ZUM INHALT SPRINGEN
GolfRanger

Privacy policy

1. Controller

M31 Digital GmbH
Karlsruher Str. 31
76437 Rastatt, Germany
Email: [email protected]

We have not appointed a data protection officer, as the requirements of § 38 BDSG are not met. Please direct data protection enquiries to the address above.

2. Principle

GolfRanger can be used without registration. We do not use advertising or marketing cookies, do not engage in profiling and do not pass on data for advertising purposes. We only process the data required for delivery, security, anonymous audience measurement and handling enquiries.

3. Hosting and delivery

The website runs on servers of Hetzner Online GmbH, Industriestraße 25, 91710 Gunzenhausen, in German data centres. A data processing agreement pursuant to Art. 28 GDPR exists with Hetzner. Delivery takes place via the content delivery network (reverse proxy) operated by Cloudflare, Inc., 101 Townsend Street, San Francisco, CA 94107, USA. In doing so, Cloudflare processes the technical connection data as a processor pursuant to Art. 28 GDPR, in particular IP address, time, requested address and browser identifier, in order to forward the request and fend off attacks. The legal basis is Art. 6 (1) lit. f GDPR, our legitimate interest in a secure and accessible service. For the transfer to the USA, a data processing agreement with EU standard contractual clauses is in place; Cloudflare is also certified under the EU-US Data Privacy Framework.

4. Server log files

Each time the site is accessed, technical access data is stored in log files:

  • IP address of the requesting party
  • Date and time of the request
  • requested address and amount of data transferred
  • referrer, if transmitted
  • browser type and operating system

The processing serves the operation, troubleshooting and defence against abuse (Art. 6 (1) lit. f GDPR). The log files are deleted after seven days. They are not merged with other data.

5. Audience measurement with Matomo

To measure reach we use Matomo, an analytics software that we operate ourselves on our own infrastructure in Germany. Matomo is configured to set no cookies and to store no identifiers on your device. It records pages accessed, referral source, device type, browser, operating system and the country derived from the IP address. The IP address is processed in anonymized form and is not stored in full.

As no access to information on your device takes place, consent pursuant to § 25 (1) TDDDG is not required. The legal basis for processing is Art. 6 (1) lit. f GDPR, our legitimate interest in data-sparing statistics on the use of our service. No data is transferred to third parties.

6. Location suggestion

If you decline your browser’s location sharing, we derive the approximate region from your IP address for a clickable location suggestion. The evaluation takes place exclusively on our server using a locally stored database (MaxMind GeoLite2). Your IP address is not stored in the process and is not transmitted to third parties, and no cookie is set. The legal basis is Art. 6 (1) lit. f GDPR, our legitimate interest in a simple location search. The suggestion is non-binding — you can enter a place yourself at any time.

7. Customer account and registration

When you register, you create a customer account with an email address and password. The password is stored exclusively as an irreversible hash value. Sign-up is completed via a confirmation link (double opt-in); the emails sent for this are handled by the service named in the “Contact form and email” section. Optionally, you can secure your account with two-factor authentication (TOTP); the secret generated in the process is stored encrypted. In your account you manage your favourites and, where submitted, your reviews.

The legal basis is Art. 6 (1) lit. b GDPR. You can download your data as an export at any time (Art. 20 GDPR) and delete your account; deletion is fully executed after a safety period of 30 days, unless statutory retention obligations prevent it.

8. Contact form and email

When you write to us via the form or by email, we process the data you provide to handle your enquiry: name, email address, chosen topic, your message and, if provided, club and phone number. The legal basis is Art. 6 (1) lit. b GDPR for enquiries with a contractual context, otherwise Art. 6 (1) lit. f GDPR.

For sending and receiving the associated emails we use Resend, Inc., 2261 Market Street, San Francisco, CA 94114, USA, as a processor pursuant to Art. 28 GDPR. The transfer is based on EU standard contractual clauses. Your enquiry and the message history are deleted once processing is complete and no statutory retention obligations apply, at the latest after six months.

The form contains a hidden field to fend off automated submissions. It is not stored and serves solely for spam detection.

9. Bot and attack protection

We protect forms and sign-in pages against automated submissions with Cloudflare Turnstile. This loads a script from Cloudflare, Inc. (USA) in your browser, which evaluates technical characteristics of your device and usage behaviour. The legal basis is Art. 6 (1) lit. f GDPR, our legitimate interest in protection against abuse; access to your device is technically necessary for this protection (§ 25 (2) TDDDG).

In addition, our security software CrowdSec, running on our own servers, analyses the server log files to detect attacks and automatically block attacking IP addresses. IP addresses identified as attacks are reported to the manufacturer’s community network (CrowdSec SAS, France, EU), and in return we receive blocklists of known attackers. The legal basis is Art. 6 (1) lit. f GDPR, our legitimate interest in defending against attacks.

10. Error analysis with Sentry

We use Sentry to detect and analyse technical errors (Functional Software, Inc., USA; operated in the EU region, stored within the European Union). When an error occurs, technical data such as the error message, requested address, browser identifier and IP address are processed. The transfer is based on EU standard contractual clauses. The legal basis is Art. 6 (1) lit. f GDPR, our legitimate interest in a stable and error-free operation.

11. Listings by golf facilities

If a golf facility claims its profile, we process the contact details of the contactable person as well as the information submitted for maintaining the listing. The legal basis is Art. 6 (1) lit. b GDPR for the performance of the listing relationship, otherwise Art. 6 (1) lit. f GDPR. The details about the facility, prices and course status are intended for publication in the directory.

12. Recipients

Only the named processors have access to data within the scope of their service: Hetzner for server operation, Cloudflare for delivery and bot protection, Resend for email dispatch, Sentry for error analysis and CrowdSec SAS for the exchange of attack signals. Data is passed on to further third parties only where we are legally obliged to do so.

13. No automated decision-making

No automated decision-making, including profiling pursuant to Art. 22 GDPR, takes place. Search results are sorted according to the criteria you select, such as distance, green fee and guest policy.

14. Your rights

You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and the right to object to processing based on Art. 6 (1) lit. f GDPR (Art. 21). You may withdraw any consent given at any time with effect for the future.

You also have the right to lodge a complaint with a supervisory authority (Art. 77 GDPR). The authority responsible for us is the State Commissioner for Data Protection and Freedom of Information of Baden-Württemberg, Lautenschlagerstraße 20, 70173 Stuttgart.

15. Data security

All transmission is encrypted via TLS. Access to servers and databases is restricted to a small circle of authorised persons, and backups are stored in encrypted form.

Last updated: September 2026. We adapt this policy when the processing or the legal situation changes.