Privacy policy

Your rights

• Access: you can find out free of charge at any time which data we hold about you.
• Rectification and erasure: you can ask us to correct inaccurate data or to delete your data.
• Restriction of processing: under certain conditions you can ask that your data is, for the time being, only stored.
• Right to lodge a complaint: if the GDPR is infringed, you can complain to the competent supervisory authority.

The website operator is the controller responsible for data processing. Contact details and more on these rights are in section 3.

Hetzner

The provider is Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany (hereinafter Hetzner).

For details, see Hetzner’s privacy policy: https://www.hetzner.com/legal/privacy-policy/

We use Hetzner on the basis of Art. 6(1)(f) GDPR. We have a legitimate interest in presenting this website as reliably and securely as possible.

The server of our audience measurement, which receives the measurement data, is also located at Hetzner in Germany (see section 4).

Sending emails

We send sign-in links for the optional account (see section 4) through an email service provider: [PLACEHOLDER: name and registered office of the mail provider — operator’s decision pending]. Only the email address and the content of the email (the sign-in link) are transmitted. The legal basis is Art. 6(1)(b) GDPR, as you request the link yourself.

Data processing agreement

We have concluded data processing agreements for the use of the services named above. This is a contract required by data protection law which ensures that the service processes the personal data of our website visitors only in accordance with our instructions and in compliance with the GDPR.

The operators of these pages take the protection of your personal data very seriously. We treat your personal data confidentially and in accordance with the statutory data protection regulations and this privacy policy.

When you use this website, various personal data are collected. Personal data are data that can be used to identify you personally. This privacy policy explains which data we collect and what we use them for. It also explains how and for what purpose this happens.

Please note that data transmission over the internet (e.g. when communicating by email) can have security gaps. Complete protection of data against access by third parties is not possible.

Controller

The controller responsible for data processing on this website is:

Sebastian WidmannRingstr. 19a76228 Karlsruhe, GermanyPhone: +49 721 85143099Email: kontakt@die-wunschliste.de

The controller is the natural or legal person who, alone or jointly with others, decides on the purposes and means of processing personal data (e.g. names, email addresses or similar).

Storage period

Unless a more specific storage period is stated in this privacy policy, your personal data remain with us until the purpose of processing no longer applies. If you make a justified request for erasure, your data will be deleted unless we have other legally permissible reasons for storing them.

For poll data: the poll’s admin can remove individual participants, entries and votes and delete the entire poll permanently — all related data are then removed irreversibly, including everything that belongs to them. Every poll expires automatically: a date poll 30 days after its last time slot (at the latest one year after it was created), all other polls 90 days after they were created. Expired polls no longer accept participation and are deleted permanently 30 days after expiry.

General information on the legal bases of processing

Data that arise when creating and answering polls are processed on the basis of Art. 6(1)(f) GDPR: we have a legitimate interest in providing a working and secure service. No contracts are concluded via the website; strictly necessary cookies do not require consent (§ 25(2) TDDDG, German Telecommunications Digital Services Data Protection Act), and no such consent is requested.

Recipients of personal data

We do not work with analytics, advertising or tracking services of other companies; we run our audience measurement ourselves (see section 4). The only recipients of personal data are our hosting provider Hetzner and — only for sign-in links of the optional account — our email service provider; both process the data under a data processing agreement (see section 2). Data are not passed on to any other third parties.

Right to object to data collection in special cases (Art. 21(1) GDPR)

Where data are processed on the basis of Art. 6(1)(e) or (f) GDPR, you have the right to object at any time to the processing of your personal data on grounds relating to your particular situation; this also applies to profiling based on these provisions. The legal basis of each processing operation is set out in this privacy policy. If you object, we will no longer process the personal data concerned unless we can demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms, or the processing serves the establishment, exercise or defence of legal claims (objection under Art. 21(1) GDPR).

Right to lodge a complaint with the competent supervisory authority

In the event of infringements of the GDPR, data subjects have the right to lodge a complaint with a supervisory authority, in particular in the member state of their habitual residence, their place of work or the place of the alleged infringement. This right is without prejudice to any other administrative or judicial remedies.

Right to data portability

You have the right to have data that we process automatically on the basis of your consent or in fulfilment of a contract handed over to you or to a third party in a common, machine-readable format. If you request the direct transfer of the data to another controller, this will only be done where technically feasible.

