This website is a private site about our airfield and our aircraft. It has no advertising and uses no third-party analytics tools. Some tool pages with maps and weather data load content from external servers – section 7 lists which ones. Even so, some data inevitably arises when you visit a website. This page explains what that data is and what happens to it.
1. Controller
The controller responsible for data processing on this website is:
Thomas Hünerfauth
E-mail:
The controller is the natural or legal person who, alone or jointly with others, determines the purposes and means of the processing of personal data.
2. Hosting and server log files
This website is hosted by an external service provider: STRATO AG, Otto-Ostrowski-Straße 7, 10249 Berlin, Germany. The host processes the data arising from visits to this site on our behalf; there is a data processing agreement in accordance with Art. 28 GDPR.
Each time a page is requested, information transmitted by your browser is automatically stored in so-called server log files:
- requested address, date and time of access
- amount of data transferred and whether the request succeeded
- browser type and version, operating system
- previously visited page (referrer)
- IP address
This data is not combined with other data sources. The legal basis is Art. 6(1)(f) GDPR. Our legitimate interest lies in the technically error-free operation and the security of the website. The log files are deleted automatically after seven days at the latest.
Our own visitor count
To see how often this website is used, we count page views on our own server. To do this, each page reports its view to this server via JavaScript when it loads. No cookies are set, no IP addresses are stored and no data is passed on to third parties.
So that the same browser counts as a visitor only once per day, the server forms a shortened, non-reversible checksum from a random value generated anew each day, the IP address and the browser identifier (user agent). The random value and all checksums of a day are deleted with the first request on the following day; after that, a visit can no longer be attributed to any person or device. Only two numbers per day are stored permanently: the number of page views and the number of visitors. Which page was viewed is not stored.
The legal basis is Art. 6(1)(f) GDPR; our legitimate interest is to know, in rough figures, how our site is used. The statistics are visible only to logged-in members in the internal area. If you do not want to be counted, you can switch off JavaScript in your browser.
3. Cookies
This website uses only technically necessary cookies. The content management system Joomla sets a session cookie that allows requests to be assigned to a session and expires when the browser is closed. A second session cookie remembers the language you have chosen (German or English), so that the site stays in that language while you browse. Anyone who logs in to the internal area also receives a cookie that keeps them logged in.
No cookies are set for analytics or advertising purposes. The legal basis is Section 25(2) No. 2 TDDDG (German Telecommunications Digital Services Data Protection Act) in conjunction with Art. 6(1)(f) GDPR. A consent banner is therefore not required.
4. Guestbook
Anyone who leaves an entry in the guestbook provides a subject, name and message; giving an e-mail address is optional. In addition, the time of the entry and the IP address are stored. Subject, name and message are publicly visible on the website; the e-mail address and the IP address are not published.
The legal basis for publication is consent in accordance with Art. 6(1)(a) GDPR, which is given by submitting the entry. The legal basis for storing the IP address is Art. 6(1)(f) GDPR; the legitimate interest lies in preventing misuse and protecting against unlawful content.
Entries remain stored until they are deleted. Consent can be withdrawn at any time with effect for the future – an informal e-mail to the address above is sufficient, and the entry will then be removed.
To protect against automated entries, the form asks a simple arithmetic question first. No data is transmitted to third parties in the process.
5. User accounts and internal area
Part of this website is accessible only after logging in. Accounts are created manually, and only for a small circle of people known by name; self-registration is not possible. Stored are name, username, e-mail address, an encrypted password and the time of registration and of the last login.
The legal basis is Art. 6(1)(b) GDPR. The data is deleted as soon as the account is closed.
6. Contact by e-mail
If you contact us by e-mail, the information you provide is stored in order to deal with your request. The legal basis is Art. 6(1)(f) GDPR or, where a contract is being initiated, Art. 6(1)(b) GDPR. The data is deleted as soon as the request has been dealt with and no statutory retention periods apply.
