Privacy Policy

Who is responsible for your data

The controller within the meaning of the General Data Protection Regulation (GDPR) is:

Avioron UG (haftungsbeschränkt) Falkenring 13 85570 Markt Schwaben Germany Email: oma@bei-oma-ernst.de

Hosting and server logs

Our website is operated by a service provider in a data centre within the European Union. On every visit, the server automatically records technical access data in log files: your shortened or full IP address, date and time, the address requested, where applicable the previously visited page, and information about your browser and operating system.

We need this data to deliver the website, to ensure stability and security, and to analyse errors. For evaluation we consolidate the logs in an internal logging system. The legal basis is our legitimate interest in secure, functioning operation (Art. 6(1)(f) GDPR).

Cookies and local storage

For the operation of the site itself we set only a few strictly necessary cookies:

If you sign in, we store a login cookie (named “th_user”). It maintains your session, is protected against being read by scripts (httpOnly) and expires after 90 days. Without signing in it is not set. The legal basis is the performance of the usage relationship (Art. 6(1)(b)) or our legitimate interest (lit. f).
We store your saved list, a note with the places you last viewed, and some display settings in your browser's local storage (LocalStorage). This information stays on your device and is not transmitted to us without an account.

The third-party services listed below may set additional cookies. They are only loaded after you have given your consent.

To obtain and manage your consent we use the consent management tool “CookieYes” (CookieYes Limited, Ireland). It displays the cookie notice and stores your choice so that non-essential services — in particular the reach measurement — only load once you have agreed. You can withdraw or change your consent at any time via the cookie notice. The legal basis for the consent service itself is our legal obligation to obtain consent and our legitimate interest (Art. 6(1)(c) and (f) GDPR).

Reach measurement (Google Analytics)

Only if you have agreed do we use Google Analytics (via Google Tag Manager) to understand, in anonymised form, how our site is used. IP anonymisation is enabled, so your IP address is processed in shortened form. The provider is Google Ireland Limited; this may involve a transfer of data to the USA. The legal basis is your consent (Art. 6(1)(a) GDPR), which you can withdraw at any time with effect for the future.

Protection against misuse (Cloudflare Turnstile)

On the login form and the map search we use Cloudflare Turnstile (Cloudflare, Inc., USA) to detect automated access and misuse. Cloudflare checks technical characteristics of your browser and connection (e.g. IP address, browser properties); no cookies are set and no cross-site tracking takes place. Data may be transferred to the USA in the process; Cloudflare is certified under the EU-US Data Privacy Framework, supplemented by standard contractual clauses. The legal basis is our legitimate interest in protection against misuse (Art. 6(1)(f) GDPR).

Map display (Google Maps)

To display the campgrounds on the map we embed Google Maps (Google Ireland Limited). When the map loads, your browser establishes a connection to Google servers and transmits your IP address; here too a transfer to the USA may occur. The legal basis is our legitimate interest in a clear map display (Art. 6(1)(f) GDPR).

Fonts

We serve the fonts used from our own server. There is no connection to a font service from Google or any other third party, and no IP address is transmitted to third parties for this purpose.

Account and sign-in

An account is voluntary. We work without a password: to sign in you enter your email address and receive a one-time sign-in link (magic link). For your account we store your email address, the time of creation, the last sign-in time, the account status, and the version and time of your acceptance of our Terms of Service. If you create an account, we also transfer your saved list and your note (last viewed places) from your device to your account so they are available on all your devices. The legal basis is the performance of the usage relationship (Art. 6(1)(b) GDPR).

Your travel profile

In your travel profile you can voluntarily store details so that you don't have to retype them for every booking: name, address, phone number and date of birth, your vehicles (type and dimensions), fellow travellers, pets and general preferences. We use this information solely to make filling in forms easier for you; it is visible only to you. The legal basis is the performance of the usage relationship or your consent (Art. 6(1)(b) and (a) GDPR). You can change or delete any entry at any time.

Your travels

With “Your travels” you can plan camping trips. To do so we store the trips you create: title, period, your travel companions (from your travel profile or entered freely), the assigned pitches with their planning status, and your notes. These details are visible only to you; you can change or delete any trip at any time, and all trips are deleted with your account. The legal basis is the performance of the usage relationship (Art. 6(1)(b) GDPR).

Your camping mailbox

If you activate the camping mailbox, we bundle booking-related messages in one place. To do so we store and display the incoming messages in your account. The legal basis is the performance of the usage relationship (Art. 6(1)(b) GDPR). The mailbox is voluntary and can be switched off.

If you send a message from the mailbox, we store the recipient, time and delivery status in a sending log. We need this to prevent misuse (such as spam) and to enforce the sending limits. Outgoing messages carry your name as the sender. The legal basis is the performance of the usage relationship and our legitimate interest in abuse-free operation (Art. 6(1)(b) and (f) GDPR).

