Privacy

1. Controller

The controller responsible for processing personal data in connection with RUN CITY. HANNOVER. is:

The email address above is our contact point for privacy requests. It is not presented here as the contact details of a formally appointed data protection officer.

2. Website access and hosting

When a website is accessed, technical data must be exchanged between your device, our hosting system and, where applicable, embedded services. This may include your IP address, date and time, requested resource, browser/device information and referrer.

We process this data where necessary to deliver the website, maintain stability, troubleshoot errors and protect IT security. The legal basis is Art. 6(1)(f) GDPR. Our legitimate interest is the secure and reliable operation of the portal.

Server and security logs are kept only for as long as required for operation, troubleshooting, abuse prevention or legal obligations and are then deleted or anonymised. Hosting processors are engaged in accordance with Art. 28 GDPR where applicable.

3. Analytics, community statistics and local storage

For reach statistics, each page view or interaction stores only the information required for the measurement, in particular the timestamp, the normalised page path without query parameters, the type of interaction and, where relevant, the RUN CITY content concerned. For an external referral, only the referrer domain may be retained; full referrer URLs are not stored for this analytics purpose. The statistics are used to measure usage and reach and to improve the portal. The legal basis is Art. 6(1)(f) GDPR. Our legitimate interest is privacy-conscious reach measurement and optimisation of RUN CITY. No advertising profiling or cross-site tracking takes place.

RUN CITY also processes certain functional community data, such as route starts, finishes, currently active runs, distance values and like counters. These values are used for portal functionality, public community counters and technical presentation.

Live run sessions

When you start a live run, the server stores the selected route, a random session key, start/activity/completion timestamps, status and distance values. The complete sequence of your GPS points is not stored in the RUN CITY database.

A short-lived session key may be stored in your browser so an interrupted live mode can be resumed. It is function-specific and not used for cross-site advertising or profiling. Depending on the processing, the legal basis is Art. 6(1)(b) or (f) GDPR.

Likes

If you actively use the Like function, the browser stores a technical identifier and like state locally so your own like can be recognised and removed. This identifier is used only for this RUN CITY function. Access to this strictly functional storage is based on section 25(2) no. 2 TDDDG.

4. Location, Route Finder and live navigation

RUN CITY does not automatically access your location simply because you open the website. Location data is used only after you actively invoke a location-based feature and grant location permission in your browser or operating system.

For walking directions to the route entry point, the necessary origin and destination coordinates are transmitted to our server. If OpenRouteService is available, our server forwards these coordinates to HeiGIT gGmbH as the provider of openrouteservice. If the service is unavailable, this version of RUN CITY uses only a direct-distance/line fallback and does not forward the coordinates to an additional public routing provider.

Where consent is required for processing precise location data, the legal basis is Art. 6(1)(a) GDPR. You can revoke location permission at any time in your browser or system settings; this does not affect the lawfulness of processing carried out before revocation.

Routing provider: HeiGIT gGmbH, Schloss-Wolfsbrunnenweg 33, 69118 Heidelberg, Germany. HeiGIT states in its privacy notice that its services, including openrouteservice, process online identifiers and technical server data.

5. Maps and external libraries

RUN CITY uses mapping and navigation components based on Leaflet and MapLibre. Depending on the map mode, map data or tiles are loaded from OpenStreetMap-based services, in particular the OpenStreetMap Foundation and/or OpenFreeMap. When external map resources are requested, the provider necessarily receives technical connection data such as your IP address.

OpenFreeMap states that it does not use cookies or tracking technologies and does not store IP addresses in regular server logs by default; temporary IP logging may be enabled for security incidents. Standard OpenStreetMap Foundation tile services are subject to the OSMF usage and privacy policies.

The Leaflet and MapLibre JavaScript/CSS libraries are currently loaded from unpkg.com. This creates a connection to the CDN when the page loads and may result in processing of technically necessary connection data. Local hosting of these libraries is preferable from a privacy and availability perspective.

External links to partners, music services or event websites are contacted only when you actively click them. From that point onwards, the respective third party's privacy terms apply.

6. RunClub, event and route submissions

The submission form can be used to suggest RunClubs, events or routes. Depending on the selected type, we process the title/name, website or social link, area/location, description, contact name, optional email address and voluntarily uploaded images, logos, photos or GPX files.

We use this data to review the submission, contact you about editorial questions and – after approval – publish or integrate the content into RUN CITY. The legal basis is Art. 6(1)(f) GDPR (legitimate interest in operating and curating the portal); where the submission is connected with entering into or performing a contract, Art. 6(1)(b) GDPR also applies.

Contact details are not published unless this has been explicitly agreed. Submission data and files are kept for the review/publication process and afterwards only for as long as required for the relevant purpose or statutory retention obligations.

7. Recipients and transfers

Personal data is disclosed only to recipients that need it for the purposes described above. These may include our hosting provider, mapping/routing services used for specific features, internal editorial/administrative staff and legally authorised authorities.

We do not sell personal usage or location data to advertisers. Any third-country transfer by external services is governed by their privacy terms and the applicable legal requirements.

8. Your rights

Subject to the statutory requirements, you have rights including access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction (Art. 18), data portability (Art. 20) and objection to processing based on Art. 6(1)(e) or (f) GDPR (Art. 21). Consent can be withdrawn at any time with effect for the future.

To exercise your rights or ask privacy questions, contact datenschutz@eichels-event.com.

You also have the right to lodge a complaint with a data protection authority. In particular:

9. Security and updates

We take appropriate technical and organisational measures to protect data against loss, manipulation and unauthorised access. The website is delivered via encrypted HTTPS.

We update this privacy notice when changes to features, providers or legal requirements make this necessary. The version published on this page is the applicable version.