Privacy policy

Overview

EloYellow Brasil is a directory of Brazilian businesses, services, products, events and lifestyle in Germany. Here we explain which personal data we process, for what purpose, on what legal basis, for how long and who receives it. Personal data is any information that can be related to a person, for example a name, an email address or an IP address.

Our principles:

• We do not use advertising or tracking cookies. Anything that is not technically necessary only runs with your consent.
• Fonts, icons and images come from our own servers. Without your consent, your browser does not load anything from third parties when you visit our pages, not even the map.
• We count page views on our server, without cookies and without storing your IP address.
• We do not sell data or pass it on for advertising purposes.

Controller and contact

The controller within the meaning of the General Data Protection Regulation (GDPR) is:

Paulius Sapranauskas Einzelunternehmen
Bahnhofstraße 33, 76703 Kraichtal
Owner: Paulius Sapranauskas

Email for data protection questions: info@eloyellow-brasil.de
Phone: 0152 2278 2156

We have not appointed a data protection officer because there is no legal obligation to do so (Section 38 BDSG).

Visiting the website and server logs

When you open our pages, your browser sends technically necessary information to our server. Without it, no page can be delivered.

• Data: IP address, date and time, the address requested (including search terms or location data contained in the address, for example in a “Near me” search), the previous page (referrer), browser identification (user agent), preferred language, status code, amount of data transferred and response time.
• Access log: our web server stores this information with a shortened IP address: for IPv4 the last block is removed, for IPv6 only the first three blocks are kept.
• Error and security log: in the event of errors and too many requests in a short time, the web server logs the full IP address. A protection program blocks addresses that repeatedly stand out for one hour.
• Protection against abuse: to slow down automated requests, our application briefly counts requests per connection in memory. For this it derives a checksum with a secret key from the IP address; the address itself is not stored for this purpose. The counters disappear at the latest with the next restart.
• Purpose: delivering the pages, stability, security, defence against attacks and abuse, troubleshooting.
• Legal basis: Art. 6(1)(f) GDPR. Our legitimate interest is a secure and working website.
• Retention: access and error logs 7 days, application logs (without IP addresses) at most 14 days.
• Recipients: our hosting provider IONOS SE, Elgendorfer Str. 57, 56410 Montabaur as processor.

Audience measurement without cookies

We count views of our pages directly on our server. We store nothing on your device and read nothing from it. There is no cookie and no script.

• Data: from the information your browser sends anyway (see server logs), we evaluate the page requested, the domain of the previous page, the preferred language, campaign parameters in the address (utm_source, utm_medium, utm_campaign), device class and browser family. From the IP address, our web server determines the federal state or country using a local database; only this region is stored.
• Pseudonymisation: from the IP address, browser identification and domain we derive a shortened checksum (HMAC-SHA256, 64 bits) with a random key that is valid for one day only. We store only this checksum, never the IP address or the full browser identification. The daily key is deleted at the change of day. After that the checksum can no longer be attributed to anyone, and visits on different days cannot be linked. Of the referrer we store only the domain.
• Purpose: we want to know how many people use our pages, where they come from and which content is in demand, and to fix errors such as pages that are not found.
• Legal basis: Art. 6(1)(f) GDPR. Our legitimate interest is audience measurement that uses little data. § 25 of the German TDDDG is not affected because we neither access your device nor store anything on it.
• Retention: individual views with the daily checksum at most 30 days, after that only aggregated daily figures without any personal reference.
• Searches without results: when a search finds nothing, we count the search term, place and selected category as a daily total, without checksum, IP address or time of day. We do not store entries that look like an email address, a phone number or a link. This shows us what is still missing on the platform. We delete these daily totals after 90 days.
• Recipients: none. The analysis runs on our server at IONOS SE, Elgendorfer Str. 57, 56410 Montabaur.

We do not count visits by search engines or other automated programs. Because we do not store anything that would let us recognise you, we cannot attribute individual views to a person afterwards (Art. 11 GDPR).

Counts for business statistics

Businesses see in their area how often their listing is used. For this we count per business and day: profile views, appearances in lists and search results, clicks on contact options (phone, WhatsApp, email, website, route, Instagram, Facebook, TikTok) and how often the listing was saved.

