Privacy Policy

1. Overview

This privacy policy applies to the website dragonboathub.de and to the "DragonBoat Hub" mobile app for iOS and Android (together, the "Service"). It explains which personal data we collect, how we use it and what rights you have.

Personal data means any information relating to an identified or identifiable person, e.g. name, email address or usage data.

2. Controller

The controller for data processing within this Service is:

Maximilian Flechtner
Medienagentur Maximilian Flechtner
Leppiner Dorfstraße 60
39619 Arendsee, Germany

Phone: +49 176 41766223
Email: flechtner@robocitrus.com

3. What data do we collect?

Data you provide to us

When you use our Service, we collect data that you actively provide:

• Email address and password on registration
• Name and profile information
• Team and club data (paddlers, seat plans, events)
• The content of your communications when you contact us

Data collected automatically (website)

When you visit our website, our servers automatically record:

• IP address
• Browser type and version
• Operating system
• Referrer URL
• Time of access

This data is not merged with other sources and is used exclusively for the technical operation of the website.

Data collected automatically (app)

When you use the app, the following data may be collected automatically:

• Device type, operating system and app version
• Crash reports and performance data
• Usage statistics (anonymised)

Health and fitness data

If you enable the optional Health & Fitness feature, the app may access data from Apple Health or Google Fit with your explicit consent. This data is processed exclusively locally on your device and is not transmitted to our servers.

4. Purpose and legal basis of processing

Performance of a contract (Art. 6(1)(b) GDPR)
Provision and operation of the Service, user account management, handling of subscriptions.

Consent (Art. 6(1)(a) GDPR)
Optional access to health data, non-technical cookies (where used).

Legitimate interest (Art. 6(1)(f) GDPR)
Technical operation and security of the website and app, server log files, troubleshooting.

5. Event submissions via the web form

Using the public submission form on this website, organisers can propose dragon boat events which, after editorial review, appear in the public event calendar. No account is required for this.

What data do we collect?

In the form you submit in particular the following details:

• Name of the event
• Date, time and location (including address)
• Description as well as optional contact and link details (website, phone, organiser's email)
• Optionally uploaded files (e.g. race announcement, images)
• Your contact email address as the submitting person — for queries, status notifications and, where applicable, withdrawal of the submission

In addition, we technically process your IP address at the time of submission as well as spam protection signals (e.g. time spent on the form, honeypot field).

Legal basis: legitimate interest (Art. 6(1)(f) GDPR)
We process your details for editorial moderation of submissions, to contact you with queries and to prevent abuse (spam, fake events, unlawful content). Without this processing, operating an open submission form would not be reasonably feasible.

Storage and encryption

• Your contact email address is stored exclusively in encrypted form (AES-256-GCM, "encryption at rest"). The address is never persisted in plain text at any point.
• Your IP address is hashed with a server-side salt (SHA-256) and never stored in plain text. Reconstructing the original IP is therefore not possible according to the current state of the art.
• The event content itself (name, location, date, etc.) is displayed publicly if the submission is approved — you deliberately submit this content for publication.

Retention periods

• Approved submissions: Your contact details as the submitting person are deleted no later than 90 days after submission. The approved event remains visible in the calendar — detached from your personal data.
• Rejected submissions: Deleted in full, including all uploaded files, no later than 30 days after the moderation decision.
• Withdrawn submissions: If you withdraw your submission via the withdrawal link, all associated data and files are deleted in full within 1 hour.

Deletion is carried out automatically by a background process that runs hourly ("EventSubmissionPurgeTask").

Your rights regarding submitted data

You may at any time request information about the submissions stored under your email address, request their deletion, or withdraw a submission you have made. To do so, contact flechtner@robocitrus.com. Because we store your email only as a hash and in encrypted form, we must match your request via exactly that address.

6. Hosting and infrastructure

Website hosting

Our website is hosted by Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany. Data processing takes place on servers within the EU. Further information: Hetzner's privacy policy.

App backend

The app's backend runs on servers within the EU. User data is transmitted encrypted (TLS) and stored in a PostgreSQL database.

App stores

The app is distributed via the Apple App Store and the Google Play Store. For downloads and in-app purchases, the privacy policies of Apple and Google additionally apply.

7. Disclosure to third parties

As a matter of principle we do not pass your personal data on to third parties, unless:

• You have expressly consented
• Disclosure is necessary for the performance of the contract (e.g. payment processing via app stores)
• There is a statutory obligation
• Disclosure serves to assert, exercise or defend legal claims

8. Retention period

We store your data only for as long as is necessary for the respective purpose of processing or as long as statutory retention periods apply.

• User account: Until the account is deleted by the user
• Server logs: Maximum of 30 days
• Invoice data: 10 years (statutory retention period)

After deletion of your account, your data is completely removed from our active systems within 30 days. Backups are overwritten after 90 days at the latest.

9. Your rights

Under the GDPR you have the following rights:

• Access: You may request information about the data we hold about you.
• Rectification: You may request the correction of inaccurate data.
• Erasure: You may request the deletion of your data, provided no statutory retention obligation applies.
• Restriction: You may request the restriction of processing under certain conditions.
• Data portability: You may receive your data in a common format or request its transfer to another provider.
• Objection: You may object to the processing of your data based on legitimate interests.
• Withdrawal: You may withdraw consent you have given at any time with effect for the future.

To exercise your rights, contact flechtner@robocitrus.com. You also have the right to lodge a complaint with the competent data protection supervisory authority.

10. Data security

We use technical and organisational measures to protect your data against loss, misuse and unauthorised access. These include, among others:

• Encrypted data transmission (TLS/SSL)
• Encrypted storage of sensitive data
• Regular security updates
• Access restrictions and authentication

Please note that data transmission over the internet (e.g. by email) can have security vulnerabilities. Complete protection against access by third parties is not technically possible.

11. Minors

Our Service is not directed at persons under the age of 16. We do not knowingly collect personal data from children under 16. Should we become aware that a child under 16 has transmitted personal data, we will delete it without delay.

12. Changes to this privacy policy

We reserve the right to adapt this privacy policy where necessary, for example when introducing new features or due to changed legal requirements. You will always find the current version on this page. In the event of material changes, we will inform you by email or via the app.