Legal Notice

This web site is operated by:

Geofabrik GmbH
Amalienstraße 44
76133 Karlsruhe
Germany

info@geofabrik.de
Telephone: +49 721 180 3560-0
Fax: +49 721 180 3560-9

Managing Directors: Christine Karch & Frederik Ramm
HRB Mannheim 703657
USt-Id DE222535480

Privacy Statement

Contents:

1. Geofabrik Website and Blog
2. Geofabrik Services
3. Geofabrik OpenStreetMap Downloads
4. Contacting Geofabrik
5. Your Rights as a Data Subject
6. Other Online Presences

Geofabrik Website and Blog

If you access our web site (www.geofabrik.de, tools.geofabrik.de) or our blog (blog.geofabrik.de), we will record the following access data and store it for 90 days:

• partial IP address from where the site was accessed. That usually reveals which Internet provider you are using. For IPv4 addresses, we store the first three bytes; for IPv6 addresses, seven bytes. This is not sufficient to identify an individual person.
• time stamp of the access (with second precision)
• URL that was accessed
• referrer, i.e. the web site from which you have followed a link to our site
• user agent, a string added by the web browser or other software used to access the site, and that identifies the name and version of the software. Sometimes this string also contains the operating system or other information deemed useful by the developer of the client software.
• HTTP status code that records if the access was successful.

In recording and processing this data, we are pursuing our legitimate interests as a data controller on the legal basis of Article 6 (1)(f) of the GDPR. We are using the data to detect problems with or misuse of our web pages, and to generate statistics about their use.

After 90 days the data about individual accesses is deleted, and only summaries (which page was accessed how often on which day) are kept for longer.

We don't use cookies and we don't knowingly embed third-party services that do either. However, our "Map Compare" site (tools.geofabrik.de/mc) embeds map tiles from various third party providers (e.g. Google, Bing), and we have no control over the design of their map offerings. If you use the "Map Compare" service, these third-party providers could transmit cookies and/or log your access.

You do not have the right to request erasure of log files created in the pursuit of our legitimate interests, however if you should have reason to believe that your privacy is impacted in any way, please talk to us and we'll endavour to solve the problem above and beyond our legal duties.

Data recorded in this fashion will not be used for other purposes than those described here. In particular, the data will not be used for marketing purposes, and only passed on to third parties where there is a legal requirement to do so.

All servers operated by Geofabrik are located with major hosting providers in the European Union, and only accessible to authorized personnel.

Geofabrik Services

Geofabrik offers a couple of paid services based on OpenStreetMap data:

• tile server (for map tiles)
• geocoding (using e.g. Nominatim, Photon)
• routing (using e.g. OSRM, GraphHopper)
• WMS server (for map images)
• Overpass server (serving OSM data)

If you access these services, or if you access one of our customers' web sites that use these services, the statements above apply accordingly. In these cases, we use the web server log files within our legitimate interests for the following purposes:

• matching of accesses to customers using the access key, for billing purposes
• investigation of abuse or unauthorized use of our customers' API keys, where we reserve the right to share any insights gained on cases of abuse with the respective customer
• counting of requests in order to match server resources with demand
• statistics about the popularity of map styles and regions in order to improve our product offerings

Geofabrik OpenStreetMap Downloads

If you access data on our download server (download.geofabrik.de), the statements above (under "Geofabrik Web Site and Blog") apply accordingly.

A portion of our download offer (from osm-internal.download.geofabrik.de) is only available for registered OpenStreetMap users. If you access data on this server, we additionally log the fact that the download happened with an OpenStreetMap authentication, but not the identity used. The OpenStreetMap login also creates a cookie in your browser that contains the following information:

• OAuth access token
• OAuth access token secret
• time when you will next have to prove that your OpenStreetMap account is still valid
• selector for the cryptographic key used for signing the cookie contents
• login status (logged in, or logged out)

Cookies are only saved in your browser, and not on our servers.

If you use the internal download service we have to redirect you to the OpenStreetMap web site for the OAuth process. The operator of openstreetmap.org (the OpenStreetMap Foundation) can therefore see from their log files that you are using Geofabrik's internal download service. You can read all about data collected and processed by the OpenStreetMap Foundation in their privacy policy. The registered address of the OpenStreetMap Foundation is: St John's Innovation Centre, Cowley Road, Cambridge CB4 0WS, United Kingdom.

If you contribute data to OpenStreetMap, this will not only add geodata, but also record your user account and a changeset id in OpenStreetMap. This information can potentially be used to deduce activities of an individual person. This information is not available publicly from the Geofabrik server. The internal server that is only accessible for authenticated OpenStreetMap users carries this information because it is necessary to pursue legitimate OpenStreetMap interests, especially quality assurance and the protection against vandalism. More about this data, and your rights to information and deletion, can be found in the OSMF privacy policy.

Making Contact

If you communicate with us by email, we will store any messages sent to us, including your name and email address, to comply with legal retention rules (from German law, § 257 HGB, § 147 par. 1 no. 2 and 3 AO).

We will only ever use this information to communicate with you in the matter at hand. Specifically, we will not use the data for marketing purposes, and pass it on to third parties only when required by law.

Your Rights as a Data Subject

As mandated by Article 13 GDPR, here is a list of your rights concerning our recording and processing of data:

• Article 15 GDPR gives you the right to obtain from us confirmation as to whether or not personal data concerning you is being processed, and, where that is the case, access to the personal data and further information about the processing.
• Article 16 GDPR gives you the right to request the rectification of inaccurate personal data concerning you, and the right to have incomplete personal data completed.
• Articles 17, 18 GDPR give you a conditional right to have your personal data erased, or to have its processing restricted.
• Article 20 GDPR gives you the right to data portability, i.e. you may request a copy of your personal data in a common, machine-readable format.
• Article 21 GDPR gives you the right to object to the processing of your personal data according to Article 6(1)(f).
• Article 77 GDPR gives you the right to lodge a complaint with a supervisory authority. The authority responsible in this case is: Der Landesbeauftragte für Datenschutz und Informationsfreiheit Baden-Württemberg (LfDI BW), Königstrasse 10a, 70173 Stuttgart, Telephone: (0711) 615541-0, email: poststelle@lfdi.bwl.de

Other Online Presences

In addition to our own web servers, we have accounts or profiles on a number of social media like Facebook, Twitter, or GitHub. If you use these platforms, you do so subject to the terms of use and privacy policies of the respective operators. We have no control over the processing of data collected in the course of such use of third-party platforms.