• How it works: views and appearances are reported to our server by a small script on the page. It only transmits the numbers of the businesses shown, no identifier, no page address and no referrer, and it stores nothing on your device. Clicks on contact options go through a redirect on our server, which counts the click and takes you straight to the destination.
• Data: we only store daily totals per business, nothing about you. We discard counts from search engines and other automated programs.
• Legal basis: Art. 6(1)(f) GDPR. Our legitimate interest is to show businesses how their listing is used.
• Recipients: each business sees the totals for its listing in its area.
• Retention: daily totals without personal reference are kept indefinitely. For the requests themselves, the server logs apply.

Cookies and browser storage

We only store on your device what a function you expressly use needs, or what you have allowed. Name, purpose, duration and time of each entry are listed below under Cookies and local storage and on the page Storage and cookie overview.

• Necessary: login (cookies sid and li), the feedback after submitting a form (auth_flash for login and registration, rv_flash for reviews and reports, ads_flash for requests on the “Advertise” page) and your choice in the cookie notice (consent). The legal basis for storage is § 25(2) no. 2 TDDDG; for the processing, Art. 6(1)(b) GDPR (account and forms you submit) and Art. 6(1)(c) in conjunction with Art. 7(1) GDPR (proof of your choice).
• With consent: we only use functions that are not technically necessary if you agree in the cookie notice. The legal basis is § 25(1) TDDDG and Art. 6(1)(a) GDPR. You can change or withdraw your choice at any time via “Cookie settings” at the bottom of every page.

Map, location and region

• Map: we plan to serve map views from our own server, built with free software and map data from OpenStreetMap. The map only loads when you open it. When it comes from our server, no data goes to third parties.
• Fallback map via OpenFreeMap: if our own map tiles cannot be reached (at the moment they are not available yet), we offer to load the map from OpenFreeMap instead. This only happens if you tap “Load map from OpenFreeMap” or have allowed “External media” in the cookie settings. Your browser then fetches the map style, tiles and fonts directly from OpenFreeMap (tiles.openfreemap.org, Hyperknot Software Kft., Hungary). OpenFreeMap receives your IP address, details about your browser and device, the map area shown and the address of our page. According to its own information, OpenFreeMap does not store IP addresses in its regular logs, keeps them for up to 30 days in case of incidents or attacks, and may use Cloudflare as a content delivery network. Details are in the OpenFreeMap privacy notice (opens in a new tab). The legal basis is your consent (§ 25(1) TDDDG, Art. 6(1)(a) GDPR), which you can withdraw at any time via “Cookie settings”.
• Google Maps map on business profiles: on a business profile, the map area first shows only a placeholder with the address; your browser loads nothing from Google. Only when you tap “Load map (Google Maps)” or have allowed “External media” in the cookie settings does your browser load the map from Google Maps, a service of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (“Google”). Google then receives your IP address, details about your browser and device, the address of our page and the name and address of the business that we pass on for the map, and may set or read cookies. Google may transfer data to Google LLC in the USA; Google LLC is certified under the EU-US Data Privacy Framework. Details are in Google’s privacy policy (opens in a new tab). The legal basis is your consent (§ 25(1) TDDDG, Art. 6(1)(a) GDPR). The click only applies to the page you opened; you can withdraw the “External media” permission at any time via “Cookie settings”. The “Open in Google Maps” link is an ordinary link to Google.
• “Near me”: only when you tap “Near me” does your browser ask whether it may share your location with us. We round the coordinates to about one kilometre and use them only for this search; we do not store them in our database. Because the rounded coordinates appear in the address of the results page, they appear in the server logs for 7 days. Legal basis: Art. 6(1)(b) and (f) GDPR and § 25(2) no. 2 TDDDG.
• Region from the IP address: our web server determines the federal state or country from your IP address using a local database (IP to City Lite by DB-IP). We use this to show regionally relevant content and ads on pages without their own location and to count reach per region. The IP address is not transmitted to anyone and is not stored additionally for this purpose. Legal basis: Art. 6(1)(f) GDPR; our legitimate interest is regionally relevant information without user profiles.
• Location for search: on pages with a search field, our web server also uses the same local database to determine your approximate location from your IP address (city name and the coordinates of that city). Our application rounds the coordinates to about one kilometre and suggests the nearest city in the “Where?” field; you can change or clear it at any time. Location and coordinates are not stored, not logged and not transmitted to third parties, and no cookie is set for this. Legal basis: Art. 6(1)(f) GDPR; our legitimate interest is convenient search without having to ask for your location.

