Privacy Policy

This is a courtesy translation for your convenience. Only the German version is legally binding.

1. Controller

The controller for data processing on this website is:
Julius Bonaventura & Azad Aygün GbR · Stadtspur Passau
Steininger Gasse 5, 94032 Passau, Germany
represented by its partners Julius Bonaventura and Azad Aygün
Email: kontakt@stadtspur-rallye.de

2. Data protection at a glance

The following notes give an overview of what happens to your personal data when you visit this website and play the game. We process as little data as possible. We only use analytics and marketing services with your prior consent (see section 8).

3. Local storage & session management

Without your consent we do not set any analytics or marketing cookies. For the technically necessary operation of the game we use your browser's "local storage" as well as a random, anonymous session ID in order to save your game progress, your settings and your ticket code. To enable a seamless change of device (e.g. when your battery runs out) and to prevent misuse (link sharing), your current game progress is transmitted to our servers and linked to your ticket code. The legal basis is performance of the contract (Art. 6(1)(b) GDPR) and our legitimate interest in the security of our systems (Art. 6(1)(f) GDPR).

On the website we also create up to three small local storage entries so that a purchase can be attributed correctly: the code of a partner business if you arrive via its QR code (for settling the partner commission, deleted after 2 hours), the source of your visit, e.g. "Google search" or "Google ad" (without any identifier of your person, deleted after 30 days), and, only with your consent to marketing, the click ID of a Google ad (see section 8, deleted after 90 days). These details are only transmitted to us when you buy or submit the company enquiry form, together with the order or the enquiry. For a company enquiry we also store which page of our website you opened the form from. The legal basis is our legitimate interest in evaluating our advertising channels and partnerships (Art. 6(1)(f) GDPR).

4. Access to camera, microphone & location

Some puzzles require access to your device's camera, microphone or location (e.g. for AR features, text recognition or navigation to the next place). Processing takes place exclusively locally on your device. No image, audio or location data is transmitted to us or to third parties, nor is it stored. These permissions are only used after you have expressly granted them via the browser.

4a. Voluntary photo submission

At the end of the rally you can voluntarily send us your final photo so that we may publish it on our website. This transmission only takes place if you actively tap the send button; that click is your consent, there is no pre-ticked box. The team name you have chosen is published together with the photo; we also store the time of submission and technical metadata. The legal basis is your consent (Art. 6(1)(a) GDPR). Submitted photos are not published immediately but are first reviewed by us; we only publish selected photos. By submitting you confirm that all people shown agree to the publication. You may withdraw your consent at any time with effect for the future and request deletion at kontakt@stadtspur-rallye.de.

4b. Public leaderboard

After completing the rally, your team appears in the public leaderboard on the game page with the team name you chose, the score achieved and your playing time. For that reason, please choose a team name that does not allow conclusions about real names if you do not want that. The legal basis is our legitimate interest in a shared gaming experience (Art. 6(1)(f) GDPR). On request we will remove your entry at any time, informally by email to kontakt@stadtspur-rallye.de.

5. Payment processing (Stripe)

For payments we use the payment service provider Stripe (Stripe Payments Europe, Ltd., 1 Grand Canal Street Lower, Dublin, Ireland). You enter your payment details (e.g. card number) directly on the secure payment page hosted by Stripe; they are processed by Stripe and do not reach our servers. From Stripe we only receive information about the payment status as well as your email address in order to send you the access code. We store the email address together with the order on our server and also use it to send you a results email after the rally containing our travel guide PDF and a request for a review (Art. 6(1)(f) GDPR, § 7(3) UWG). You may object to this use at any time and informally, e.g. by email to kontakt@stadtspur-rallye.de. The legal basis is Art. 6(1)(b) GDPR. Further information: stripe.com/privacy.

6. Hosting & server log files

We host our website with an external provider (processor). When the site is accessed, technically necessary access data (e.g. IP address, date/time, file requested) is processed in server log files. This serves the secure and stable operation of the site (Art. 6(1)(f) GDPR). These logs are only stored for a short time and are deleted regularly.

