GDPR and security

Operated and hosted in Germany

My Store Locator is a product of Internet am Dornbusch (owner Sajjad Hanifa), Frankfurt am Main. Your contract partner is based in Germany, and German law applies to the contract.

• Application and database: on servers operated by us in data centres of STRATO GmbH in Germany. This is where your location data, user accounts and your visitors' enquiries are stored – exclusively on servers in Germany.
• This website: on a server operated by us at IONOS SE, in a data centre in Germany.
• E-mail: mailboxes and sending via IONOS SE in Germany.
• Support: in German and English, by phone and e-mail.

Two services deliberately sit outside these servers: your visitors' browsers load map tiles directly from OpenStreetMap – with consent mode only after a click (see below). Payments for paid plans are handled by Stripe; details are in the privacy policy.

Data processing agreement (Art. 28 GDPR)

When you use My Store Locator, we process data on your behalf, for example enquiries that visitors send through the form on your map. You can conclude the data processing agreement directly in the app, and read it in advance on the DPA page.

Consent mode (two-click solution)

An interactive map is made up of many small images, the map tiles. Your visitors' browser loads them from a tile server, currently OpenStreetMap. With every such request, the tile server necessarily receives the visitor's IP address. That is exactly why the map shouldn't load without asking.

In the Embed Studio you can turn on consent mode:

1. Visitors first see a placeholder with a short privacy notice.
2. Only after they click "Load map" are the map and its tiles loaded.
3. Until then, neither the map nor any tiles are requested.

Consent mode works with both the iframe code and the JavaScript widget. Whether you need it, or prefer to control the map through your own consent tool, is something to decide with your data protection officer.

Statistics without cookies or IP addresses

So you can see how your map is used, My Store Locator counts map views, searches, opened locations, directions, calls and website clicks. These values are stored as aggregated daily counters, for example "map X, 12 October: this many views".

• No cookies are set.
• IP addresses are not stored in the statistics.
• No profiles of individual visitors are created.

Your data stays yours

• Data export (Art. 20 GDPR): download your data from the app as a ZIP file with CSV and JSON files.
• CSV export of your locations at any time, for use in other systems.
• Company data isolation: each company's data is separated at database level (row level security). One company cannot see another company's data.

Access and accountability

• Roles: Owner, Administrator, Editor, Store manager (own locations only) and Viewer. Everyone gets only the rights they need.
• Audit log: changes are recorded.
• Invitations via one-time link instead of shared passwords.

Technical security

• Passwords are hashed with Argon2, a current algorithm for password hashing. We never know your password.
• Rate limits slow down automated login attempts and abuse of public endpoints.
• HTTPS for the app, maps and interfaces.
• API keys are stored only as hashes and shown exactly once.

Coming soon

• Two-factor authentication (2FA) – the interface is in place, but the feature is not active yet.
• Single sign-on (SSO) for Enterprise customers.

We don't advertise seals or certificates. Instead, this page describes what is actually implemented.

What you need to take care of

You are the controller for your own website. If you embed the map, you should mention it in your privacy policy. The text below can serve as a starting point.

Template: location map (My Store Locator)

Our website includes a location map provided by the My Store Locator service, operated by Internet am Dornbusch, owner Sajjad Hanifa, Eschersheimer Landstraße 297, 60320 Frankfurt am Main, Germany. The map is only loaded once you click "Load map". At that point, your IP address and technical information about your browser are transmitted to the My Store Locator servers in Germany and to the OpenStreetMap tile servers so that the map can be displayed. My Store Locator keeps usage statistics only as aggregated daily counters, without cookies and without storing your IP address. If you send an enquiry using the contact form on the map, we process your details to handle your enquiry. The legal basis is your consent (Art. 6(1)(a) GDPR), which you can withdraw at any time with effect for the future. My Store Locator processes the data on our behalf under an agreement pursuant to Art. 28 GDPR.

For more background, read our guide Store locators and the GDPR.

FAQ