Privacy Policy

As of: October 2026

1. Controller

Sophie Simon, Scoottec
c/o COCENTER, Koppoldstr. 1, 86551 Aichach, Germany
Email: hallo@scoottec.de

2. Hosting, email and server log files

This website, the database of the scooter register and my mailboxes are hosted by STRATO GmbH, Otto-Ostrowski-Straße 7, 10249 Berlin, Germany. When you visit the pages, the host processes technically necessary data (IP address, date and time, page requested, amount of data transferred, browser type and operating system) in server log files in order to provide the website securely and reliably. The legal basis is my legitimate interest in secure operation (Art. 6(1)(f) GDPR). IP addresses are shortened; the log files are kept for no more than six weeks and then deleted automatically. A data processing agreement under Art. 28 GDPR is in place with STRATO.

3. Cloudflare

Requests to scoottec.de pass through the network of Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107, USA (for customers in the EU: Cloudflare Germany GmbH). Cloudflare establishes the encrypted connection (SSL), forwards requests to my server and protects the website against attacks. In doing so, Cloudflare processes the technically necessary connection data (in particular IP address, requested address, time, browser identifier). The legal basis is my legitimate interest in a secure and available website (Art. 6(1)(f) GDPR). A data processing agreement is in place with Cloudflare. Cloudflare is certified under the EU-US Data Privacy Framework; transfers to the USA are therefore covered by the European Commission’s adequacy decision (Art. 45 GDPR). I do not receive any personal analytics from Cloudflare.

4. No tracking

The shop pages only set a cookie when you choose a language or open the English pages: “lang” remembers for one year whether you want to see the site in German or English (technically necessary for the function you requested, § 25(2) no. 2 TDDDG). The scooter register also uses technically necessary cookies (see section 10). The website does not use any analytics, advertising or social media services. Fonts and all other content are loaded from this server.

5. Contact by email

If you send me an email, I process your details to answer your enquiry and, where applicable, to perform a contract (Art. 6(1)(b) GDPR).

6. Enquiry form and lettering configurator

If you use the enquiry form (e.g. for spare parts, special colours or questions), your details (name, email address, optionally phone number and delivery address, details of your scooter and part, message, design code and attached photos) are stored on my server at STRATO and sent to me by email. I use them to handle your enquiry, prepare a quote and carry out the order (Art. 6(1)(b) GDPR). Enquiries that do not lead to an order are deleted no later than two years after the last message (see section 11).

Photos you select in the form are reduced in size in your browser before they are sent. Designing in the configurator happens entirely in your browser; your design is only transferred when you order or send an enquiry.

7. Orders

If you order via the “Review order” page, I store your order on my server at STRATO: name, email address, optionally company and phone number, billing and delivery address, delivery country, message, design code, selected products, price, any discount code redeemed, the language of your order (German or English, for the emails to you), as well as the date and order history. I use the data to check your order, issue the invoice, manufacture and deliver (Art. 6(1)(b) GDPR). You receive automatic emails (acknowledgement of receipt, order confirmation with invoice, and payment and shipping information where applicable), which are sent from my mailbox at STRATO. Orders you place via Etsy, by email or by phone are recorded in the same way in order to issue the invoice and carry out the order; for Etsy orders I only store the details Etsy passes on to me for delivery.

For backup purposes I regularly create a copy of this data and of the scooter register, which I send to myself encrypted by email and keep separately (Art. 6(1)(c) and (f) GDPR – retention obligations and protection against data loss). It is deleted once the retention periods have expired.

8. Discount codes

If you redeem a discount code, I store with the code which order used it, when and for what amount, in order to check validity and the number of redemptions (Art. 6(1)(b) GDPR). Personal thank-you codes from the scooter register are marked as redeemed (see section 10).

9. Disclosure to third parties

For shipping, I pass your name and delivery address on to the shipping company (Deutsche Post/DHL) to the extent necessary for delivery (Art. 6(1)(b) GDPR). No further disclosure takes place.

10. Scooter register / Rollerpass (scoottec.de/roller/)

Account and login. For an account I store your email address, your password (only as an irreversible, encrypted hash – I cannot read it), your display name, optionally country and postcode, the time you agreed to the terms of use, the time your email address was confirmed, your language (German or English, for the site and emails) and the time the account was created and last logged in. To confirm your address and reset your password, I send you one-time links by email. The legal basis is the performance of the user agreement (Art. 6(1)(b) GDPR). Your email address is never shown publicly.