7. Fonts & technical libraries

All fonts of the website and the game are hosted on our own server. No connection to Google or any other font provider is made for this when you load a page.

For text recognition in some camera puzzles, the game loads the program library Tesseract.js including language data via the content delivery network jsDelivr, only at the moment you start such a puzzle. For technical reasons your IP address is transmitted to the operator of the network. Your camera images do not leave your device. The legal basis is performance of the contract for the game (Art. 6(1)(b) GDPR) and our legitimate interest in working text recognition (Art. 6(1)(f) GDPR).

7a. Videos in the game (YouTube)

In two puzzles we show short videos embedded via YouTube (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland). We use the privacy-enhanced mode (youtube-nocookie.com). As soon as such a puzzle is displayed, your browser loads the video from YouTube's servers. In the process your IP address and technical information about your device are transmitted to YouTube, possibly also to the USA. The video starts automatically without sound; during playback YouTube may collect further usage information and store it on your device. The legal basis is performance of the contract for the game (Art. 6(1)(b) GDPR) and our legitimate interest in vivid puzzle design (Art. 6(1)(f) GDPR). For transfers to the USA there is an adequacy decision of the EU Commission (EU-US Data Privacy Framework) under which Google is certified. More information: policies.google.com/privacy.

8. Analytics & marketing (only with consent)

In the cookie banner you can decide separately: the Statistics category controls Google Analytics 4 only, the Marketing category controls Google Ads only. You can therefore accept one category and decline the other; necessary functions (ticket purchase, game progress, language setting) work independently of this. If you consent, we use the corresponding services via Google Tag Manager, namely Google Analytics 4 and Google Ads (Google Ireland Ltd.). These services use cookies or similar technologies in order to analyse the use of the website and to measure the effectiveness of advertising. In doing so, your IP address may be transmitted to the providers' servers (possibly in the USA). The legal basis is your consent (Art. 6(1)(a) GDPR, § 25(1) TDDDG). Without consent these services are not loaded (Google Consent Mode v2). In Google Analytics the "Google signals" feature is also enabled: for users who are signed in to their Google account and have allowed personalised advertising there, Google links the session data collected on this website with information from the Google account; from this we receive exclusively aggregated, non-personal reports (e.g. on demographics, interests and cross-device use). You can view this link in your Google account (among others under "My Activity" or the settings for personalised advertising) and deactivate it at any time. You may withdraw your consent at any time with effect for the future: open cookie settings again. Your selection will then be reset and you can decide anew.

8a. Email notifications (city reminders, travel guide & news)

If you sign up on the website to be notified about an upcoming city, or if at the end of the rally you expressly tick that you would like to be informed about new rallies, offers and discounts, we store your email address (together with the city you selected, where applicable) for this purpose. The legal basis is your consent (Art. 6(1)(a) GDPR). For a city reminder we use the address exclusively for the one-off notification when the selected city launches; further advertising only takes place with separate consent. If you provide your email address at the end of the rally solely to receive the travel guide PDF (without ticking the box), we use it exclusively for that one-off delivery and do not store it in a mailing list. You may withdraw your consent at any time with effect for the future, e.g. informally by email to kontakt@stadtspur-rallye.de; we will then delete your address from the mailing list.

8b. Contact & corporate enquiries

If you contact us by email, WhatsApp or via the enquiry form for companies and groups, we process the details you provide (in the corporate form: company name, name of the contact person, email address, optionally telephone number, number of participants, preferred date and your message, plus the source of your visit as described in section 3) exclusively in order to handle the enquiry and to prepare a quote. The legal basis is Art. 6(1)(b) GDPR (steps prior to entering into a contract) or Art. 6(1)(f) GDPR (legitimate interest in responding to enquiries). The details are stored on our server and deleted as soon as they are no longer required for processing and no statutory retention obligations (e.g. for business letters and invoices) prevent deletion.

9. Your rights

You have the right at any time to information, rectification, erasure, restriction of processing, data portability and to object to the processing of your data. Please contact kontakt@stadtspur-rallye.de. You also have the right to lodge a complaint with a data protection supervisory authority, for example the Bavarian State Office for Data Protection Supervision (BayLDA).