Privacy policy

1. Data controller

The entity responsible for data processing on this site under GDPR is:

2. What data we collect and why

2.1 Automatically when you visit

Our hosting provider (Vercel Inc., 340 S Lemon Ave #4133, Walnut, CA 91789, USA) automatically logs certain technical information in server logs when you access the site: your IP address, user agent, referrer URL, requested page, and timestamp. This data is used for security monitoring and basic analytics and is retained for up to 30 days.

Legal basis: Art. 6(1)(f) GDPR (legitimate interest in operating a secure website).

2.2 When you submit a contribution

If you use our /contribute form, we store the data you enter (listing details, optionally your name and email) in our database at Supabase (hosted in Frankfurt, Germany on EU infrastructure).

Purpose: to review and publish community-submitted listings, and to contact you if we have questions about your submission.

Legal basis: Art. 6(1)(a) GDPR (consent, by submitting the form) and Art. 6(1)(f) GDPR (legitimate interest in maintaining the directory).

Retention: approved contributions are retained indefinitely as part of the public directory. Rejected contributions are retained for up to 12 months for moderation audit and then deleted.

2.3 Admin authentication (only for site administrators)

When administrators sign in via magic link at /admin/login, Supabase sends a one-time authentication email and stores a session cookie. This affects only site operators, not general visitors.

Legal basis: Art. 6(1)(f) GDPR (legitimate interest in securing administrative access).

3. Cookies

This site uses Google Analytics (GA4) to understand how visitors use the site. GA4 sets analytics cookies only after you give explicit consent via the cookie banner. If you decline, no analytics cookies are set and the site works identically. IP anonymization is enabled.

Additionally, Vercel Analytics collects anonymous page view data without cookies (no consent required).

Strictly-necessary session cookies are used for the admin authentication flow (Supabase Auth), which affect site operators only.

4. Third-party services

• Vercel Inc. (hosting, serverless functions). Data processing agreement per GDPR Art. 28 in place. Some data may be processed in the US under EU-US Data Privacy Framework.
• Supabase Inc. (database, authentication). EU infrastructure (Frankfurt region). Data processing agreement per GDPR Art. 28 in place.
• Google LLC (Google Analytics GA4, consent-based). Only activated after explicit user consent. IP anonymization enabled. Data may be processed in the US under EU-US Data Privacy Framework.
• Google Fonts (via Next.js). Fonts are self-hosted at build time, not loaded from Google at runtime. No data is transmitted to Google when you visit.

5. Your rights under GDPR

You have the following rights regarding your personal data:

• Right to access (Art. 15 GDPR)
• Right to rectification (Art. 16 GDPR)
• Right to erasure (Art. 17 GDPR, “right to be forgotten”)
• Right to restriction of processing (Art. 18 GDPR)
• Right to data portability (Art. 20 GDPR)
• Right to object (Art. 21 GDPR)
• Right to withdraw consent at any time (Art. 7 GDPR)
• Right to lodge a complaint with a supervisory authority (Art. 77 GDPR)

To exercise any of these rights, email hi@indianingermany.com. We will respond within 30 days.

6. Supervisory authority

You have the right to lodge a complaint with the data protection supervisory authority in your country of residence or place of work. In Germany, each federal state has its own authority. The federal authority is:

Bundesbeauftragte für den Datenschutz und die Informationsfreiheit (BfDI), Graurheindorfer Straße 153, 53117 Bonn, www.bfdi.bund.de

7. Changes to this policy

We may update this privacy policy from time to time to reflect changes in our practices or legal requirements. The current version is always available at this URL.