1. Who is responsible
The controller for the processing of personal data on this website under the EU General Data Protection Regulation (GDPR) is:
Sinan Cekic
Schneidhainerstraße 2
61350 Bad Homburg
Germany
Email: contact@bike-pump.com
We are not required by law to appoint a data protection officer. For any question about your data, write to the address above. See also our legal notice.
2. Overview: what we collect and why
You can use FreeAirPumps without an account and without telling us who you are. We only process the data listed below. “Personal data” or “personal information” means any information that relates to you as an identifiable person, such as your IP address or email address.
| Data | When | Purpose | Who receives it | Kept for |
|---|---|---|---|---|
| IP address, date and time, page requested, browser and referrer | Every visit | Deliver the site, keep it secure | Our hosting provider | 14 days |
| IP address and the map area you view | When a map is shown | Load the map images | OpenStreetMap Foundation | See OSMF policy |
| Search text and IP address | When you search the map | Find the place you typed | OpenStreetMap Foundation | See OSMF policy |
| Your device’s location | Only if you tap “use my location” and allow it | Center the map on you | Nobody, it stays in your browser | Not stored |
| Name, email, message | When you use the contact form | Answer you | Discord (private channel) | Until handled, max. 6 months |
| Place details, optional email | When you report a location | Update the map, ask follow-up questions | Discord (private channel) | Place data: published; email: max. 6 months |
| Cookie IDs, device and usage data, approximate location | In the EU, UK and Switzerland only with your consent; elsewhere when ads are shown | Ads | Google and its ad partners | See “Advertising” |
| Cookie IDs, device and usage data, approximate location | In the EU, UK and Switzerland only with your consent; elsewhere on every visit unless your browser sends GPC | Statistics | 2 months |
We do not sell your personal information for money. How Google uses cookies on this site, and how you can refuse or opt out, is explained under “Cookies and your consent” below.
3. Legal bases
We only process personal data where the GDPR allows it. Each section below names the basis that applies:
- your consent (Art. 6(1)(a) GDPR), and for storing or reading information on your device § 25(1) TDDDG;
- a contract with you or steps you ask for before one (Art. 6(1)(b) GDPR);
- a legal obligation, for example to keep records or answer authorities (Art. 6(1)(c) GDPR);
- our legitimate interests, weighed against yours (Art. 6(1)(f) GDPR), such as running a secure website and answering inquiries.
Where no shorter period is given, we delete personal data as soon as we no longer need it for its purpose, unless statutory retention periods (for example under tax law) require us to keep it longer.
4. Visiting the website: hosting and server logs
This website runs on servers of STRATO GmbH, Otto-Ostrowski-Straße 7, 10249 Berlin, Germany. The hosting provider processes data only on our behalf and according to our instructions, under a data processing agreement (Art. 28 GDPR). The servers are located in Germany.
Whenever you open a page, your browser automatically sends information that our server records in log files: your IP address, the date and time, the page or file requested, the amount of data transferred, whether the request succeeded, the website you came from (referrer), and your browser and operating system (user agent).
We need this data to deliver the website to you and to detect and fix errors and attacks. The legal basis is our legitimate interest in a secure, working website (Art. 6(1)(f) GDPR). Logs are deleted after 14 days. If an entry is needed to investigate a specific attack, we keep it until the investigation is finished.
All connections use TLS encryption (https). Fonts, scripts and images of this website are served from our own server; we do not load fonts from Google or other font services.
5. The map and map search (OpenStreetMap)
The map images (tiles) come from the tile servers of the OpenStreetMap Foundation, St John’s Innovation Centre, Cowley Road, Cambridge, CB4 0WS, United Kingdom (OSMF). To display them, your browser connects directly to these servers and transmits your IP address, the tiles requested (which reveal the map area you are looking at), your browser’s user agent and the address of the page you are on.
When you type a place into the map search and press search, the text you entered and your IP address are sent to the OSMF’s search service (Nominatim) to find the matching coordinates. We do not search while you type. Please do not enter information about yourself other than the place you are looking for.
We use OpenStreetMap because the map is the core of this website and OSM is a non-profit service that does not use the data for advertising. The legal basis is our legitimate interest in showing you an interactive map (Art. 6(1)(f) GDPR). The OSMF processes the data as a separate controller under its own privacy policy. The United Kingdom is covered by an adequacy decision of the European Commission (Art. 45 GDPR).
