Controller
AWL Zentrum Ltd, Basepoint Business Centre, Unit 34 John de Mierre House, West Sussex RH16 1UA, United Kingdom. Contact: kontakt@playzonefinder.com. EU representative: AWL Zentrum SL, Psaje Peligros 3 1, Estepona, Spain.
Hosting
This website runs on our own server in Germany, rented from Hostinger International Ltd. Connection data and technically necessary logs are processed in order to deliver the site securely.
Photos from Wikimedia Commons (operator: Wikimedia Foundation, Inc., San Francisco, USA) are fetched and cached by our own server in Germany. The browser does not connect to Wikimedia, and the IP address is not transmitted to Wikimedia. The licence and author information of the photos is retained.
Maps
The map uses map data from OpenStreetMap contributors, displayed with MapLibre. Our own server loads the map tiles from the tile provider OpenFreeMap via img.playzonefinder.com and caches them; the browser does not connect to the provider. Routes in Google Maps only open when you click the respective link.
Statistics
Google Analytics 4 and PostHog are only loaded after you have given your explicit consent via the consent banner. Without consent, no audience measurement takes place. Your choice is stored in your browser's storage and can be withdrawn at any time via the “Privacy settings” link at the bottom of the page. When you withdraw, we also delete any statistics cookies already set (Google Analytics and PostHog). We do not show advertisements.
We use Google Analytics 4 (provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland) to measure audience reach. The legal basis is your explicit consent (Art. 6(1)(a) GDPR). In this context, data may be transferred to Google LLC in the USA; Google LLC is certified under the EU-U.S. Data Privacy Framework, on which the transfer is based (adequacy decision of the European Commission of 10 July 2023). According to Google, Google Analytics 4 does not store IP addresses. In our account, Google Analytics retains event data for 2 months and user-level data for 14 months. Unless you withdraw your consent, the “_ga” cookie remains stored for up to 2 years.
We use PostHog (provider: PostHog Inc.) to measure usage; the data is processed on servers in the EU. The legal basis is your explicit consent (Art. 6(1)(a) GDPR); without consent, PostHog is not loaded. We record page views, leaving a page and clicks on phone numbers, directions, website and external links. Session recordings and surveys are switched off. For this, PostHog stores a random identifier in your browser. You can withdraw your consent at any time via the “Privacy settings” link at the bottom of the page; the identifier and any PostHog cookies already set are then deleted and the consent banner appears again. IP addresses are anonymised in PostHog. We have not set a shorter deletion period in PostHog; under our plan, PostHog retains event data for up to 7 years. Under PostHog's data processing agreement, PostHog Inc. may also process data in the USA; according to its own statement, PostHog participates in the EU-U.S. Data Privacy Framework.
Anonymous counting for venue operators
So that operators can see how often their listing is viewed, we count views as well as clicks on “Call”, “Website” and “Directions” on venue pages and in venue lists. Only a total per venue and day is stored. We do not set any cookies for this, store nothing in your browser and record neither your IP address nor any other information about you. The legal basis is our legitimate interest in providing operators with a performance overview (Art. 6(1)(f) GDPR). Because we only store daily totals without any personal reference, the count cannot be linked to any person; there is therefore no stored data about you to which an objection could relate. The counting request appears in the server logs like any page request (see “Retention periods”).
Forms and photo submissions
If you suggest a venue, claim a listing or submit a photo, we process the data you provide (name, email address and a submitted photo) solely to handle your request. The data goes to our email inbox and is checked by a person before anything is published. For reviews, we store the stars, the text and the first name you give; we do not ask for an email address. To prevent abuse, instead of your IP address we only store a check value that changes daily, cannot be reversed and is deleted after 30 days. Reviews only appear after they have been checked by a person; on request, we delete them at any time (contact details in the imprint). The legal basis is Art. 6(1)(b) GDPR (handling your request or use of the directory under the terms of use). We send these emails – and, for reports from operators, the confirmation of receipt to the sender – via the email service Resend (Plus Five Five, Inc., 2261 Market Street #5039, San Francisco, CA 94114, USA); Resend processes the form data, including submitted photos. The legal basis here is also Art. 6(1)(b) GDPR. According to Resend's data processing agreement, processing takes place mainly in the USA; the transfer is based on the EU standard contractual clauses, and according to its own statement Resend also participates in the EU-U.S. Data Privacy Framework.
Using the forms is voluntary; there is no legal or contractual obligation to provide us with data. Required fields are name and email address when suggesting a place or claiming a listing, additionally the photo when submitting a photo, and name, stars and text for reviews. Without this information we cannot process the request or publish the review.
Retention periods
Server logs: we delete the web server's access logs (IP address, time, requested address, referring page and browser information) after 14 days, and system logs after 7 days.
Forms: we delete information from the forms (suggest a place, claim a listing, submit a photo) 12 months after receipt, and rejected photo submissions 30 days after the decision. We delete guest enquiries 12 months after receipt.
