Privacy Policy

1. Data Controller

The data controller is [name / company], [serviceable address], e-mail: contact@roado.eu. For further details, please refer to the Legal Notice (Impressum).

No data protection officer has been appointed; for data protection inquiries, please contact the email address indicated above.

2. Scope, purposes and legal bases of processing

We process personal data only to the extent necessary and based on the legal grounds set out in Art. 6(1) GDPR:

• Website operation and server log files (IP address, timestamp, requested URI, browser headers) for stability and IT security; legal basis: legitimate interest (Art. 6(1)(f) GDPR).
• Strictly necessary cookies / local storage: language preference ("locale" cookie) and session states; legal basis: Art. 6(1)(f) GDPR.
• Advertising and personalization (Google AdSense / Google CMP): We use Google AdSense, a service provided by Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Ireland). Advertising cookies and device identifiers are used only with your prior explicit consent (Art. 6(1)(a) GDPR) collected via the consent management banner. You can manage or revoke your consent at any time via the "Cookies" section.
• E-mail inquiries and contact forms: processing contact info and message contents to handle your request; legal basis: Art. 6(1)(b) or (f) GDPR.
• User-uploaded photos: stored with creator identification to allow media management; legal basis: Art. 6(1)(f) / (a) GDPR.
• Owner accounts and magic-link authentication: e-mail address and single-use authentication token valid for 5 minutes; legal basis: Art. 6(1)(b) GDPR.

3. Hosting and data processors

Our service is hosted on infrastructure provided by [hosting provider name and address]. The provider processes data on our behalf under a data processing agreement (Art. 28 GDPR).

Data may be shared with IT service providers and Google Ireland Limited in connection with advertising services. Disclosures to public authorities occur only where required by statutory law.

4. International data transfers (USA)

In connection with Google services, data may be transferred to Google LLC servers in the United States. Google participates in the EU-US Data Privacy Framework (DPF) adequacy decision and utilizes EU Standard Contractual Clauses (SCCs).

5. Retention periods

We retain personal data only for as long as necessary to fulfill the intended purposes or comply with statutory retention requirements.

Server logs are retained temporarily (typically up to 30 days). Contact information is retained for the duration of handling and applicable statutory limitation periods.

6. Your rights under GDPR

You have the right of access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20), objection (Art. 21), and the right to withdraw consent at any time without affecting the lawfulness of processing before withdrawal.

You also have the right to lodge a complaint with a competent data protection supervisory authority (e.g., UODO in Poland or state data protection commissioners in Germany).

7. Automated decision-making

We do not perform automated decision-making or profiling producing legal effects pursuant to Art. 22 GDPR.

8. Updates to this policy

We may update this policy periodically. The current version is always available on this page with the date of last update.