6. Your location (“use my location”)
The map can center on your current position. This only happens if you tap the location button and then allow access in your browser’s prompt. Your browser determines the position, depending on your device using GPS, Wi-Fi or mobile networks, and your browser’s or operating system’s provider may be involved in this under its own privacy policy.
We use your position only inside your browser to move the map and work out distances to air pumps. It is not sent to our server and not stored. Once the map has moved, the map images for that area are loaded from the OSMF as described above, so the OSMF can infer the approximate area.
The legal basis is your permission (Art. 6(1)(a) GDPR; § 25(1) and (2) No. 2 of the German TDDDG). You can withdraw it at any time in your browser’s site settings.
7. Contact form, location reports and email
Contact form. When you send a message through the contact form, we receive your name, email address, the topic and your message. We use them only to answer you.
Location reports. The location form asks for details about a place: its name, address, type, whether the air is free and any notes. This information is about the place, not about you, and once reviewed it may appear on the map. Your email address is optional; we only use it if we have a question about your report and never publish it.
Form data travels encrypted to our server, which does not store it. The server forwards it to a private channel on the chat service Discord that only we can read. For users in Europe, Discord is provided by Discord Netherlands B.V., Schiphol Boulevard 195, 1118 BG Schiphol, Netherlands. Discord may process the data in the USA through Discord Inc., 444 De Haro Street, Suite 200, San Francisco, CA 94107, USA, which is certified under the EU-U.S. Data Privacy Framework (Art. 45 GDPR). See Discord’s privacy policy. Discord does not receive your IP address or any other data from your browser; only the content of the form is passed on.
To block spam, our server checks submissions itself; we do not use third-party captcha services. For this it counts submissions per IP address in its working memory for 1 hour and then forgets them; the IP address is not saved or passed on.
If you email us directly, your email and its content are processed in our mailbox at our hosting provider (STRATO GmbH) in the same way and for the same purposes.
The legal basis is our legitimate interest in answering inquiries and keeping the map accurate (Art. 6(1)(f) GDPR), or, if your message concerns a contract with us, Art. 6(1)(b) GDPR. We delete your message and contact details once the matter is settled, at the latest after six months, unless the law requires us to keep them longer.
9. Statistics with Google Analytics
We use Google Analytics 4, a web analytics service of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (“Google”), to understand which pages are useful and where visitors come from. Google Analytics uses cookies and records, for example, the pages you view, how long you stay, the website you came from, your device, browser and screen size, and your approximate location (country, region, city) derived from your IP address.
Google Analytics 4 does not store IP addresses. We have set data retention to the minimum of two months, turned off Google signals and ad personalization. Google processes the data on our behalf under a data processing agreement. Data may be transferred to Google LLC in the United States; Google LLC is certified under the EU-U.S. Data Privacy Framework (Art. 45 GDPR) and has also agreed to the EU Standard Contractual Clauses.
In the EU, UK and Switzerland we only use it with your consent (Art. 6(1)(a) GDPR, § 25(1) TDDDG), elsewhere on the basis of our legitimate interest (Art. 6(1)(f) GDPR); see “Cookies and your consent” for how to refuse or object. More in Google’s privacy policy and in how Google uses information from sites that use its services.
10. Advertising with Google AdSense
Ads on this website help pay for running the map. They are delivered by Google AdSense, a service of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (“Google”).
- Third-party vendors, including Google, use cookies to serve ads based on your prior visits to this website and other websites.
- Google’s use of advertising cookies enables it and its partners to serve ads to you based on your visits to this site and/or other sites on the internet.
- You can opt out of personalized advertising in Google’s Ads Settings, and out of many third-party vendors’ personalized ads at aboutads.info (US) or youronlinechoices.eu (EU).
To deliver and measure ads and to prevent fraud, Google and its partners process your IP address, cookie and device identifiers, information about your browser and device, the pages you view and how you interact with the ads. For personalized ads, Google and the ad technology providers it works with act as separate controllers under their own privacy policies. Data may be transferred to the United States; Google LLC is certified under the EU-U.S. Data Privacy Framework (Art. 45 GDPR).
EU/EEA, UK and Switzerland: cookies and personalized ads only with your consent in Google’s consent message (Art. 6(1)(a) GDPR, § 25(1) TDDDG). You can change or withdraw it at any time via “Privacy settings”. Without consent, Google may still show non-personalized or limited ads, which do not use cookies for personalization.