We keep reviews for as long as they are published; we delete rejected or removed reviews 30 days after the decision. We delete the anti-abuse check value after 30 days.
Deletion runs automatically every night. How long Google Analytics and PostHog keep data is set out in the section “Statistics”.
Your rights
You can request access, rectification, erasure, restriction of processing and data portability, and you can withdraw any consent you have given. You also have the right to lodge a complaint with a competent data protection supervisory authority. Where we process data on the basis of our legitimate interest, you may object at any time on grounds relating to your particular situation (Art. 21 GDPR).
Notes for individual countries
United Kingdom: The controller is AWL Zentrum Ltd (address above). You can complain to the Information Commissioner's Office (ICO, ico.org.uk).
Norway: You can complain to the Norwegian Data Protection Authority, Datatilsynet (datatilsynet.no).
Switzerland and Liechtenstein: Our servers are located in Germany, a country with adequate data protection under Annex 1 of the Swiss Data Protection Ordinance. If you consent to Google Analytics, data may also be transferred to the USA; Google LLC is certified under the Swiss-U.S. Data Privacy Framework. Under its data processing agreement, PostHog Inc. may also process data in the USA and, according to its own statement, participates in the Swiss-U.S. Data Privacy Framework. Form data is transferred to the USA via the email service Resend even without consent; for transfers from Switzerland, Resend relies under its data processing agreement on the EU standard contractual clauses as adapted for Switzerland.
USA: Audience measurement only starts after your consent; we do not respond separately to “Do Not Track” signals from your browser. After your consent, Google Analytics may also collect data about your use across different websites. The directory is not directed at children under 13; we do not knowingly collect personal information from children under 13. This policy is effective as of the date stated above; we publish changes on this page with a new date.
Canada: AWL Zentrum Ltd (address above) is accountable for privacy and can be reached at kontakt@playzonefinder.com. You can complain to the Office of the Privacy Commissioner of Canada (priv.gc.ca) and, in Québec, to the Commission d'accès à l'information du Québec (cai.gouv.qc.ca).
Japan: Please send requests for disclosure, correction, deletion or cessation of use of your data by email to kontakt@playzonefinder.com; we do not charge a fee for this. To protect your data, we use encrypted connections (HTTPS) and restrict access to authorised persons. Our servers are located in Germany (European Union); the EU is recognised by Japan's Personal Information Protection Commission (PPC) as having an equivalent level of protection. Google Analytics only transfers data to the USA with your consent. Information under Article 28(2) APPI on transfers to the USA: the recipient country is the United States of America. According to the PPC's country report (survey as of October 2021), there is no comprehensive data protection law there, but laws for individual sectors, such as the Electronic Communications Privacy Act (ECPA), the Gramm-Leach-Bliley Act (GLBA) and the Health Insurance Portability and Accountability Act (HIPAA); the report lists no EU adequacy decision, and the USA has participated in the APEC CBPR system since 25 July 2012. The report does not list any data localisation obligations or obligations to cooperate with government information gathering that could significantly affect your rights. Measures taken by the recipients: Google LLC is certified under the EU-U.S. Data Privacy Framework; Google Analytics transmits data encrypted (HTTPS with HSTS), and according to Google uses it only in line with its contract with us and our settings. PostHog stores our data in the PostHog EU Cloud in Frankfurt am Main and anonymises IP addresses; under its data processing agreement, PostHog Inc. may also process data in the USA, states that it participates in the EU-U.S. Data Privacy Framework, and encrypts data in transit and at rest. Both services are only loaded after your consent. Forms are different: the data entered is transferred to the USA via the email service Resend (Plus Five Five, Inc., USA) even without consent; according to its own statement, Resend participates in the EU-U.S. Data Privacy Framework, uses EU standard contractual clauses and provides HTTPS encryption.
New Zealand: the privacy officer under section 201 of the Privacy Act 2020 is René Lauterbach (AWL Zentrum Ltd, address above), reachable at kontakt@playzonefinder.com. Without the required information in a form we cannot process the request. You can complain to the Office of the Privacy Commissioner (privacy.org.nz).
Philippines: the Data Protection Officer is René Lauterbach (AWL Zentrum Ltd, address above), reachable at kontakt@playzonefinder.com. You can object to the processing of your data and lodge a complaint with the National Privacy Commission (privacy.gov.ph). The retention periods are set out in the section “Retention periods”.
Guest enquiries
If you send an enquiry or birthday enquiry via a venue page, we process the data you provide (name, email address, optionally phone number, preferred date, number of people, message) solely to handle your enquiry. We store it in a separate table, assigned to the venue you enquired about. The legal basis is Art. 6(1)(b) GDPR (preparing a booking or enquiry with the venue).
We pass your enquiry on to the operator of the venue concerned so that they can reply to you. Your data is not passed on to other third parties or used for advertising.
To prevent abuse, instead of your IP address we only store a check value that changes daily and cannot be reversed. We delete your information no later than 12 months after the enquiry.