Privacy Policy

The protection of your personal data is of particular concern to us. We therefore process your data exclusively on the basis of statutory provisions (GDPR, BDSG, TDDDG, DDG). Below, we provide detailed information about how we handle your data.

1. General, Security and Recipients

The use of our website is basically possible without providing personal data. For certain functions (e.g. login, analysis dashboard, upload of monitoring data, order of goods), however, the provision of personal data is required.

Categories of recipients:
Within our company (sole proprietorship), only those positions receive access to your data that need these to fulfill our contractual and legal obligations. In addition, we use external service providers in the following areas:

• Hosting and IT service providers (e.g. for web server and email)
• Payment service providers (for the processing of purchases and subscriptions)
• Shipping service providers (for the delivery of goods)

SSL or TLS encryption:
For security reasons, this site uses SSL or TLS encryption. You can recognize this by the address line of the browser ("https://" and the padlock symbol). Data that you transmit to us cannot be read by third parties.

2. Hosting and Server Log Files

We host our website at STRATO GmbH, Otto-Ostrowski-Straße 7, 10249 Berlin (hereinafter: Strato).

When calling up the website, Strato automatically records information in so-called server log files (IP address, browser type, referrer URL, timestamp). We have concluded a contract on order processing (AVV) with Strato according to Art. 28 GDPR.

Processing takes place on the basis of Art. 6 Para. 1 lit. f GDPR. Our legitimate interest consists in ensuring technical security, stability as well as error analysis and abuse defense of our website.

Storage duration of the log files:
The IP addresses in the log files are stored for the duration of a maximum of 7 days to detect attacks and are then anonymized. After anonymization, no conclusions about your person are possible anymore.

3. Cookies and Tracking

We use technically necessary "session cookies". These are absolutely necessary to identify you as an authorized user after login and to enable access to your territory dashboard. The legal basis for this storage is § 25 Para. 2 No. 2 TDDDG. These cookies are automatically deleted after the end of your visit (session). No tracking tools: We do not use external analysis tools (such as Google Analytics, Matomo) or advertising trackers.

Language selection cookie: If you change the language of our website, we store this setting additionally in a technically necessary cookie. This ensures that the website is displayed to you in your preferred language also during future visits or after a login/logout. The legal basis for the storage of this cookie is likewise § 25 Para. 2 No. 2 TDDDG (technical necessity) as well as our legitimate interest in a user-friendly design of the website (Art. 6 Para. 1 lit. f GDPR). The cookie is automatically deleted after 12 months.

"Keep me logged in" function: If you activate the "Keep me logged in" option when logging in, we store a permanent cookie on your device. This serves exclusively to automatically recognize you during future visits and save you from having to enter your login credentials again. The legal basis for setting this cookie is § 25 Para. 2 No. 2 TDDDG, as this storage is strictly necessary to provide the function explicitly requested by you. The subsequent processing of the login information is based on our legitimate interest in a user-friendly design of our platform (Art. 6 Para. 1 lit. f GDPR). This cookie has a lifespan of 30 days and is automatically deleted thereafter. You can delete the cookie at any time before it expires by clicking on "Log out" or by clearing the cookies in your browser settings.

4. Integration of YouTube Videos

YouTube videos are integrated on our website (two-click solution). The video is only loaded when clicking on the preview image. The videos are integrated via the platform youtube-nocookie.com, so that no personal data is transmitted before clicking.

Only when starting the video does YouTube (Google Ireland Ltd., Dublin, Ireland; if applicable to Google LLC, USA) transmit data to the platform. Google is certified according to the EU-U.S. Data Privacy Framework.

Legal basis: Art. 6 Para. 1 lit. f GDPR (legitimate interest) before clicking, Art. 6 Para. 1 lit. a GDPR (consent) after clicking.

Further information can be found in the privacy policy of Google.

5. Contacting Us

If you contact us by email or via a contact form, the data provided by you (e.g. email address, name, content of the request) will be stored in order to process your request.

The legal basis is Art. 6 Para. 1 lit. b GDPR, provided that your request is related to a contract. In all other cases, processing is based on our legitimate interest (Art. 6 Para. 1 lit. f GDPR) in the effective processing of the requests addressed to us. The data are regularly deleted after final processing of the request, provided that no statutory storage obligations conflict.

6. Registration and User Account

When registering a user account, we collect different data depending on the chosen tariff. The legal basis for this is the fulfillment of our contract with you (Art. 6 Para. 1 lit. b GDPR):

Free tariff model ("Free Package"): If you choose the free tariff, only your email address and a password chosen by you will be collected and processed. No collection or forwarding of payment data to external service providers takes place in this tariff.

Paid premium tariffs / upgrades: If you choose a paid tariff or carry out an upgrade, we additionally process the data required for payment processing and transmit these to our payment service provider Mollie (see point 7).

Obligations to provide proof (log data): To secure our systems and to be able to prove the conclusion of the contract as well as the consent to our GTC and privacy policy in case of doubt, we store the exact time and the IP address used for registration as well as for any cancellation. The legal basis for this is our legitimate interest in legal protection (Art. 6 Para. 1 lit. f GDPR) as well as our statutory obligation to provide proof (Art. 6 Para. 1 lit. c in conjunction with Art. 7 Para. 1 GDPR).