Third-party content and links

We never load third-party content, such as videos or social media posts, automatically. In its place there is a placeholder with the provider’s name. Only when you tap “Load content” or allow “External media” in the cookie settings does your browser send data such as your IP address to that provider, which may then also set cookies. The legal basis is your consent (§ 25(1) TDDDG, Art. 6(1)(a) GDPR). The placeholder states which provider it is and where to find its privacy information.

Links to other websites, for example to a business’s website or Instagram profile, are ordinary links. You only open the other page when you follow a link; the privacy information of its operator applies there.

User account

For an account we need your name, your email address and a password. With the account you can save listings, set up notifications and, as a business, manage listings.

• Data: name, email address, password (only as an Argon2id hash, never in plain text), language, role, time of confirmation and of the last login, saved listings, notifications and your settings for them.
• Registration and login: we send you a link to confirm your address (valid for 48 hours). If an account already exists for the address, you receive a notice instead. After login our server recognises you by a random session key in the cookie sid; the database only holds a checksum (SHA-256) of it with the times of start, last use and expiry. Password reset links are valid for 60 minutes, login links for 15 minutes.
• Purpose: providing the account and its functions, protection against unauthorised access.
• Legal basis: Art. 6(1)(b) GDPR (contract under our Terms of use); for protection against abuse, Art. 6(1)(f) GDPR.
• Retention: until you delete the account. Sessions end at the latest 30 days after the last use and are then deleted. We delete expired links continuously and used ones after 7 days at the latest. If you delete your account, we block it immediately and delete the data within one month at the latest.
• Two-factor login: editorial and administration accounts additionally sign in with a one-time code from an authenticator app. For this we store an encrypted key, the time of setup and of the last code used, and checksums of the recovery codes. Legal basis: Art. 6(1)(f) GDPR (protecting the administration against unauthorised access) and Art. 32 GDPR. We delete this data when two-factor login is switched off or the account is deleted.
• Self-service: a copy of your data and the deletion of your account are available in the Privacy area of your account.

You may create an account from the age of 16.

Reports of illegal content

You can report content that you consider illegal or not permitted (Report content).

• Data: the reported content and its address, the reason, your explanation, your name and email address, for logged-in users the link to the account, our decision with reasons and the times of the notifications.
• Purpose: handling the report, notifying the reporter and the person concerned, documenting our decisions.
• Legal basis: Art. 6(1)(c) GDPR in conjunction with Articles 16 and 17 of the Digital Services Act (DSA), and Art. 6(1)(f) GDPR (protection of the platform and documentation).
• Recipients: the person whose content is affected learns that and why we have acted. We do not tell them your name or email address unless you agree or we are legally obliged to. We pass information about criminal offences involving a threat to the life or safety of persons to the competent authorities under Article 18 DSA.
• Retention: 3 years after the decision.

Businesses, profiles and advertisers

If you represent a business, take over a listing, manage it or book services, we process the data about you and your business.

• Data: name and contact details of the person acting, role in the business, information for checking the entitlement (for example the verification method chosen, contact address and verification notes), content of the listing (descriptions, opening hours, services, deals, events, photos and videos) and, for booked services, billing and contract data.
• Photos and videos: we re-encode uploaded images and remove all metadata such as camera and location data. Whoever uploads confirms that they hold the necessary rights; we store this with the time.
• Proof: documents you send us for verification are deleted no later than 7 days after our decision. After that only a verification note remains (type, date, person who checked).
• Purpose: taking over, verifying and managing the listing, providing booked services, invoicing.
• Legal basis: Art. 6(1)(b) GDPR (contract under our Business terms), Art. 6(1)(c) GDPR for statutory retention obligations, Art. 6(1)(f) GDPR for checking the entitlement.
• Retention: until the end of the contract; after that we delete content and account data within 30 days. We keep invoices and accounting records for 8 years and business letters for 6 years (§ 147 AO, § 257 HGB).
• Enquiries to your business: if someone sends your business an enquiry through our platform, you are the controller for the data you receive.