Reports about airfield information
The airfield cards have a link “Something wrong? Report it”. The form transmits the airfield concerned, the page, the selected category, the text entered and – if given – a source and an e-mail address for questions. Giving an e-mail address is optional. The report is sent by e-mail to the controller and stored on this website’s server (STRATO) in a file that is not publicly accessible.
To prevent misuse, the number of reports is limited. For this purpose an irreversible check value is derived from the IP address and the date; it expires after 24 hours. The IP address itself is not stored. The legal basis is the legitimate interest in correct airfield information (Art. 6(1)(f) GDPR), and consent for the optional e-mail address (Art. 6(1)(a) GDPR). Reports are deleted once they have been dealt with, at the latest after twelve months.
7. What this website does not do – and where external servers are involved
We use no third-party web analytics services (for our own data-minimising visitor count, see section 2), no advertising networks, no social media plugins and no fonts from external servers. When you open the text and image pages, only the server of this website is contacted. There is no automated decision-making and no profiling.
Maps and weather data from external servers
Some tool pages need maps or weather data that we cannot provide ourselves. On these pages your browser loads content directly from the providers listed below. In doing so, the respective provider necessarily receives your IP address, information on browser and operating system, date and time and the address of the referring page. The weather services also receive the coordinates of the selected airfields or route points – these are not personal data. We ourselves receive no data about you from these providers.
| Provider | Purpose | On which pages |
|---|---|---|
| cdnjs (Cloudflare, Inc., USA), cdnjs.cloudflare.com | Leaflet map library (program code and stylesheet) | Radar, webcams on the map, weather briefing |
| OpenTopoMap, opentopomap.org | Map tiles (topographic map) | Radar, webcams on the map |
| OpenStreetMap Foundation, United Kingdom, openstreetmap.org | Map tiles | Precipitation radar in the weather briefing |
| Deutscher Wetterdienst, Offenbach, maps.dwd.de | Precipitation radar images | Precipitation radar in the weather briefing |
| Open-Meteo, open-meteo.com | Weather model data and terrain elevations | Weather briefing (Alpine conditions), destination briefing, route briefing |
| airplanes.live (USA), globe.airplanes.live | Embedded live map of air traffic | Radar |
| DFS Deutsche Flugsicherung GmbH, Langen, ais.dfs.de | Embedded overview of airspace use (AUP) | Weather briefing |
The legal basis is Art. 6(1)(f) GDPR: we have a legitimate interest in displaying up-to-date maps and weather data for flight planning without being able to host them ourselves. For providers based in the USA, a transfer of data to the USA cannot be ruled out. The providers' own privacy policies apply to their processing. If you want to avoid this, do not open these tool pages; all other pages work without external servers.
Linked external websites – such as manufacturer, authority or press pages – are independent services. They are loaded only when you click the link. The respective provider is responsible for their data processing.
8. Encryption
This website is delivered exclusively over an SSL/TLS-encrypted connection, recognisable by the padlock symbol in your browser. Data transmitted cannot therefore be read by third parties.
9. Rights of data subjects
You have the following rights vis-à-vis the controller:
- Access to whether and which data is processed (Art. 15 GDPR)
- Rectification of inaccurate data (Art. 16 GDPR)
- Erasure (Art. 17 GDPR)
- Restriction of processing (Art. 18 GDPR)
- Data portability (Art. 20 GDPR)
- Objection to processing based on a legitimate interest (Art. 21 GDPR)
- Withdrawal of consent given, with effect for the future (Art. 7(3) GDPR)
For all of these requests, an informal message to the e-mail address above is sufficient.
10. Right to lodge a complaint with a supervisory authority
Independently of this, you have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR), in particular in the place of your residence, your place of work or the place of the alleged infringement. For this website, it is:
Bayerisches Landesamt für Datenschutzaufsicht (BayLDA)
Promenade 18, 91522 Ansbach, Germany
11. Changes to this policy
This privacy policy will be updated as soon as the legal situation or the functions of this website change. The version available here applies.
Last updated: October 2026