Legal notice

This is a courtesy translation. The German version is the legally binding one.

Information pursuant to § 5 DDG

Christian Dresel
Unterfürberger Str. 52
90768 Fürth
Germany

Contact

Disclaimer for the geocoding service

Data source. Using the Nominatim software, this server provides search and reverse search based on OpenStreetMap data for Germany, Austria, Switzerland and Liechtenstein. The data comes from the Geofabrik extract “DACH”. It is collected by the OpenStreetMap community and is not checked or edited by me. I give no warranty for its correctness, completeness or timeliness. The data may be out of date.

Provision. The service is run privately and without any assurance of availability, response time or a particular query capacity. It may be changed, restricted or discontinued at any time without notice, for example for maintenance, data updates or in case of overload. Requests are limited per IP address and may be rejected. No applications should be built on the service where a failure could cause damage (for example navigation, emergency or safety applications).

Use of the results. Anyone who reuses results is responsible for complying with the ODbL (in particular the attribution “© OpenStreetMap contributors”) and for the lawful use of the results. The respective user alone is responsible for the search terms and coordinates they send to the server. Abusive use or use that disrupts operation (for example sustained load, circumventing the limits) may lead to a block.

Statutory liability. Liability for intent and gross negligence, for damage from injury to life, body or health, and under mandatory statutory provisions remains unaffected. Otherwise liability is excluded to the extent permitted by law. Under §§ 7 to 10 DDG I am not obliged to monitor third-party information that is transmitted.

Liability for links

This site links to external websites (for example OpenStreetMap, the OSM wiki and nominatim.org) whose content I have no influence on. The respective operator is always responsible for them. No legal violations were apparent at the time of linking.

Copyright and licence

The texts of these pages written by me are subject to German copyright law. The place data served is © OpenStreetMap contributors and is available under the Open Database License (ODbL). Nominatim is free software (GPL 2.0) by the Nominatim project.

Privacy

Controller is Christian Dresel; address and email see above.

What data is processed. When you open this page and the API (/search, /reverse, /lookup, /details, /status), the server processes technically necessary data:

Web server log (nginx): IP address, date and time, requested URL including the search terms or coordinates (they are part of the URL), method, status code, amount of data transferred, referrer and browser/client identifier (user agent). Retained for 14 days, then deleted automatically. Therefore do not send personal or confidential information as a search term.
Request limiting: To limit the load per user, the web server briefly keeps the IP address (the /64 network for IPv6) in memory. This is not permanent storage.
Usage statistics (start page): A script counts only numbers, namely queries per hour, rejected queries and the CPU load of the container. No IP addresses, browser identifiers or query contents are stored.

IPv4, IPv6 and the upstream proxy. My server is located at my home in Fürth. IPv6 requests arrive there directly; I ask you to prefer IPv6. IPv4 requests go through an upstream proxy server in Germany that is not operated by me and that I have no influence on (information about the service: sni.fff.community). The proxy only forwards the encrypted connection based on the server name (SNI) and does not decrypt it (end-to-end HTTPS); it therefore cannot read search terms or responses. For technical reasons, the proxy operator sees the client’s IP address, the server name, and the time and data volume of the connection. Unencrypted HTTP requests over IPv4 are answered by the proxy itself with a redirect to HTTPS. Whether and for how long the proxy operator logs data itself, I do not know and cannot say. For IPv4 requests, my server receives the client’s IPv4 address embedded in an IPv6 address and logs it in that form. It remains personal data and, like the other log data, is deleted after 14 days. I am not aware of any processing outside Germany.

Purpose and legal basis. The processing serves secure and stable operation, error analysis, limiting the load per user and preventing abuse. The legal basis is Art. 6(1)(f) GDPR (legitimate interest in operating the service). The data is not combined with other data, not linked into profiles, not passed on to third parties by my server and not used for advertising (for the proxy on IPv4 see above). The logs are evaluated only manually for troubleshooting and abuse prevention.

Cookies, third parties. These pages set no cookies. The start page and the legal notice do not load external fonts or images. The connection is encrypted via HTTPS (TLS). The certificate comes from Let’s Encrypt; no visitor data is transmitted in the process. When you click external links (for example to OpenStreetMap or GitHub), the privacy policies of the respective provider apply.

Web analytics of the start page (Matomo). On the start page (not on the API) I use Matomo, open-source software for audience measurement, to see how often the start page is opened. Matomo runs on the operator’s own server (matomo.dresel.systems); no data is passed on to third parties. What is recorded is the page viewed, the approximate origin (country, city), browser type, operating system, screen resolution and the referrer URL. No cookies are set (Matomo is configured cookieless), and the IP address is shortened at collection (the last two number blocks are removed, 203.0.113.45 becomes 203.0.0.0), so that it can no longer be assigned to a specific person. The legal basis is Art. 6(1)(f) GDPR (legitimate interest in analysing and improving the offering). The anonymised evaluation data is stored for the longer term to compare development over time. You can switch tracking off here at any time (a script from matomo.dresel.systems is loaded on this page for that):

Your rights. You have the right of access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18) and objection (Art. 21 GDPR), as well as the right to lodge a complaint with a data protection supervisory authority; in Bavaria this is the Bavarian State Office for Data Protection Supervision (BayLDA). Providing the data is not mandatory, but without it the server cannot be operated technically. Please send requests by email to the address above. Since the logs are deleted after 14 days, I cannot attribute older accesses any more.