Listings from public sources

Many listings did not come to us from the businesses themselves; we compiled them from publicly accessible sources. Where a listing concerns a sole trader or a self-employed person, this is personal data. This section contains the information required by Art. 14 GDPR.

• Data: name of the business, business address (only the town for services that typically do not take place on the business’s own premises), coordinates, business phone number, website, links to public social media profiles, opening hours, category and type of offer, languages of the website. For listings from Google Maps, also Google’s identifier for the place (Place ID), the link to the Google profile and the average star rating and number of reviews there, with the retrieval date. For events: title, date, venue, organiser, ticket link and price.
• Not published: private addresses, email addresses, photos, logos and texts from the website, names of owners (unless they are part of the business name) and information about the origin or nationality of persons. We do not take photos or review texts from Google Maps at all. We only use an email address from the dataset to inform you under Art. 14 GDPR.
• Sources: the open dataset Overture Maps Places of the Overture Maps Foundation (with data from Meta, Microsoft, Foursquare and other suppliers), Google Maps Platform by Google (Places API, queried through the official interface), the business’s own website including its imprint and, for events, the organisers’ websites, official ticket shops and public event calendars. The data was publicly accessible. The source of each listing is shown on the profile; details are under Data sources and licences.
• Website check: our checking program retrieves at most the home page and one imprint or contact page, respects robots.txt and identifies itself by its own name. Only facts are taken over. For the check we keep short excerpts as evidence for as long as the listing exists.
• Purpose: a public directory, free to use, in which interested people find offers with a Brazilian connection.
• Legal basis: Art. 6(1)(f) GDPR. Our legitimate interest, and that of the public, is information about commercial offers. We only show business information that the business has published itself. The exception is the star rating and the number of reviews on Google Maps: these come from Google users, and we only show them in summary form, with the source and the retrieval date. The listing is free of charge; paying businesses receive no hidden advantages, and we label paid placements.
• Recipients: the public (visitors to our pages) and our hosting provider IONOS SE, Elgendorfer Str. 57, 56410 Montabaur.
• Information by letter: we inform the business about the inclusion by letter to its business address, at the latest one month after collection and before publication. We record the dispatch (recipient, date, version of the letter, your response).
• Retention: as long as the directory exists and the information is correct. We check listings at least every 12 months; if a listing cannot be confirmed again, we take it offline. If we learn that a business has closed, we remove the listing within 30 days. We keep the record of the letters sent for 3 years. Results from Google Maps that we do not include are stored only with the place identifier (Place ID), our classification and the reason, so that we do not review them again.
• Your rights: you can object at any time; we then usually remove the listing within 72 hours. The easiest way is Remove a listing. We accept corrections through Report content or by email to info@eloyellow-brasil.de.

Information by email

If a business's website shows an email address and nobody manages the listing through an account, we inform that address once by email about the listing.

• Content: what information we show, where it comes from and why, plus two links: correct the details and have the listing removed. The email contains no advertising, no offers and no tracking pixels. Several listings with the same address are combined in one email; we do not send any further emails of this kind.
• Data: the email address from the website, the listings concerned, the language of the email, time and result of each delivery attempt (sent, failed with the mail server's error message, skipped) and a checksum of the personal link. We also record the dispatch with the listing (recipient, date, version of the text).
• Personal links: anyone who makes a request through the link in the email shows that they received the email at the address on the website. We note this with the request, but only if the listing still shows that address and nobody has started managing it through an account in the meantime. The links are valid for 90 days after sending. A person on our team still decides, as described under Requests to remove or correct a listing.
• Purpose: the information under Art. 14 GDPR and a simple way to correct details or object to the listing.
• Legal basis: Art. 6(1)(f) GDPR. Our legitimate interest is to inform you about the listing simply and verifiably, as Art. 14 GDPR provides.
• Recipients: our team and IONOS SE, Elgendorfer Str. 57, 56410 Montabaur and IONOS SE, Elgendorfer Str. 57, 56410 Montabaur as processors.
• Retention: the record of the dispatch for 3 years after sending, like the record of the letters. If we delete a listing, we also delete the address in this record. The sending log of our email system (recipient, subject, result, no content) is deleted after 90 days.
• Objection: at any time under Art. 21 GDPR, through the link in the email, through Remove or correct a listing or by email to info@eloyellow-brasil.de.

