Privacy Policy
Last updated: 2026-07-23
Data Controller
The data controller within the meaning of the General Data Protection Regulation (GDPR) and other national data-protection laws is:
Marco Manzari
Koppoldstr. 1 · 86551 Aichach · DE
Email: mail@utrack.me Phone: +49 30 55570662
Provision of the website and server log files
Each time you visit our website, our hosting provider automatically captures technical information that your browser transmits. This is stored temporarily in so-called log files:
- IP address of the requesting device
- Date and time of access
- Name and URL of the requested file
- Volume of data transferred and HTTP status code
- Browser type and version, operating system
- Referrer URL (the previously visited page)
Processing is carried out on the basis of Art. 6(1)(f) GDPR. The legitimate interest of Marco Manzari is the secure and stable operation of the website and the prevention of attacks. Log files are automatically deleted after 30 days, unless a security incident requires longer retention.
Legal basis: Art. 6(1)(f) GDPR (legitimate interest)
Cookies
We set technically necessary cookies so that our website functions correctly. These cookies are required for the operation of the site (e.g. for storing language preferences or for load balancing) and are placed without consent on the basis of § 25(2) No. 2 TDDDG.
We only set technically necessary cookies and do not use any non-essential cookies.
You can completely deactivate the setting of cookies in your browser at any time or delete cookies that have already been set. Instructions can be found in your browser's help function.
Legal basis: § 25 TDDDG (Germany) and Art. 6(1)(f) GDPR (legitimate interest)
User accounts / registration
To use the full scope of our services, you can create a user account. As part of registration and account use we process the following data:
- e-mail address
- username
We need this data to create your account, authenticate you, and provide the agreed features.
Passwords are stored only as secure hashes and are not readable by us in plain text.
The legal basis is Art. 6(1)(b) GDPR (performance of contract). Under Art. 17 GDPR you have the right to erasure of your account and under Art. 20 GDPR the right to data portability of the data you have provided. Contact us at mail@utrack.me. After deletion, your account data is removed without undue delay, unless statutory retention obligations apply.
Legal basis: Art. 6(1)(b) GDPR (contract performance)
Embedded maps
We embed mapsfrom the provider OpenStreetMap (browser viewer). As soon as you load a page with an embedded map, data is transmitted to the map provider — in particular your IP address and information about the page accessed. Interactive use (zoom, pan) may transmit further location or behavioural data.
Where the provider (e.g. Google Maps, Mapbox, OpenStreetMap tiles served via third-party CDNs) transfers data to third countries, this takes place on the basis of appropriate safeguards (in particular Standard Contractual Clauses and — for US providers, where applicable — the EU-US Data Privacy Framework).
The legal basis is your consent under Art. 6(1)(a) GDPR and § 25(1) TDDDG. You can withdraw your consent at any time via our consent manager.
Legal basis: Art. 6(1)(a) GDPR (consent) and § 25 TDDDG (Germany)
Data processors
To carry out our tasks, we use carefully selected service providers who process personal data on our behalf ("data processors" pursuant to Art. 28 GDPR). A data-processing agreement (DPA) is in place with each of these providers.
| Provider | Purpose | Country | DPA |
|---|---|---|---|
| Hetzner Online GmbH | Hosting of the uTrack relay server and the Zitadel identity service | DE | Agreement |
| Scaleway SAS | Domain, DNS and transactional e-mail | FR | Agreement |
| Migadu Email AB | Mailbox for the contact address | CH | Agreement |
Our website is hosted with Hetzner Online GmbH (DE).
Transfers to third countries
Where we transfer data to countries outside the European Economic Area (EEA), we do so only under the conditions of Art. 44 ff. GDPR. We ensure an adequate level of protection through one of the following mechanisms:
- An adequacy decision by the European Commission (Art. 45 GDPR) — currently in force for Andorra, Argentina, Canada (commercial organisations under PIPEDA only), Faroe Islands, Guernsey, Isle of Man, Israel, Japan, Jersey, New Zealand, South Korea, Switzerland, United Kingdom, Uruguay, and United States (DPF-certified recipients only);
- EU Standard Contractual Clauses (Art. 46(2)(c) GDPR) — in the 2021/914 version, supplemented by technical and organisational measures in line with the CJEU's Schrems II case-law.
Specific recipients:
- OpenStreetMap Foundation (map tiles, browser viewer) (GB) — an adequacy decision is in force for this country.
- Migadu Email AB (CH) — an adequacy decision is in force for this country.
We will provide copies of the Standard Contractual Clauses and the supplementary measures on request. Please use the contact details given in this notice.
Retention period
We retain personal data only for as long as is necessary for the respective processing purposes or as required by statutory retention periods (in particular under § 257 HGB and § 147 AO — typically 6 or 10 years).
Specific retention periods for individual processing activities are set out in the relevant sections of this privacy policy.
Your rights as a data subject
You have the following rights at any time with regard to your personal data:
- Access to the data stored about you (Art. 15 GDPR)
- Rectification of incorrect or incomplete data (Art. 16 GDPR)
- Erasure of your data ("right to be forgotten", Art. 17 GDPR)
- Restriction of processing (Art. 18 GDPR)
- Data portability (Art. 20 GDPR)
- Withdrawal of a consent given with effect for the future (Art. 7(3) GDPR)
To exercise these rights, an informal notification to mail@utrack.me is sufficient.
Independently, you have the right to lodge a complaint with a data-protection supervisory authority (Art. 77 GDPR; see below).
Right to Object (Art. 21 GDPR)
You have the right, on grounds relating to your particular situation, to object at any time to the processing of your data, where such processing is carried out on the basis of legitimate interests (Art. 6(1)(f) GDPR) or in the public interest (Art. 6(1)(e) GDPR).
Where your data are processed for the purposes of direct marketing, you have the right to object at any time and without giving reasons. After your objection, your data will no longer be processed for that purpose.
You may submit your objection informally to: mail@utrack.me
Right to lodge a complaint with a supervisory authority
Under Art. 77 GDPR you have the right to lodge a complaint with a data-protection supervisory authority concerning the processing of your personal data — in particular in the Member State of your habitual residence, your place of work, or the place of the alleged infringement.
Competent supervisory authority for the controller:
Berliner Beauftragte für Datenschutz und Informationsfreiheit Alt-Moabit 59-61, 10555 Berlin