Privacy policy

Note: This English version is for convenience; the German version (Datenschutzerklärung) is authoritative.

This privacy policy applies to the website my-store-locator.com (the "website") and to the My Store Locator application at app.my-store-locator.com insofar as we process our customers' data there (section 9). The website is deliberately lean: no cookies, no analytics or tracking services, no fonts or scripts from third-party servers.

Last updated: 13 October 2026

1. Controller

The controller responsible for data processing is:

Internet am Dornbusch, owner Sajjad Hanifa
Eschersheimer Landstraße 297, 60320 Frankfurt am Main, Germany
Phone: +49 69 34 87 77 44
E-mail: info@my-store-locator.com

My Store Locator is a service of Internet am Dornbusch.

We are not required to appoint a data protection officer (Section 38 BDSG). If you have questions about data protection, please contact us directly.

2. Overview

We keep data processing on this website to a minimum:

  • We use no cookies.
  • We use no analytics or tracking services and no advertising pixels.
  • Fonts are loaded from our own server, not from third parties.
  • The live demo map only loads map tiles from OpenStreetMap after you click "Load map".
  • Forms are not stored in a database but sent to us by e-mail.

3. Hosting and server log files

This website runs on a server operated by us at IONOS SE, Elgendorfer Str. 57, 56410 Montabaur, in a data centre in Germany. The My Store Locator application (app.my-store-locator.com) runs separately on servers of STRATO GmbH in Germany (see section 9).

When you open a page, the server automatically processes information transmitted by your browser in so-called server log files:

  • IP address
  • date and time of access
  • page or file requested
  • amount of data transferred and HTTP status code
  • referrer URL (the previously visited page)
  • browser type and version, operating system

Purpose: delivering the website, ensuring stability and security, detecting and preventing attacks.

Legal basis: Art. 6(1)(f) GDPR. Our legitimate interest lies in providing the website securely and without errors.

Retention: the log files are not combined with other data and are deleted as soon as they are no longer needed for these purposes.

4. Cookies and local storage

This website does not set any cookies and does not store any data in your browser's local storage (localStorage, sessionStorage).

5. Contact form and demo booking

If you write to us using the contact form or the demo booking form, we process the details you provide: name, e-mail address and your message and – if provided – company, phone number, topic, number of locations, website and preferred date. Name and e-mail address (and the company for demo bookings) are required so that we can reply.

Delivery by e-mail: form submissions are not stored in a database but sent to us by e-mail. You automatically receive a confirmation at the address you provided (without your message). Sending and mailbox run via our e-mail account at IONOS SE, Elgendorfer Str. 57, 56410 Montabaur, Germany. If a message temporarily cannot be delivered, we store it securely on our web server without external access until we have transferred it to our mailbox; we then delete it there.

Spam protection: to protect against automated submissions, the forms use methods without third parties: a hidden field, a signed time stamp and a small calculation that your browser solves when you submit. We also count submissions per form and hour using an encrypted code (hash) of your IP address; this code is deleted automatically after one hour. The legal basis is Art. 6(1)(f) GDPR (protection against abuse).

Purpose: handling your enquiry and, where applicable, preparing and holding a demo.

Legal basis: Art. 6(1)(b) GDPR where your enquiry is aimed at concluding a contract; otherwise Art. 6(1)(f) GDPR (legitimate interest in answering enquiries).

Retention: we delete your enquiry once it has been dealt with and no statutory retention obligations apply. Business correspondence that leads to a contract is kept for the periods required by commercial and tax law (Art. 6(1)(c) GDPR).

6. Contact by e-mail or phone

If you e-mail or call us, we process your contact details and the content of your message to deal with your request. The legal basis is Art. 6(1)(b) GDPR for contract-related enquiries, otherwise Art. 6(1)(f) GDPR. Our mailboxes are hosted by IONOS SE, Elgendorfer Str. 57, 56410 Montabaur, Germany. We keep business correspondence for the retention periods required by commercial and tax law (Art. 6(1)(c) GDPR).

7. Live demo map (OpenStreetMap)

On some pages we show a demo map with fictional sample locations. The map does not load at first; you see a placeholder with a notice. Only when you click "Load map" does your browser request map tiles from the OpenStreetMap Foundation's tile server.

Provider: OpenStreetMap Foundation, St John’s Innovation Centre, Cowley Road, Cambridge, CB4 0WS, United Kingdom.

Data transferred: IP address, browser information, requested map sections and the address of the page on which the map is shown.

Legal basis: your consent, given by clicking "Load map" (Art. 6(1)(a) GDPR). You can withdraw consent at any time with effect for the future by reloading the page and not loading the map again. Your choice is not stored – after reloading the page, only the simplified preview map without any external connection is shown again.

