Privacy policy
This policy explains how Mein-Rosapineta.de and the Mein-Rosapineta Android app process personal data.
Controller
Stefan Waldmann · SMW365.DE
Wilhelm-Maisel-Str. 18, 90530 Wendelstein, Germany
+49 (0)9129 2990-683 · hello@smw365.de
Purposes and legal bases
We process data to provide accounts, community, shop and requested services (Art. 6(1)(b) GDPR), for optional analytics, location, notifications and app advertising after consent (Art. 6(1)(a)), for security and moderation (Art. 6(1)(f)), and to meet legal duties (Art. 6(1)(c)). No solely automated decision with legal or similarly significant effects is made.
Website and app access
IP address, time, requested address, referrer, browser/app version, operating system, device type and error data may be processed to deliver and secure the service. Hosting providers process this data on our behalf where applicable.
Account and profile
Username, e-mail address, password hash, language and voluntary profile data are used for registration, login and profile features. Public visibility is shown in the relevant settings.
Community and communications
Posts, comments, reactions, ratings, reports, messages and related metadata are processed to display content, communicate and moderate abuse. Private messages are visible only to participants and authorised personnel where required for support, security or legal duties.
Photos and files
Uploads may contain image data, captions, technical metadata and recognisable people. Only upload content for which you hold the necessary rights and consents, especially for minors.
Stays and protection of minors
Stay information can include travel period, accommodation type and age groups. Exact current accommodation numbers and precise travel days are not published. Known minors do not receive profile-based advertising. Guardians can contact support about protective measures.
Accommodation enquiries
Mein-Rosapineta only forwards non-binding enquiries and is not a travel agency. With your separate request, necessary contact, travel and accommodation data are sent to the selected provider. The accommodation contract, if any, is concluded directly with that provider.
Location and maps
A voluntary home postal code can be converted to an approximate region. Device location is accessed only after permission for nearby features and is not made public. Map and weather providers receive necessary connection or area data.
Notifications
If system notifications are enabled, after at least seven inactive days we may send at most one weekly reminder about real new posts, approved photos or profile visits, stopping after 90 inactive days. Profile visits record signed-in members only, not anonymous visits or IP addresses; repeat visits are grouped, visible only to the profile owner and deleted after 180 days. Android delivery uses Google Firebase Cloud Messaging. Notifications can be disabled at any time.
Cookies, analytics and app advertising
Required session storage protects login, language and forms. First-party analytics runs only after consent and is designed not to store raw IP addresses. The Android app can use Google AdMob and Google User Messaging Platform only after the required consent; possible data include consent status, IP address, device or advertising identifiers, app/device details and ad interactions. Refusing is not intended to block core community functions.
Recipients and external services
Depending on the feature, recipients can include hosting providers, OpenStreetMap/Nominatim, Open-Meteo, RainViewer/Xweather, CDN providers, Google Play, Google AdMob/UMP, Firebase Cloud Messaging, PayPal, tassendruck.de / E-Unity GmbH & Co. KG and the parcel carrier. Shop production receives only product/motif data, name and delivery address needed for production and delivery; e-mail and phone are not routinely passed on. International transfers use applicable safeguards where required.
Retention
Account data is kept while the account or feature is needed. Deleted community content is removed unless pending reports, security, legal claims or legal duties require limited retention. Paid orders, invoice and payment evidence may be retained for statutory commercial and tax periods, separated from the community account and blocked for other uses.
Export and deletion
You can export account data and schedule deletion under Account & Privacy. There is a seven-day cancellation period. The account, community content and uploads are then deleted; records that must legally be retained are detached and restricted. A public deletion request page is also available.
Security
Measures include HTTPS, password hashing, role-based access, session and form protection and security logging. No online service can guarantee zero risk.
Your rights
Subject to legal conditions, you have rights of access, rectification, erasure, restriction, portability and objection, and may withdraw consent for the future. Contact hello@smw365.de. You may complain to the Bavarian Data Protection Authority (BayLDA).
Updates
We update this policy when services or legal requirements change. The German version is controlling if a translation differs. Last updated: 6 September 2026.