7. Payment Processing (Mollie)

To process payments (e.g. for subscriptions or purchases of goods), we use the payment service provider Mollie B.V. (Keizersgracht 126, 1015 CW Amsterdam, Netherlands). Mollie enables us to accept various payment methods (e.g. credit card, SEPA direct debit, SOFORT, PayPal, Apple Pay). When you make a payment, your payment data is transmitted directly to Mollie.

Credit card and other payments: Your sensitive payment information (e.g. credit card number, IBAN) is processed exclusively by Mollie. We do not store these data ourselves. For technical assignment of your payments and to manage your subscription, we only store reference data of the payment service provider in our database (e.g. Customer ID, transaction numbers, stored payment email address).

PayPal: When paying via PayPal, a data transfer to PayPal Inc. (USA) can take place. The transfer takes place on the basis of the EU-U.S. Data Privacy Framework or standard contractual clauses to ensure an appropriate level of data protection.

Since Mollie is based within the European Union, no transfer to an unsafe third country takes place for all other payment methods. The high European data protection standards of the GDPR apply.

The legal basis for the transfer and processing of the data is Art. 6 Para. 1 lit. b GDPR (contract fulfillment). Further information on data protection at Mollie can be found at: https://www.mollie.com/en/legal/privacy.

8. Order of Goods and Shipping (Merchandise)

If you order physical goods, we process your name and your address.

Transfer to shipping service providers: For the purpose of delivery, we pass your address data on to the commissioned transport company (e.g. DHL, Hermes). Legal basis: Art. 6 Para. 1 lit. b GDPR.

9. Monitoring Data, Image Metadata, Invitation Function and Wolf Reports

When you upload wildlife sightings or image metadata, they are stored assigned to your user account. This includes timestamps, animal species and, if applicable, GPS coordinates. This data serves exclusively your personal territory statistics.

Invitation of co-users: If you use the function to invite other persons (e.g. co-users), we process the email address of the third party provided by you exclusively for sending the invitation email and for technical assignment to the territory. The inviter is responsible for ensuring that he is entitled to pass on the email address to us.

If you invite co-users, they will receive access to the data released by you. Processing takes place for contract fulfillment (Art. 6 Para. 1 lit. b GDPR).

Wolf report feature: When you use our wolf reporting function, the location data and details of the sighting are stored in your private history. If you give your express consent (Art. 6 Para. 1 lit. a GDPR) via the corresponding checkbox during the report, these data as well as any uploaded evidence image will be forwarded by email directly to the responsible bodies (e.g. hunting association, wolf management). For data protection reasons, the image is used exclusively for this dispatch and is completely deleted from our servers immediately after transmission.

10. Use of our Hegemonitor App (Google Play Store)

In addition to our regular website, we offer Hegemonitor as a mobile app. Technically, this is a so-called Trusted Web Activity (TWA), which essentially represents our website optimized for mobile devices as an app experience.

Data processing: Data processing in the app does not differ from use in a regular web browser. No additional app-specific tracking tools (such as Firebase Analytics) are used.

Device permissions: If you want to upload wildlife camera images or proof photos (e.g. for wolf reporting) within the app, your operating system asks you for permission to access your camera or your device storage. This permission is only used for the upload process actively initiated by you. We never secretly read your memory in the background at any time. You can revoke these permissions at any time in the settings of your smartphone.

11. Storage Duration and Account Deletion

Personal data are deleted as soon as they are no longer necessary for the achievement of the purpose of their collection. In the case of a regular account deletion, all data are removed, provided that no statutory storage obligations conflict (e.g. 10 years for tax-relevant documents for purchases of goods).

Automatic deletion for inactivity (Free Package):
If you use the permanently free tariff model ("Free Package"), an automated deletion routine takes effect to avoid "data corpses" (Art. 5 Para. 1 lit. e GDPR):

Inactivity period (90 days): If you have not uploaded and evaluated a wildlife camera image for more than 90 consecutive days, your account will be classified as inactive. A mere system login does not interrupt this period.

Notification: After these 90 days have expired, you will receive an email informing you of the impending deletion.

Irrevocable deletion: If you do not perform an active image evaluation within a further 30 days after receiving this email, your account will be automatically deleted after a total of 120 days of inactivity. All profile data, linked camera settings, image data and statistics will be irrevocably deleted.

The legal basis for this is the fulfillment of the contract (Art. 6 Para. 1 lit. b GDPR) as well as our legitimate interest in the resource-efficient provision of our server infrastructure (Art. 6 Para. 1 lit. f GDPR).

12. Your Rights

You have the right at any time to free information about your stored personal data, their origin and recipients and the purpose of the data processing as well as a right to correction, deletion or restriction of processing and the right to data portability.

Withdrawal of consent: Many data processing operations are only possible with your express consent. You can withdraw an already given consent at any time. An informal message by email is sufficient.

13. Data Controller

Christoph Biebel
c/o Online-Impressum #7452
Europaring 90
53757 Sankt Augustin
Phone: +49 177 7489104
E-Mail: webmaster@hegemonitor.de

14. Further Mandatory Information

• Provision of data: The provision of your personal data is required for the conclusion of a contract (use of the software or purchase of goods). Without the provision of data, we cannot provide the services.
• Automated decision-making: Automated decision-making including profiling (according to Art. 22 Para. 1 and 4 GDPR) does not take place.

15. Right of Complaint

You have the right to complain to the responsible data protection supervisory authority (e.g. Bavarian State Office for Data Protection Supervision) if you believe that the processing of your data violates the GDPR.