Personal Data We Process

• Account data: name, email address, timezone, and authentication details for users.
• Calendar content: texts, images, embedded media, and metadata supplied by users for each day.
• Usage data: server logs, IP address, and device information captured when you access the admin area for security and troubleshooting.
• Support data: information you provide when contacting us for help.

Purposes and Legal Bases

We process personal data on the following legal bases under Art. 6 GDPR:

• Performance of a contract (Art. 6(1)(b)) – to create and operate user accounts, calendars, and related services.
• Legal obligations (Art. 6(1)(c)) – for record keeping, tax, and security requirements.
• Legitimate interests (Art. 6(1)(f)) – to secure the platform, prevent abuse, and improve features. Our interests do not override your fundamental rights and freedoms.
• Consent (Art. 6(1)(a)) – for optional communications; you may withdraw consent at any time.

Storage Duration

We store personal data only for as long as necessary to fulfill contractual or legal obligations:

• Active accounts: Account data and calendars are retained for the duration of your active account.
• Deleted accounts: Upon account deletion, personal data is permanently removed within 30 days, except where legally required to retain (e.g., payment records for tax compliance).
• Server logs: Access logs and security logs are retained for 90 days for security monitoring and troubleshooting.
• Backups: Automated backups are retained for 30 days on a rolling schedule. Data deleted from the production system will be purged from backups after this period.
• Payment records: Transaction records required for tax and accounting purposes are retained for 10 years as mandated by German tax law.
• Inactive accounts: Accounts with no login activity for 3 years may be flagged for deletion with 60 days advance notice via email.

Cookies & Tracking Technologies

Dagatal uses only essential cookies that are strictly necessary for the platform to function. We do not use tracking, analytics, or advertising cookies.

Essential Cookies (Required for Operation)

These cookies are necessary for the platform to function and cannot be disabled:

• Session Cookie (PHPSESSID): Maintains your session state and enables core functionality like authentication, form submissions, and security features. Set for all visitors. Expires when you close your browser or after 24 hours of inactivity.
• CSRF Token: Protects against cross-site request forgery attacks. Session-based and expires with your session.
• Cookie Consent (cookie_consent): Remembers that you've acknowledged our cookie notice. Expires after 1 year.

No Optional Cookies

We do not use any optional, functional, or tracking cookies. All cookies we set are essential for the core functionality of the platform.

Third-Party Cookies

When you choose to load embedded YouTube videos, YouTube may set its own cookies according to their privacy policy. These are only loaded after you explicitly consent to view the video.

Browser Controls

You can configure your browser to reject all cookies, though this will prevent you from logging in and using Dagatal and many other websites.

Processors & Transfers

We work with trusted third-party processors under data processing agreements (DPAs) that meet GDPR requirements. All data is stored within the European Union. Below is a complete list of our processors:

Infrastructure & Hosting

Server4You GmbH
Hessen-Homburg-Platz 1
63452 Hanau, Germany
Purpose: Web hosting, server infrastructure
Data Processed: All website data, user accounts, content
Location: 🇩🇪 Germany (EU)
Safeguards: ✓ DPA Signed

Business Correspondence

IMPRESSUMPRIVATSCHUTZ GmbH
Ludwig-Erhard-Str. 18
20459 Hamburg, Germany
Purpose: Secure and reliable postal address service
Data Processed: Postal mail sent to us
Location: 🇩🇪 Germany (EU)
Safeguards: ✓ DPA Signed

Payment Processing

When you purchase premium features, payment processing is handled by Stripe, Inc., a certified PCI-DSS Level 1 payment service provider. Stripe processes your payment information (credit card details, billing address) directly and securely. We do not store your full payment card details on our servers.

Stripe operates under its own privacy policy and data processing agreements that comply with GDPR requirements. For more information about how Stripe handles your data, please visit Stripe's Privacy Policy.

We receive only transaction confirmations and limited payment metadata (such as the last four digits of your card and transaction ID) necessary to fulfill your premium calendar activation.

Your Rights

Under the GDPR you have the following rights:

• Access to your personal data and information about processing (Art. 15 GDPR).
• Rectification of inaccurate data (Art. 16 GDPR).
• Erasure (“right to be forgotten”) where statutory grounds apply (Art. 17 GDPR).
• Restriction of processing (Art. 18 GDPR).
• Data portability in a structured, commonly used format (Art. 20 GDPR).
• Objection to processing based on legitimate interests (Art. 21 GDPR).
• Right to lodge a complaint with your local supervisory authority.

Security

We apply technical and organizational measures such as encrypted connections (HTTPS), access controls, logging, and regular software updates to protect your data from unauthorized disclosure or loss.

Contact for Privacy Questions