Objection to a listing

If you object through Remove a listing, we process the details from the form.

• Data: link or name and town of the listing, your role (owner, authorised representative, person named in the listing), name, email address, your message, reference number, times, our decision with reasons.
• Procedure: we send you a confirmation link. We only remove a listing automatically if your entitlement is clearly established: the listing comes from a public source, nobody manages it through an account, it has no published reviews, you object on behalf of the business, and your email address belongs to the domain of its website or is contained in the listing, where we checked the website or the address in the last 30 days. Otherwise a person checks whether you are entitled, for example with a call to the business’s public phone number.
• Implementation: if the listing comes from a public source, we hide it and delete its data: name, address, coordinates, contact details, descriptions, services, opening hours and categories. What remains is a record with the source and the identifier under which the source lists the business, for example the identifier in the Overture Maps dataset. Only this way can our import recognise the listing in the next update and not create it again. Listings that a business created itself or manages through an account are hidden; we delete their data under the rules for businesses.
• Block list: so that a removed listing does not come back in another form, we store checksums of individual features: source identifier, phone number, website domain, name with postcode and the approximate location (an area of about 150 by 150 metres). We create the checksums with a secret key that is not stored in the database (HMAC-SHA-256); we do not store the values themselves for this. If only the location matches for a new record, a person checks whether it is the same business.
• Purpose: implementing and documenting your objection, protection against requests from unauthorised persons.
• Legal basis: Art. 6(1)(c) GDPR in conjunction with Articles 12, 17 and 21 GDPR, and Art. 6(1)(f) GDPR (lasting respect for the objection, documentation).
• Retention: unconfirmed requests 30 days, decided requests 3 years after the decision, the record and the block list for as long as we take over data from these sources. If you later want to appear again or take over the listing through an account, we lift the block.
• Recipients: our team for data protection requests, as well as IONOS SE, Elgendorfer Str. 57, 56410 Montabaur and IONOS SE, Elgendorfer Str. 57, 56410 Montabaur as processors.

Requests to remove or correct a listing

Through Ask us to remove or correct a listing you can ask us to remove a listing or to correct information in it. A person checks every request.

• Data: the listing concerned, whether it should be removed or corrected, your relationship to the business (owner, employee, someone else), name, email address, optionally your phone number, your message and your confirmation that the information is true, as well as reference number, times, our decision with reasons, internal notes and our replies. We do not store your IP address for this; to prevent mass requests we only count it briefly as a checksum in working memory.
• Purpose: checking and handling your request, follow-up questions, our reply to you and documenting how we decided.
• Implementation: if we remove a listing, we delete it completely, with all details, photos, services, opening hours and the data from Google. Only a record without contact details remains: name, city and category of the listing, the source with the identifier it uses for the business (for example at Google Maps or Overture Maps), and when, by whom and why we deleted it. With this record and the block list, our import recognises the business and does not create it again in later updates. If a business manages the listing through an account or there are subscriptions, payments or advertising orders for it, we only take it offline, because we have to keep this data for accounting (Section 147 of the German Fiscal Code, Section 257 of the German Commercial Code).
• Legal basis: Art. 6(1)(c) GDPR where you exercise rights under Articles 16, 17 or 21 GDPR, otherwise Art. 6(1)(f) GDPR (our legitimate interest in correct listings, in handling your request and in documentation).
• Recipients: our team, as well as IONOS SE, Elgendorfer Str. 57, 56410 Montabaur and IONOS SE, Elgendorfer Str. 57, 56410 Montabaur as processors.
• Retention: open requests until they are closed, closed requests 3 years after closing, the record of a deleted listing and the block list as for an objection.