Your keychain

In the keychain you can store access credentials for camping portals. Important: your passwords are encrypted on your own device before they are transmitted to us. We store only this encrypted data and cannot decrypt or view it. The key to it lies with you alone; there is deliberately no reset mechanism. The legal basis is the performance of the usage relationship or your consent (Art. 6(1)(b) and (a) GDPR).

Wenn Oma für dich nachschaut (Plattform-Zugriff)

Besuchst du eine Camping-Plattform über Omas Begleitung (eine Adresse unter camping-apps.de), surfst du selbst auf der echten Plattform — Oma liest dabei in deinem Auftrag mit, was auf der Seite steht, und legt Buchungen und Nachrichten zu deinen Reisen und in dein Postfach. Deine Zugangsdaten bleiben dabei auf deinem Gerät: Unser Server erhält sie zu keinem Zeitpunkt und kann auch verschlüsselt gespeicherte Einträge deines Schlüsselbunds nicht lesen. Rechtsgrundlage ist die Durchführung des Nutzungsverhältnisses (Art. 6 Abs. 1 lit. b DSGVO).

Aus einem solchen begleiteten Besuch speichern wir die gefundenen Buchungen (Zeitraum, Platzname, Buchungsnummer, Preis, Status, gegebenenfalls Stornofrist) für deine Reisen sowie einen kurzen Textauszug der Buchungsseite zur Fehlersuche, der nach 90 Tagen automatisch gelöscht wird.

Diese begleiteten Plattform-Besuche leiten wir technisch über einen Weiterleitungsdienst (Proxy) des Anbieters Decodo (betrieben durch die Data troops UAB, Vilnius, Litauen). Das bedeutet: Die Verbindung zur Plattform läuft nicht direkt von unserem Server, sondern über dessen Netz. Die Verbindung ist dabei durchgehend TLS-verschlüsselt — der Dienst kann die übertragenen Inhalte, insbesondere deine Zugangsdaten, nicht mitlesen; sichtbar sind ihm nur technische Verbindungsdaten wie die Zieladresse. Der Anbieter sitzt in der Europäischen Union und ist auf Grundlage eines Auftragsverarbeitungsvertrags für uns tätig (Art. 28 DSGVO).

Jeder Lesevorgang wird protokolliert und ist für dich unter „Was Oma getan hat“ einsehbar. Sicherheitsabfragen der Plattform (etwa CAPTCHA oder Zwei-Faktor-Bestätigungen) lösen wir nie automatisch.

Du kannst die Begleitung je Plattform jederzeit abschalten („Oma soll hier nichts mehr tun“) — Oma liest dann dort nichts mehr mit. Bereits gefundene Buchungen bleiben in deinen Reisen stehen (sie gehören zu deiner Planung), werden aber nicht mehr aktualisiert; mit der Konto-Löschung verschwinden auch sie.

Activity log

So that you can trace what happens in your account, we keep a log of security-relevant events — such as sign-ins, changes to the travel profile or access to the keychain. The legal basis is our legitimate interest in transparency and security (Art. 6(1)(f) GDPR).

Usage statistics and referrals

To understand which features are used and how often we refer to camping platforms, we record individual events (for example a search, saving a campground or a click on a platform link). Referral links may contain identifiers to attribute the referral. If you are signed in, we can attribute such events to your account; otherwise we evaluate them without a personal reference. The legal basis is our legitimate interest in reach and referral measurement (Art. 6(1)(f) GDPR).

Sending emails (Brevo)

We send emails that you need in order to use the service — in particular the sign-in link and, if you use it, notifications from your camping mailbox. For sending we use the email service provider Brevo (Sendinblue Germany GmbH, Germany). Brevo processes your email address, the message content and technical delivery data in data centres within the European Union and acts as our processor on the basis of a data processing agreement (Art. 28 GDPR). The legal basis is the performance of the usage relationship (Art. 6(1)(b) GDPR).

Retention period

We store your data only for as long as it is required for the respective purpose. Account and profile data remain stored until you delete them or your account. After deletion, your account is first blocked and permanently removed after 30 days; within this period you can reactivate it by signing in again. Server logs are automatically deleted after a short time, unless they are exceptionally needed to investigate a security incident.

Your rights

Under the GDPR you have comprehensive rights: access to your stored data (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and objection to processing based on legitimate interest (Art. 21). You can withdraw consent you have given at any time with effect for the future.

You can exercise many of these rights directly in your account: under My area you will find a complete export of your data as a file as well as the option to delete your account yourself. For anything else, an informal message to oma@bei-oma-ernst.de is enough.

You also have the right to lodge a complaint with a data protection supervisory authority, for example the authority responsible for us in Bavaria (Bavarian State Office for Data Protection Supervision).

Changes to this policy

We are continuously developing Bei Oma Ernst and will amend this privacy policy whenever anything about the processing changes. The version published here applies in each case.

What the individual features mean for you is explained in detail on the page Your personal camping assistant.