Access, rectification and erasure

Within the scope of the applicable legal provisions, you have the right at any time to free information about your stored personal data, their origin and recipients and the purpose of processing, and, where applicable, a right to rectification or erasure of these data. You can contact us at any time about this and any other questions on personal data.

Right to restriction of processing

You have the right to request that the processing of your personal data be restricted. You can contact us about this at any time. The right to restriction of processing applies in the following cases:

• If you dispute the accuracy of the personal data we hold about you, we usually need time to check this. For the duration of the check, you can request that the processing of your personal data be restricted.
• If your personal data were or are being processed unlawfully, you can request restriction of processing instead of erasure.
• If we no longer need your personal data but you need them to exercise, defend or establish legal claims, you can request restriction of processing instead of erasure.
• If you have lodged an objection under Art. 21(1) GDPR, your interests and ours must be weighed against each other. As long as it has not been determined whose interests prevail, you can request that the processing of your personal data be restricted.

If you have restricted the processing of your personal data, these data — apart from being stored — may only be processed with your consent or for the establishment, exercise or defence of legal claims, for the protection of the rights of another natural or legal person, or for reasons of important public interest of the European Union or a member state.

SSL/TLS encryption

For security reasons and to protect the transmission of confidential content, such as your poll data, this site uses SSL/TLS encryption. You can recognise an encrypted connection by the browser’s address bar changing from “http://” to “https://” and by the lock symbol in your browser bar.

When SSL/TLS encryption is active, the data you send us cannot be read by third parties.

Objection to advertising emails

We hereby object to the use of contact details published as part of our legal notice obligation for sending advertising and information material that has not been expressly requested. The operators of these pages expressly reserve the right to take legal action in the event of unsolicited advertising, such as spam emails.

Cookies

This website only sets strictly necessary cookies — no cookies for measurement or advertising, no third-party cookies. Two cookies are set per poll:

• Participant cookie: stores an encrypted recognition token so that your votes and entries stay linked to you and you can change them later. It is valid for 1 year (HttpOnly, encrypted, SameSite=Lax); the database only holds a hash.
• Admin cookie: grants access to the poll’s admin view. It is valid for 30 days and is also HttpOnly, encrypted and set with SameSite=Lax.

In addition, the application uses a session cookie and a CSRF protection cookie — both strictly necessary and without storing any poll data. The session cookie (HttpOnly, SameSite=Lax) expires after 120 minutes of inactivity; the protection cookie makes it harder for third parties to submit forged forms.

If you choose to sign in with an account, we also set a sign-in cookie (HttpOnly, encrypted, SameSite=Lax) so that you stay signed in. It lasts up to 400 days and is removed when you sign out.

If you choose a language in the footer, a language cookie remembers it for one year (only “en” or “de”, HttpOnly, SameSite=Lax). A page with a language in its address (such as /en or /de) also sets this cookie to its language. Without this cookie, the language follows your browser; the address / then forwards to /de if your browser prefers German, otherwise to /en.

You can set your browser to inform you when cookies are set and to allow cookies only in individual cases or to block them in general. If you refuse cookies, participation is limited: without the participant cookie, your votes and entries can no longer be linked to you later.

Server log files

No IP addresses and no access logs are stored in our database. To prevent abuse (for example when creating polls), the application temporarily checks whether an unusually large number of requests arrive from one address within a short time; this check does not store the address permanently. When delivering the site, the hosting provider processes technically necessary data in accordance with its privacy policy (see section 2).

Audience measurement with Statistics

We measure the use of this website with Statistics, an analytics tool without cookies that we run ourselves (server see section 2). When a page is opened, a small script transmits the following to our own statistics server: the page opened and its title (without query parameters, except campaign identifiers such as “utm_source”), the referring page, the browser’s language setting, screen and window width, whether there is a touchscreen, how long the page was visible and how far you scrolled, as well as measurements of how fast the page loaded (Largest Contentful Paint, Interaction to Next Paint, Cumulative Layout Shift). In addition, individual actions such as submitting a form, a download or a click on a phone or email link may be counted as an event; for phone and email links only the number or the domain of the address, never the part before the “@”. From the browser identifier (user agent), the device type, operating system and browser are derived; Chromium-based browsers additionally report the exact operating system version on request.