Withdrawal and cancellation of contracts

Via withdraw online and Cancel contracts here you can send us a withdrawal or a cancellation without logging in.

• Data: name, email address, business or listing; for a withdrawal the order date and your message, for a cancellation the type of cancellation, the requested date and, for an extraordinary cancellation, the reason; in addition the reference number, date and time of receipt and how we handled it. If your email address matches a subscription, we link the declaration to that subscription.
• Process: you immediately receive a confirmation by email, and our team also receives the declaration by email. If a cancellation clearly matches a running subscription, we set it at Stripe to “ends at the end of the period”. Refunds after a withdrawal are made via Stripe.
• Purpose: processing and documenting your declaration.
• Legal basis: Art. 6(1)(b) and (c) GDPR (Sections 312k, 355 and 356 BGB). To prevent abuse, we briefly count submissions per connection and per email address in working memory, only as a checksum (Art. 6(1)(f) GDPR).
• Retention: 3 years after receipt (documentation, regular limitation period under Section 195 BGB).
• Recipients: our team, Stripe for the cancellation and refund of a subscription as well as IONOS SE, Elgendorfer Str. 57, 56410 Montabaur and IONOS SE, Elgendorfer Str. 57, 56410 Montabaur as processors.

Contact form

You can write to us using the contact form on the home page and under Contact, as a private person or as a business.

• Data: whether you are writing as a private person or as a business, your name, your email address, your message, the language of the page, the form you used (home page or contact page) and the time, as well as how we handled it (done, when and by whom, internal note). We do not store your IP address for this; to prevent mass messages we only count it briefly as a checksum in working memory.
• Process: your message is stored in our admin area, and our team also receives it by email. We reply to the address you give. We do not send an automatic confirmation.
• Purpose: handling and answering your message.
• Legal basis: Art. 6(1)(b) GDPR where your message concerns a contract with us or steps before one (for example a plan for your business), otherwise Art. 6(1)(f) GDPR (our legitimate interest in answering enquiries). Counting against abuse is also based on Art. 6(1)(f) GDPR.
• Recipients: our team, as well as IONOS SE, Elgendorfer Str. 57, 56410 Montabaur and IONOS SE, Elgendorfer Str. 57, 56410 Montabaur as processors.
• Retention: we delete your message 12 months after we have marked it as done, unless we have to keep it longer, for example as business correspondence about a contract (6 years, Section 257 of the German Commercial Code).

Messages and enquiries to businesses

If you send a message to a business through our platform, we forward it. This is only possible for businesses that have taken over their listing and confirmed their receiving address.

• Data: your name, your email address, your message and the time; for wholesale enquiries also the company, phone number (optional), country, quantity and desired date.
• Purpose: forwarding to the business, clarifying questions and investigating abuse.
• Legal basis: Art. 6(1)(b) GDPR (at your request); for the copy we keep, Art. 6(1)(f) GDPR (protection against abuse).
• Recipients: the business you contact. It is itself the controller for further processing.
• Retention: we delete our copy of a message after 30 days, the copy of a wholesale enquiry 12 months after the enquiry.

