Privacy

Privacy is one of those topics where many people immediately think of cookie banners, endless texts, and “Accept all”. It doesn’t have to be that way.

For us, privacy mainly means one thing: collect as little data as possible. Not tracking everything, not analysing every click, and certainly not storing data just because we could.

The most important part first: When you upload an image, it has exactly one purpose: after a manual review by us, it is published on our public map. That is the whole point: your image becomes visible to all visitors of the site.

Your images are not sold, not shared with third parties, and not used to train AI models.

If people are visible in an uploaded image, we look at it personally. If necessary, faces or other people are blurred by hand. We explicitly do not use automatic AI detection. We would rather look ourselves once than blindly trust software.

By the way, we have no cookie banner. Why? Because we don’t need one. The cookies we use are strictly technical and ensure the shop and your cart work.

Cookies? Yes.
Do you have to consent? No.

The map on the website comes from OpenStreetMap, not Google Maps. Works great and is much more privacy-friendly.

Do we know who you are? No.
Do we know which pages are popular? Yes.
Do we know how much revenue we make? Unfortunately, yes. (Spoiler: it’s a loss-making venture; we do it out of local patriotism 😄)

For that we use our own, self-hosted analytics – completely without tracking cookies and without external providers. The data stays on our server; we get anonymous statistics without following you across the internet.

And for everyone still reading: respect. From here on it’s the official privacy stuff.

Hartmann Contractor KG
Paul-Klee-Str. 38
42781 Haan
Germany
Email: info@serend.de

Office address
serend.design
c/o Hartmann Bürotechnik
Viehhofstr. 121
42117 Wuppertal
Germany

We are not required to appoint a data protection officer; the legal requirements for doing so are not met in our case.

You have the right to access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20), and objection to processing based on legitimate interests (Art. 21).

You may withdraw any consent given at any time with effect for the future.

Right to lodge a complaint: You may complain to a data protection supervisory authority. The authority responsible for us is the State Commissioner for Data Protection and Freedom of Information of North Rhine-Westphalia, Kavalleriestraße 2–4, 40213 Düsseldorf, Germany.

For enquiries, an informal message to info@serend.de is sufficient. The reply is probably shorter than this privacy policy 🙂

The website runs on servers operated by Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany (location: Nuremberg). A data processing agreement pursuant to Art. 28 GDPR is in place.

When you access the site, IP address, date and time, browser information, and the page accessed are processed for technical reasons.

Legal basis: legitimate interest in secure operation (Art. 6(1)(f) GDPR). Retention: server logs are automatically deleted after 14 days.

To protect our forms (photo upload, contact, photo deletion, withdrawal, and admin login) from automated abuse and spam, we use Cloudflare Turnstile, a service provided by Cloudflare, Inc. (101 Townsend St, San Francisco, CA 94107, USA).

When you submit one of these forms, your IP address and browser information are transmitted to Cloudflare for verification. This involves a transfer of data to the USA (third country). Cloudflare is certified under the EU-U.S. Data Privacy Framework; standard contractual clauses apply as an additional transfer mechanism. Turnstile deliberately works without tracking cookies.

Legal basis: legitimate interest in providing the website securely and free from abuse (Art. 6(1)(f) GDPR).

Images you upload are used exclusively to publish them – after manual review – on our public map. They are neither sold nor used for advertising or to train AI models.

Your original file is not stored. It is processed in memory during upload and converted; all metadata is removed (e.g. camera model, capture time, serial number). From GPS coordinates – if present – we only determine the approximate location and offset the map pin by 100–250 m. Exact coordinates are never stored; only this cleaned, metadata-free version of your image together with the already imprecise location is written to disk.

If people are visible in an image, we review it manually. If required, people or sensitive areas are blurred by hand. No automatic face recognition or AI analysis is used. Manual work still applies here.

The display name you choose is freely selectable and appears publicly under the photo. We do not verify its authenticity and do not collect any further information about you.

Legal basis: your consent when submitting the upload (Art. 6(1)(a) GDPR) and legitimate interest in operating the map (lit. f). Retention: until deletion by you or by us. You can request deletion at any time using your image ID.

Because we deliberately do not collect contact details for uploads, we cannot actively notify you about decisions. Instead, we record the outcome and reasoning for your image ID; you can retrieve it at any time via the status page. This fulfils our obligation to provide reasons under Art. 17 DSA within the information available to us.

