDPR. This data is processed for the purpose of providing you with a simple way of informing your municipality of issues with the local cycling infrastructure and, in particular, hazards and opportunities for improvement. Your contact details are collected to enable your municipality to contact you directly regarding your report.

For RADar! reports submitted in Hesse:

As many municipalities in Hesse use two tools in parallel, namely the RADar! reporting platform and the Meldeplattform Radverkehr (MPR) cycle traffic reporting platform (www.meldeplattform-radverkehr.de), the reports submitted by users of the RADar! reporting platform in Hesse are forwarded to the MPR as read-only reports. These reports are transmitted to the MPR’s specialised users without any references to individual persons. The MPR is operated by ivm GmbH (the integrated traffic and mobility management office in Frankfurt for the Rhine-Main region). For the privacy policy of ivm GmbH, see www.meldeplattform-radverkehr.de/datenschutz (in German only).

The contact details of the local RADar! coordinators in the municipalities are also transmitted to the MPR’s specialist users to ensure that the processing status of the suggestions for improvements to the cycling infrastructure that cyclists submit can also be displayed in RADar!

The data is processed pursuant to Article 6(1)(a) GDPR based on the voluntary consent you gave during registration.

V. Sending of newsletters and automated emails

Climate Alliance uses Mailjet to send:

• newsletters relating to the RADar! reporting platform
• mailouts to participating cyclists and local coordinators containing information specifically about the reporting platform
• automated emails (e.g. confirmation of registration, password reset, etc.)
• notifications to the reporting person and local coordinator regarding the receipt of and changes to reports

We use the services of Mailjet SAS for this: 13, rue de l’Aubrac, 75012 Paris, France (global HQ). Mailjet among others allows users to organise and analyse the sending of newsletters; the data of subscribers to the newsletter is stored on Mailjet’s servers. We can use Mailjet to analyse whether an email has been opened and which links, if any, have been clicked. The email addresses we have on file are only used to email important information about the CITY CYCLING campaign to subscribers.

We provide an unsubscribe link in each newsletter. It is alternatively possible to unsubscribe via email (info@radar-online.net).

See here for Mailjet’s privacy policy: www.mailjet.com/de/rechtliches/datenschutzerklaerung.

Please note:

Municipalities are alternatively able to use external service providers to send out municipality-specific newsletters for the campaign itself. They are obliged to conclude a data processing agreement within the sense of Article 28 as part of an agreement on joint responsibility.

C. Who has access to the collected data?

Climate Alliance and the local coordinators involved in the RADar! reporting platform use the data detailed in Section B exclusively in connection with the RADar! reporting platform and the associated CITY CYCLING campaign as well as the RiDE project. For RADar! and CITY CYCLING this includes for:

• maintenance and management (creation, deletion, adjustment) of the coordinator accounts in the participating municipalities
• maintenance and management (creation, deletion, adjustment) of the participating cyclists’ accounts in the participating municipalities
• sending newsletters and confirmations of bookings and account activations from Climate Alliance to the local coordinators
• sending emails from Climate Alliance to the participating cyclists
• sending newsletters and municipality-specific information from RADar! coordinators to participants in their municipality
• sending emails between RADar! coordinators (or those commissioned by the municipality) and the reporting persons (e.g. in the event of specific queries/concerns regarding reports submitted)
• emails to forward reports to the relevant authorities
• managing the reports submitted by cyclists (e.g. status changes and writing of publicly visible comments)
• exporting reports (including report details) to an Excel or shapefile format

In addition, the details (first and last names, email address and telephone number) of a local coordinator will be displayed for each municipality in the contact field of the publicly visible map. This data is automatically taken from the licence booking, but can be edited.

The RiDE project uses the data detailed in Section B to provide reports without the personal details of any cyclists or coordinators in addition to the data on cycling (e.g. to aid in its interpretation). RiDE is a project by flow.d GmbH, which involves analysing the journeys completed by bike that are tracked using the CITY CYCLING app for municipal bicycle traffic planning. For the privacy policy of flow.d GmbH, see www.flow-d.de/datenschutz.

The parties listed in Section C process the data to support local coordinators in their editorial, organisational and communication work to manage the RADar! reporting platform and the associated CITY CYCLING and RiDE projects. Processing or use for commercial purposes or any other purpose is not permitted. The transfer of data to those involved in the campaign is based on your voluntary consent within the sense of Article 6(1)(a) GDPR. As mentioned in the introduction, we have concluded a joint responsibility agreement with the participating local authorities.

D. Storage and processing of personal data

Any personal data that is stored will be irretrievably deleted immediately as soon as it is no longer needed for the purposes for which it was collected and/or as soon as a user requests this and no legal basis exist anymore for its storage.

To facilitate the use of the reporting platform, users’ access details will remain valid for a maximum of two further years. This means that they will not need to re-register every year. To ensure the efficient use of storage capacities, user accounts that have not been accessed for more than two years will be deleted. The same applies for inactive accounts for which the registration was not confirmed.

Climate Alliance and the responsible RADar! coordinators may store the aforementioned data of people who report issues for a maximum of two years and may not pass this on to third parties without authorisation.

The report data from the RADar! reporting platform is available to the responsible parties in the respective municipality for different periods of time depending on the licence model booked. The report processing period – so the period during which the local RADar! coordinators in the municipalities are able to process and manage reports – is one or three years as standard. The participating municipalities are able to extend this period at any time and as often as desired.

To be able to inform reporters of the status of their reports, the report data will be anonymised at the latest five years after the report was submitted. Personal identification will then no longer be possible. Only the report itself and its status (not yet processed, currently being processed, processed, neutral, positive) will be retained.

E. Withdrawal of consent

As explained above, we process your personal data pursuant to Article 6(1)(a) GDPR based on your voluntary consent that you gave via one of the various registration options. Please be advised that you have the right to withdraw your consent at any time. The withdrawal of your consent is effective for the future. This means that any processing in the period prior to receipt of your withdrawal remains lawful. To exercise your right of withdrawal, send an email to info@radar-online.net or write to the postal address provided at the start of this privacy policy.

F. Information on the right to object

You have the right to object at any time to the processing of your personal data for direct marketing purposes. You also have the right to object at any time on grounds relating to your particular situation to processing which is based on points (e) or (f) of Article 6(1) GDPR (Article 21 GDPR).

G. Transfer of personal data to third countries outside the EU and EEA

We do not transfer your personal data to third countries outside the EU or EAA.

H. Further rights of data subjects

Insofar as the legal requirements are met, you have the following additional rights:

• right of access (Art. 15 GDPR)
• right to rectification (Art. 16 GDPR)
• right to erasure (Art. 17 GDPR)
• right to restriction of processing (Art. 18 GDPR)
• right to data portability (Art. 20 GDPR)

You moreover have the right to lodge a complaint with a supervisory authority. You can, for example, lodge a complaint with the supervisory authority where our head office is located, namely the Hessian Commissioner for Data Protection and Freedom of Information in Wiesbaden (datenschutz.hessen.de).

Please do not hesitate to contact us at any time in case of questions about this privacy policy or our data processing (info@radar-online.net).

Last updated: 28 October 2024