Emails

• Service emails: we send emails that are necessary for your account, your reviews, reports, objections or booked services, plus a one-time welcome email after you sign up. These emails contain no tracking pixels and no advertising; only the welcome emails for business accounts briefly present our Premium plan. Legal basis: Art. 6(1)(b) and (c) GDPR, for the Premium presentation Art. 6(1)(f) GDPR (our legitimate interest in presenting our own services).
• Newsletter: we only send our newsletter with news, events and deals around Brazilian life in Germany if you have expressly ordered it: with the optional tick box when you sign up or in your account under “Notifications”. You then get an email with a confirmation link that is valid for 72 hours; if you ticked the box when signing up, we send it as soon as you have confirmed your email address. Only clicking this link subscribes you (double opt-in); confirming your account alone does not count as a subscription. We store the email address, language, your home city if you have set one, the version of the consent text and where you saw it (sign-up or account), and the times of request, confirmation and unsubscription. You can unsubscribe at any time with one click through the link in every issue or in your account. Legal basis: your consent (Art. 6(1)(a) GDPR), for the proof Art. 6(1)(c) GDPR. We delete unconfirmed requests after 7 days and the proof of consent 3 years after unsubscription. If you delete your account, we also delete your newsletter subscription.
• When you write to us: we use your details to reply. Legal basis: Art. 6(1)(b) or (f) GDPR. We delete the messages once the matter is closed, unless statutory retention obligations apply (business letters 6 years).
• Delivery: we send emails through IONOS SE, Elgendorfer Str. 57, 56410 Montabaur as processor. If an email cannot be delivered, we store it with the recipient address and content, try to send it up to three more times within about 40 minutes and delete it as soon as it has been delivered. If that fails, our administration sees a notice; we then delete the email once the matter is resolved, after 30 days at the latest. Legal basis: Art. 6(1)(b) and (f) GDPR.

Alerts about new businesses

If you wish, we email you when a new business joins EloYellow Brasil in your city or nearby.

• Data: your email address, the city or postcode you enter with the centre point of that place (not your location), the radius (10, 25 or 50 km), the language of the emails, the version of the consent text, the times of subscription, confirmation and last delivery, and the number of emails sent. If you create the alert in your account, we store the link to the account. We store confirmation and unsubscribe links only as a checksum.
• How it works: after you sign up, we send you a confirmation link that is valid for 72 hours. The alert only becomes active once you click it (double opt-in). If you are logged in and the address of your account is confirmed, the alert to that address applies immediately. We write at most once a week and only when there is something new, with up to ten entries.
• Purpose: to inform you, as requested, about new businesses near you.
• Legal basis: your consent (Art. 6(1)(a) GDPR). You can withdraw it at any time with effect for the future: through the unsubscribe link in every email or in your account under “New near you”. To prevent abuse, we briefly count sign-ups per connection and per email address in memory, only as a checksum (Art. 6(1)(f) GDPR, see server logs).
• Retention: until you unsubscribe; we then delete the details of this alert. We delete unconfirmed sign-ups after 7 days. If you delete your account, we also delete the alerts you created in it; alerts you ordered without an account end through the unsubscribe link.
• Recipients: IONOS SE, Elgendorfer Str. 57, 56410 Montabaur and IONOS SE, Elgendorfer Str. 57, 56410 Montabaur as processors.

Payments

We charge paid services for businesses and the Premium package for consumers through Stripe (Stripe Payments Europe, Limited, Ireland). You enter your payment details directly with Stripe; they do not reach our server. Stripe gives us the payment status, the payment method and information for invoices.

• Data: name and email address of the person booking, the details you give when booking (for example company, billing address and VAT number), the package and payment interval booked, amounts, payment status, payment method, invoices and the customer and subscription IDs at Stripe.
• Customer type: whether you book as a business or as a consumer; for consumers also the time at which you requested the immediate start (evidence under Section 356(4) and Section 357a(2) BGB) and when we sent you the contract confirmation.
• Purpose: processing the payment, billing and invoicing, managing the subscription including renewal and cancellation, and meeting tax and commercial law obligations.
• Legal basis: Art. 6(1)(b) and (c) GDPR.
• Roles: Stripe processes data for us as a processor and partly as an independent controller, for example to prevent fraud and to meet its own legal obligations.
• Third country: Stripe may transfer data to the USA on the basis of the EU-US Data Privacy Framework and standard contractual clauses.
• Retention: invoices and accounting records 8 years.
• Privacy at Stripe: stripe.com/privacy (opens in a new tab)

Recipients and processors

We only pass on data where this is necessary for the purposes described, where there is a legal basis or where you have consented. Service providers that process data on our behalf are bound by contract under Art. 28 GDPR:

• Hosting of the website and database: IONOS SE, Elgendorfer Str. 57, 56410 Montabaur
• Email delivery: IONOS SE, Elgendorfer Str. 57, 56410 Montabaur
• Backups: IONOS SE, Elgendorfer Str. 57, 56410 Montabaur
• Payment processing: Stripe Payments Europe, Limited (Payments)

Beyond that, data is only received by bodies towards which there is a legal obligation, for example tax advisers and tax authorities for invoices, or authorities and courts by order.

