Privacy policy

In short: we do not ask for registration, set no tracking cookies, embed no third-party services and do not store the names of Secret Santa participants.

Controller

Niels Hegmans, Johannes-Dech-Str. 49, 50737 Köln, Germany. Contact: see legal notice.

Hosting and server logs

The website runs at Hetzner Online GmbH in Germany (data processing agreement, no transfer to third countries). The web server writes no access log. To protect against attacks, requests to typical attack paths are logged briefly with a shortened IP address and deleted after 14 days. To limit abuse we briefly count requests per shortened identifier that cannot be reversed, in memory only; the IP address is not stored.

Self-hosted, no third parties

Fonts, scripts and images come from this website. There are no requests to third-party services, no embedded content and no cookies, so no cookie banner is needed.

Audience measurement (Matomo)

To improve this website we run the open-source software Matomo on our own server in Germany (matomo.heimseiten.com, also at Hetzner Online GmbH), so no third party is involved. Matomo sets no cookies, truncates your IP address before storing it and does not measure if your browser sends “Do Not Track”; measurement starts only a few seconds after a page has been opened. It records the page without the part after the hash sign, the referring page, the time spent, approximate region, device type, operating system, browser and language, and clicks on external links, never names, wishes or assignments. We do not measure the personal slip pages at all. The data is not shared with third parties. The legal basis is Art. 6(1)(f) GDPR.

Secret Santa draw

Your browser works out the draw. Names, budget, date and matches exist only in the links (after the hash sign) and in the list your browser stores locally. That part of an address is not sent to our server.

On the server we store per round random IDs, whether a slip was opened, and encrypted wish lists. We never hold the key. Everything is deleted 90 days after creation (later if the party date is later, at most after 365 days). Legal basis: Art. 6(1)(b) and (f) GDPR.

Local storage in your browser

We use your browser's local storage to remember your color scheme and your running Secret Santa rounds. This data does not leave your device. You can delete it in your browser settings or with the buttons on the page.

Your rights

You have the right to access, rectification, erasure, restriction of processing, data portability and objection. Because we do not store names or addresses linked to persons, we often cannot attribute data to a person. Complaints can be sent to a data protection authority; in North Rhine-Westphalia this is the state commissioner for data protection and freedom of information (LDI NRW).