Access to the status page is not logged in a personal way. No cookie is set and no analytics are triggered.

Via the “Report or delete photo” form you can report unlawful content or – as an uploader – have your own photo removed. We process the data you provide (name, email address, description and, if applicable, image ID) to review your report, send you confirmation of receipt and the decision (Art. 16 and 17 DSA), and – for justified reports – prevent identical future violations.

Legal basis: Art. 6(1)(c) GDPR (legal obligation under the Digital Services Act) and Art. 6(1)(f) GDPR (legitimate interest in preventing repeated legal violations).

Retention: Data you provide as the reporting person (name, email) is anonymised six months after the case is closed. Only the ticket number and the decision without personal reference are retained. For permanent repeat blocking we also store a technical image fingerprint (perceptual hash), blocked find zones (derived from already imprecise coordinates offset by 100–250 m), and a tamper-proof log (audit log). The actual image file of a removed photo is fully deleted.

Details of the reporting person are not disclosed to the uploader and vice versa. Every decision can be appealed using the ticket number.

If you order stickers, we process your name, delivery address, email address, and order data.

Payment: Processing is handled by PayPal (Europe) S.à r.l. et Cie, S.C.A., 22-24 Boulevard Royal, L-2449 Luxembourg, as an independent controller. We do not receive full payment details and do not store account numbers or card data.

Invoicing and accounting: We use lexoffice by Haufe-Lexware GmbH & Co. KG, Munzinger Str. 9, 79111 Freiburg, Germany. A data processing agreement is in place.

Email delivery: Order and shipping confirmations as well as invoices are sent via the SMTP server of webgo GmbH, Heidenkampsweg 81, 20097 Hamburg, Germany. A data processing agreement is in place.

Shipping: We label mail ourselves and hand it to Deutsche Post. Deutsche Post AG is independently responsible; no data processing relationship exists.

Legal basis: performance of a contract (Art. 6(1)(b) GDPR); for retention, legal obligation (lit. c).

Retention: we keep order and invoice data for ten years pursuant to § 147 German Fiscal Code and § 14b German VAT Act. Tax law requires this, not us. Information no longer needed is deleted after the process is completed.

If you contact us via the contact form or submit a withdrawal, we use your details exclusively to handle the respective request.

Legal basis: performance of a contract or pre-contractual measures (Art. 6(1)(b) GDPR) or legitimate interest in responding (lit. f). For withdrawal declarations, additionally legal obligation (lit. c).

Retention: until processing is complete, then deletion – unless statutory retention periods apply.

We use only a few, minimal cookies – no tracking or advertising cookies:

· Cart & session: technically necessary so the shop, your cart, and the protected admin area work. Legal basis: § 25(2) no. 2 TDDDG, processing under Art. 6(1)(b) and (f) GDPR. Duration: session.

· Like cookie (cm_vid): When you like a photo, we store a random, anonymous visitor ID (duration approx. 1 year). It is used solely to detect and prevent multiple likes from the same browser – it contains no personal data and is not used for tracking. This cookie is only set when you actively like; legal basis is our legitimate interest in a fair like function (Art. 6(1)(f) GDPR).

To understand which content works well, we run our own, self-hosted analytics – no external service (e.g. Google Analytics or Matomo Cloud) is used, and data does not leave our server.

Measurement runs completely without cookies. Instead of recognising you, we create a daily changing pseudonymous identifier per page view from IP address and browser signature (using SHA256). The raw IP address is not stored, the identifier cannot be traced back to a person, and it changes every day. We see anonymous statistics but cannot identify you or track you across websites.

Legal basis: legitimate interest in privacy-friendly analytics (Art. 6(1)(f) GDPR). Retention: 12 months in aggregated form.

We use OpenStreetMap for the map on our website. When map tiles load, a connection to servers of the OpenStreetMap Foundation may be established for technical reasons, during which your IP address is transmitted.

Legal basis: legitimate interest in displaying the map (Art. 6(1)(f) GDPR).

Fonts are loaded locally from the server via Next.js Font Optimization. No external servers are contacted and no personal data is transmitted.

Via the Instagram icon, visitors leave our site. We are not responsible for data processing there; the respective provider’s terms apply.

The website is encrypted throughout using TLS. The admin area is protected by authentication and accessible only to authorised persons. Changes to photos and reports are recorded in a tamper-proof log.

We update this policy when our offering or the legal situation changes. The version published here applies in each case.

As of: 5 August 2026