Transfers outside the EU

Our servers and our processors process data in the European Union. If you load the fallback map via OpenFreeMap, your IP address may also reach servers outside the EU through the Cloudflare network (map). For payments, Stripe may transfer data to the USA. If you load the Google Maps map on a business profile, Google may transfer data to the USA (map). Where data leaves the EU, we rely on an adequacy decision of the European Commission or on standard contractual clauses.

Retention periods at a glance

Data	Retention
Web server access and error logs	7 days
Application logs (without IP addresses)	at most 14 days
Individual page views with daily checksum	30 days, then only daily figures without personal reference
Searches without results (daily totals without personal reference)	90 days
Daily totals for business statistics	indefinitely, without personal reference
Account	until deletion, then deleted within one month at the latest
Sessions	up to 30 days after the last use
Confirmation, reset and login links	until expiry, used ones up to 7 days
Alerts about new businesses	until unsubscription, unconfirmed sign-ups 7 days
Emails that could not be delivered	until delivery, otherwise at most 30 days
Published reviews	until deletion
Reports and moderation decisions	3 years after the decision
Record of the letters under Art. 14 GDPR	3 years after dispatch
Record of the notice email to businesses	3 years after sending, without the address once the listing is deleted
Objections to listings	unconfirmed 30 days, decided 3 years
Requests to remove or correct a listing	open until closed, closed 3 years
Withdrawals and cancellations via our forms	3 years after receipt
Record of a removed or deleted listing and block list	as long as we take over data from the sources
Messages sent through the contact form	12 months after they were marked as done
Copies of messages to businesses	30 days
Copies of wholesale enquiries	12 months
Documents for checking the entitlement	7 days after the decision
Invoices and accounting records	8 years
Business letters	6 years
Backups	the daily ones of the last 7 days, one each for the last 4 weeks and the last 2 months, together at most about 70 days

Backed-up data disappears when the respective backup expires: whatever we delete in live operation is also gone from all backups after about 70 days at the latest. If we restore a backup, we apply deletions made in the meantime again.

Your rights

You have the right to

• access your data (Art. 15 GDPR),
• rectification of incorrect data (Art. 16 GDPR),
• erasure (Art. 17 GDPR),
• restriction of processing (Art. 18 GDPR),
• data portability (Art. 20 GDPR),
• withdraw consent with effect for the future (Art. 7(3) GDPR).

To exercise them, write to info@eloyellow-brasil.de. We reply without undue delay and within one month at the latest. To protect your data, we ask in case of doubt whether the request really comes from you; for an account, logging in is usually enough.

Right to object

Complaint to a supervisory authority

You can lodge a complaint with a data protection supervisory authority if you believe that we process your data unlawfully (Art. 77 GDPR). The authority responsible for us is: Landesbeauftragte für den Datenschutz und die Informationsfreiheit Baden-Württemberg, Heilbronner Straße 35, 70191 Stuttgart. You can also contact the authority at your place of residence or work.

Obligation to provide data and automated decisions

You are not obliged to give us any data. Without the technically necessary information, however, we cannot deliver our pages, and without the required fields of a form we cannot set up an account or handle a request.

We do not make decisions based solely on automated processing within the meaning of Art. 22 GDPR that produce legal effects concerning you or similarly significantly affect you. Only supporting functions run automatically: the review filter holds back anything conspicuous for a human check, and we implement an objection automatically if the entitlement is clearly established. A rejection is always decided by a person.

Data security

We transmit all pages in encrypted form (HTTPS). We store passwords only as an Argon2id hash, and session keys and confirmation links only as checksums. Backups are kept on our server in Germany; only those who administer the server can access them. Only people who need access to personal data for their tasks have it, and every administrative action is logged.

Changes to this policy

We adapt this policy when our services, the services we use or the legal situation change. The version published here applies; the date is at the top.