Other countries: Google delivers ads, including personalized ads, without asking first. The legal basis is our legitimate interest in financing this free service (Art. 6(1)(f) GDPR). You can object at any time: via the opt-outs listed above, via the “Do not sell or share my personal information” link Google shows in US states that require it, or by sending a Global Privacy Control signal, in which case we only request non-personalized ads. More in how Google uses cookies in advertising and how Google uses information from sites that use its services.
11. Directions and links to other websites
The “Directions” button opens Google Maps (or your maps app) with the coordinates of the place you picked. Nothing is sent to Google before you tap it; after that, Google’s privacy policy applies. The same is true for all other links to external websites: we transmit no data when the page loads, and we are not responsible for how those websites handle your data.
12. Recipients and transfers outside the EU
We share personal data only with the recipients named in this policy:
- our hosting provider (STRATO GmbH), which also runs our mailbox, as a processor bound by our instructions (Germany);
- Discord, for the content of the contact and location forms (Netherlands and USA, Data Privacy Framework);
- the OpenStreetMap Foundation for map images and map search (United Kingdom, adequacy decision);
- Google and the ad technology providers it works with, for ads (EU and USA, Data Privacy Framework);
- Google, for statistics (EU and USA, Data Privacy Framework);
- public authorities, only if we are legally required to do so.
13. Your rights
Under the GDPR you have the right to:
- access the personal data we hold about you (Art. 15);
- have incorrect data corrected (Art. 16);
- have your data deleted (Art. 17) or its processing restricted (Art. 18);
- receive data you gave us in a common, machine-readable format (Art. 20);
- withdraw consent at any time, with effect for the future (Art. 7(3));
- object to processing based on legitimate interests (Art. 21, see below).
Your right to object (Art. 21 GDPR)
Where we process your data on the basis of legitimate interests (Art. 6(1)(f) GDPR), you can object at any time for reasons arising from your particular situation. We will then stop, unless we can demonstrate compelling legitimate grounds that override your interests, or the processing serves to establish, exercise or defend legal claims. If we ever use your data for direct marketing, you can object at any time without giving reasons, and we will stop.
To use any of these rights, email contact@bike-pump.com. We answer within one month and may ask you to confirm your identity first. You also have the right to lodge a complaint with a data protection supervisory authority, in particular in the EU member state where you live, work or where the alleged infringement took place (Art. 77 GDPR). The authority responsible for us is the Hessian Commissioner for Data Protection and Freedom of Information (HBDI).
14. Notice for US residents
We give the rights described above to every visitor, wherever you live. This includes the rights granted by California and other US state privacy laws: to know what personal information we collect, use and disclose (see the overview above), to access, correct and delete it, to receive a copy, and to opt out of its sale, of sharing for cross-context behavioral advertising, and of targeted advertising. We will not discriminate against you for using these rights.
We do not sell personal information for money. Personalized ads through Google AdSense may count as “sharing” or “targeted advertising” under some state laws. To opt out, use the “Do not sell or share my personal information” link Google shows in the states that require it, Google’s Ads Settings, or a Global Privacy Control signal, after which we only request non-personalized ads. A Global Privacy Control signal also stops Google Analytics on this site.
To make a request, email contact@bike-pump.com. You may use an authorized agent. If we decline your request, you can appeal by replying with “Appeal” in the subject line; we will answer within 60 days. If the appeal is denied, you can contact your state attorney general.
Do Not Track. There is no common standard for how websites should respond to browser “Do Not Track” signals, so we do not respond to them specifically. We do honor Global Privacy Control as described above. Google and its ad partners may collect information about your activity across websites through our ads; see “Advertising” for your choices.
California “Shine the Light”. We do not disclose personal information to third parties for their own direct marketing purposes.
15. Data security
We protect data with TLS encryption, current software and access limited to the operator. Form submissions are not stored on the web server; they are forwarded to a private Discord channel. No transmission over the internet is completely secure, and ordinary email in particular can be read in transit, so please do not send us sensitive information.
16. Children
This website is meant for drivers and cyclists in general and is not directed at children under 13 (or under 16 in the EU). We do not knowingly collect personal data from children. If you believe a child has sent us personal data, please contact us and we will delete it.
17. No automated decisions
We do not make decisions based solely on automated processing, including profiling, that have legal or similarly significant effects on you (Art. 22 GDPR).
18. Changes to this policy
We update this policy when our website or the law changes. The date at the top shows the latest version. If we make significant changes, for example add a new service that processes your data, we will point this out on the website and ask for your consent again where needed.