Processing register

About this translation. Consteia is based in the Netherlands and acts under Dutch law. This translation is an aid that explains the rules in your language. It does not refer to the legislation of the countries where this language is spoken. If the translation differs from the Dutch text, the Dutch text applies.

Why this is a document of its own

A privacy statement describes what we do with your data and why. That rarely changes. Which party runs our server or sends our mail changes more often, and such a change does not touch the agreement with you.

That is why the processors are listed here separately. If we change service, this register changes and the privacy statement keeps its number. You then do not have to go through a checkbox again for something the agreement itself does not change, and at the same time it stays visible exactly who was involved and when.

This register belongs with the Consteia Privacy & Cookie Statement and the Consonae Privacy Statement. Both refer to it.

What a processor is

A processor does part of the work on our behalf and has no authority of its own over your data. It may use the data only for what we ask of it, it may not use it for itself, and it is bound by a data processing agreement. We remain responsible.

Parties that do decide for themselves about your data are not listed here, because they are not processors. At the moment there is no party of that kind, and should that ever change, it will get a chapter of its own.

The parties

This register is under construction. Where a name is still missing, what that party does for us and which data it sees in doing so is stated anyway, because that is what you need to weigh whether you are fine with it. The names will follow as soon as the choices are made, and every addition will appear in the history at the bottom.

Hosting and database

We rent a virtual server from STRATO and register our domain names there. They provide and maintain the machine; what runs on it, we manage ourselves. The domain registration only concerns our own data and not that of visitors.

Party: STRATO, for now.
Establishment: Germany. STRATO runs two data centres of its own, in Berlin and Karlsruhe, and processes only there. Your data therefore stays within the European Economic Area.
What they do: run the server on which the website, the database and the uploaded files are located.
What they can see in doing so: in principle everything that is on that server, because that is inherent to hosting.
Data processing agreement: concluded. This is the agreement that Article 28 GDPR prescribes, and it records what STRATO may and may not do with data. If you want to know what it regulates, ask; we will explain it to you.

Sending email

Our email goes out directly from our own server. There is therefore no separate party that delivers your messages; it is the same server as above, at the same hosting party and under the same agreement.

What is sent: a confirmation, a recovery request, or a notice that something is ready for you.
What goes with it: your email address and the content of that message. We keep that content deliberately sparse.

Payment service

Party: Stripe
Establishment: Ireland. For customers in the European Economic Area, payment processing runs through Stripe Technology Europe, Limited. Registered number: 0599050. Registered office: 25/28 North Wall Quay, Dublin 1, D01H104
What they do: handle the payment when you buy tokens, make a donation or buy a product.
What they see in doing so: your payment details and the amount. We do not receive those payment details.
Note: for part of its work, a payment service is a controller itself, because the law imposes obligations of its own on it. As soon as payments actually start running, this will be broken down here.

Photon by Komoot

What they do: convert a place name into geographic coordinates, which is needed for every astronomical calculation.
What they see in doing so: only the place name. The request runs through our own server, so your IP address never reaches them and the place name cannot be linked to a person by them.
Where in the code: api/geocoding-proxy.php.

ip-api.com

What they do: look up the country that belongs to an IP address, during a login attempt.
What they see in doing so: the IP address. This is the only place where a visitor's IP address leaves our server.
Retention with us: the answer stays in a cache of our own for seven days, so that the same address does not go through that service every time.
Still to be weighed: for visitor statistics we already look up the country locally, in a file on our own server. The same route could work here too, and then nothing at all would leave the house.

Map files for determining the country

What it is: two files that sit on our own server and in which we look up which country and region a truncated IP address belongs to.
Why mentioned here: this is not a processor, because nothing goes outside. It is listed here for completeness, so that the list gives the whole picture.

Transfers outside the European Economic Area

We will determine this as soon as hosting and email sending have been chosen. If a service is located outside the EEA, this is where it will say with which party that is the case and which safeguard that transfer rests on.

How this register changes

If we change service, we update this document and note the change below. That is a correction to this register and not a change to the agreement with you, so you do not have to agree to it again.

If a party receives a different task with your data, that is a change to the agreement. It will then appear in the privacy statement and be put to you.

History

Questions

If you want to inspect a data processing agreement, or want to know where a particular piece of data ends up exactly, just ask through the contact form. We will show you.