As events, Polls counts exactly four steps: starting to create a poll, a created poll, copying or sharing the participation link, and the first saved answer on a poll page. Only kinds are sent with them: the kind of poll (such as “find a date”), the way of sharing (copy or share menu) and the kind of page visited before (such as “home page”) – never titles, names, entries or access codes.

Pages whose address carries a secret access code — taking part in a poll, managing it, the confirmation after creating and signing in — are reported by the script only by their kind, such as “/p/*” for taking part: without the access code and without the page title. Access codes, poll titles and content, names and entries therefore never reach the statistics server.

Your IP address is not stored. Only at the moment of transmission is it combined with the browser identifier and a random value that changes daily into a value that can no longer be traced back to you afterwards. This makes it possible to group the visits of one day without recognising you beyond that day. No cookies are set and nothing is stored on your device, except for a marker if you switch off the measurement for your browser yourself (see below); no profiles are created and no data is passed on to third parties. The data is evaluated in aggregate and as individual visits, i.e. which pages were opened one after the other within a visit, without it being possible to determine who you are.

The legal basis is our legitimate interest in data-minimising audience measurement in order to improve our service (Art. 6(1)(f) GDPR). Reading the browser information mentioned is necessary to provide the service under Section 25(2) no. 2 of the German TDDDG. The data is deleted after 400 days.

You can object to the processing (Art. 21 GDPR): open a page of Polls with ?statistics_ignore=1 added to the address. The script remembers the objection in your browser’s local storage and no longer records your visits; with ?statistics_ignore=0 you lift it again. You can also disable JavaScript for this website or contact us.

Creating and taking part in polls

Polls doesn’t need an account. Access works through links: the participant link for participants and the admin link, which is shown in plain text exactly once and opens the poll’s admin view. If you like, you can also use an optional account (see below).

We store the display name you choose freely, the poll content (title, description, options), your votes and entries, and timestamps of your actions. Passwords and IP addresses are never stored, email addresses only for the optional account.

When a poll is created, it also stores your browser’s time zone (such as “Europe/Berlin”) so that dates appear in the right local time for everyone. Points in time are stored in Coordinated Universal Time (UTC) and only converted to local time in the browser.

If the poll’s creator has allowed comments, you can write comments below the poll. We store the comment text, your display name and the timestamp. You can delete your own comments yourself as long as the poll is open and comments are allowed; after that, the creator, who can moderate all comments, can delete them. Comments are removed together with the poll or your participation.

If a poll link is shared via a messenger, its provider sends the poll title to its servers for the link preview.

Account (optional)

If you like, you can sign in with your email address — without a password: we send you a sign-in link that works for 15 minutes and only once. Its only purpose is to let you find your polls and answers again on any device. Polls works just the same without an account.

We store your email address, the time of your last sign-in and the links to the polls you created or took part in. When you sign in, polls and answers this browser previously knew through cookies without an account are linked to your account. For the sign-in link we briefly store the address and a hash of the link; we delete both at the latest one day after they expire. An account is only created once you confirm the link. Your email address never appears on pages that others see.

The legal basis is Art. 6(1)(b) GDPR (providing the account you asked for). We automatically delete accounts that have not signed in for 12 months. You can delete your account yourself at any time under “My polls”: the polls you created then stay, no longer linked to you, and expire as usual — or you delete them at the same time if you wish. Your answers stay in the polls.

Enquiries by email or phone

If you contact us by email or phone, your enquiry including all resulting personal data (name, enquiry) will be stored and processed by us for the purpose of handling your request. We do not pass on these data without your consent.

These data are processed on the basis of Art. 6(1)(b) GDPR if your enquiry is related to the performance of a contract or is necessary for pre-contractual measures. In all other cases, the processing is based on our legitimate interest in handling enquiries addressed to us effectively (Art. 6(1)(f) GDPR) or on your consent (Art. 6(1)(a) GDPR) if it was requested; consent can be withdrawn at any time.

The data you send us in enquiries remain with us until you ask us to delete them, withdraw your consent to storage or the purpose for storing the data no longer applies (e.g. after your request has been dealt with). Mandatory statutory provisions — in particular statutory retention periods — remain unaffected.