Third country: the United Kingdom is a third country. There is an adequacy decision of the European Commission for the United Kingdom under Art. 45 GDPR.

More information: OpenStreetMap Foundation privacy policy at https://osmfoundation.org/wiki/Privacy_Policy (external link)

This website contains links to other websites, for example to guides by website builder providers. Simply viewing our page does not transfer any data to those websites. Only when you follow a link does the respective operator process your data under its own responsibility.

9. The My Store Locator application (customer accounts)

Links such as "Start for free" or "Log in" take you to the application at app.my-store-locator.com. When you create and use an account there, we process the following as controller:

  • Account data: name, e-mail address, company, password (stored only as a hash), role and language, and the data of team members you invite
  • Contract and billing data: chosen plan, billing period, billing address, VAT ID, invoices and payment status
  • Usage and security data: sign-in times, session data and a change log (audit log)

Purpose and legal basis: providing the service and performing the contract (Art. 6(1)(b) GDPR), complying with tax and commercial law obligations (Art. 6(1)(c) GDPR) and keeping the service secure (Art. 6(1)(f) GDPR). For signing in, the application sets a technically necessary session cookie (Section 25(2) no. 2 TDDDG); it is used only for signing in, not for analytics.

Hosting: the application and its database run on servers operated by us in data centres of STRATO GmbH, Otto-Ostrowski-Straße 7, 10249 Berlin, in Germany. E-mails from the application (for example invitations) are sent via IONOS SE, Elgendorfer Str. 57, 56410 Montabaur, Germany.

Payment processing via Stripe: paid plans are billed via the payment service provider Stripe Payments Europe, Ltd., 1 Grand Canal Street Lower, Dublin 2, Ireland ("Stripe"). When you book a plan, you enter your payment details (for example card, SEPA direct debit or PayPal) directly on Stripe's payment page (Stripe Checkout); we do not receive full card or account details. We pass on to Stripe the information needed for the payment (name, e-mail address, company, billing address, plan and amount) and receive the payment status from Stripe. You manage your subscription and payment method in Stripe's customer portal, which you open from the application. The legal basis is Art. 6(1)(b) GDPR. Stripe also processes payment data as an independent controller, for example to prevent fraud and to meet legal obligations. In doing so, Stripe may transfer data to Stripe, Inc. in the USA; Stripe, Inc. is certified under the EU-US Data Privacy Framework (adequacy decision under Art. 45 GDPR), and Stripe additionally uses standard contractual clauses. More in Stripe's privacy policy: https://stripe.com/privacy (external link)

Retention: we delete account data 30 days after the contract ends. Invoices and accounting records are kept for the statutory periods (up to 10 years, Section 147 AO, Section 257 HGB).

Data of your website visitors: if you, as a customer, embed location maps on your own website, we process your website visitors' data and your location data as a processor on your behalf. The data processing agreement applies to this.

10. Recipients

Within our company, only the people who need your data for the purposes described receive it. External recipients are the service providers named in this policy: IONOS SE (website hosting, e-mail), STRATO GmbH (data centre for the application), Stripe for paid plans (payment processing) and – after you click "Load map" – the OpenStreetMap Foundation. We do not pass on data for advertising purposes.

11. Your rights

Under the GDPR you have the following rights:

  • access to the data we process about you (Art. 15 GDPR)
  • rectification of inaccurate data (Art. 16 GDPR)
  • erasure (Art. 17 GDPR)
  • restriction of processing (Art. 18 GDPR)
  • data portability (Art. 20 GDPR)
  • withdrawal of consent with effect for the future (Art. 7(3) GDPR)

Right to object (Art. 21 GDPR): where we process data on the basis of legitimate interests (Art. 6(1)(f) GDPR), you may object at any time on grounds relating to your particular situation.

To exercise your rights, an informal message to the contact details above is sufficient.

12. Right to lodge a complaint

You have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR), in particular in the member state of your habitual residence, place of work or the place of the alleged infringement. The authority responsible for us is the Hessian Commissioner for Data Protection and Freedom of Information (Hessischer Beauftragter für Datenschutz und Informationsfreiheit), Postfach 3163, 65021 Wiesbaden, Germany.

13. Obligation to provide data

You are not obliged to provide us with personal data. Without the required details in the form, however, we cannot handle your enquiry, and without account data we cannot provide the application. Without the technically transmitted data (server log files), the website cannot be displayed.

14. No automated decision-making

We do not use automated decision-making, including profiling, within the meaning of Art. 22 GDPR.

15. Changes

We update this privacy policy when the website, the application or the legal requirements change. The version published here applies.

Last updated: 13 October 2026