Cookies. The scooter register sets technically necessary cookies: “rp_s” keeps you logged in for up to 90 days, “rp_c” protects forms against misuse (deleted when you close the browser), “lang” remembers your language. No consent is required for this (§ 25(2) no. 2 TDDDG). To remember rides you have skipped, the site also uses your browser’s local storage; this information does not leave your device. So that the scooter register works as an app and shows a notice page instead of an error message during short server outages, a so-called service worker stores a small notice page on your device. No cookie banner is needed, because no cookies or storage are used for statistics, advertising or third parties.

Push notifications. Only if you switch them on in your account and your browser or phone asks and you agree (Art. 6(1)(a) GDPR) do I store the subscription address generated by the browser for your device. Notifications are delivered via the push service of your browser or device manufacturer (e.g. Google, Apple, Mozilla); no content is transmitted – your device then loads the text directly from this server. You can switch them off at any time in your account or in your device settings.

Public content. What you enter about your scooters and rides (photos, details, story, display name, location, Instagram name) is visible to all visitors. Of your postcode, only the town is shown publicly; I calculate distances on my server using a postcode table (GeoNames, CC BY 4.0). If a postcode is missing from this table, my server asks the Nominatim service of the OpenStreetMap Foundation (St John’s Innovation Centre, Cowley Road, Cambridge, CB4 0WS, United Kingdom) once for the town. Only country and postcode are transmitted – no IP address, no name and no other details of yours; I store the result for all further requests. Uploaded photos are resized and saved anew on the server; all embedded metadata, including GPS location data, is removed in the process.

Location in the browser. If you tap “Use my location”, your browser asks for permission. The location is rounded to about one kilometre, transmitted only for this search and not stored.

Messages and price offers. I forward messages to other users by email; your email address is shown to the recipient as the reply address. I do not store the content, only sender, recipient scooter, time and, where applicable, the amount of the price offer, in order to prevent misuse.

Rides and reminders. If you join a ride, others see your display name in the list of participants and the organiser is notified. If you switch on reminders for “rides near me” or “scooters for sale near me” in your account, I compare the postcode of new rides or sale listings with your postcode and the chosen radius and notify you by email and via the bell in your account (Art. 6(1)(a) GDPR, consent). You can switch this off at any time in your account or via the unsubscribe link in every email. Notifications in your account are deleted after 180 days.

Reviews. After an order I may send you a personal review link by email; for this I use the email address from your order (Art. 6(1)(f) GDPR, legitimate interest in customer feedback; you can object at any time). If you leave a review, I store the stars, text, first name and initial of your surname, date and your email address. Only stars, text, first name with initial and date are published – only after I have checked them and with your consent (Art. 6(1)(a) GDPR). You can request deletion of your review by email at any time. Reviews are loaded on the shop pages directly from this server, without third parties.

Scooter tag. If you design a scooter tag in the Rollerpass, I add your scooter’s number and scooter code to the design code of your order so that the NFC chip points to the right scooter pass. Whether a scooter tag has been ordered for a scooter follows from the order and is shown to me in the admin area with your account – also to grant the founder discount only once (Art. 6(1)(b) GDPR).

Offers by email. Only if you tick “Offers from Scoottec by email” when registering or in your account do I occasionally send you emails about Scoottec products and promotions, e.g. about the scooter tag (Art. 6(1)(a) GDPR, consent; § 7(2) UWG). For this I store your consent with its time and which offer I sent you when. You can withdraw your consent at any time in your account or via the unsubscribe link in each of these emails. Without consent, notices about offers only appear in your account (bell), not by email or push.

Discount codes as a thank-you. If I am currently offering a thank-you for an action (e.g. registering, adding a scooter, leaving a review), I send you the discount code by email and store your email address, your account if applicable, the action, the code, the time and whether it was redeemed (Art. 6(1)(b) GDPR). This allows me to check the code when you order and prevent it from being issued more than once. I delete this data no later than three years after the end of the year in which the code was issued; the link to your account is removed immediately when the account is deleted.

Links to partner shops. For some mods, the shop mentioned is linked as an “Ad”. Only when you click it do you leave the scooter register; the shop then receives the usual connection data and – for partner or affiliate links – the information that you came from Scoottec. The respective shop is responsible for data processing there.

Reports and abuse protection. I store reports about content with the reason, text and – if provided – your email address in order to handle them. To protect against spam, I store an irreversibly encrypted value of your IP address together with the number of requests for no more than three days (Art. 6(1)(f) GDPR). If something goes wrong (e.g. a form doesn’t get through because the server is overloaded), I store the time, the address requested, the error code and the browser identifier for no more than 30 days – without IP address and without form contents – in order to find and fix faults (Art. 6(1)(f) GDPR).

Retention. Your data remains stored until you delete an entry or your account; you can do this yourself at any time in “My account”, which removes scooters, photos and rides immediately. Accounts with an unconfirmed email address in which nothing has been entered are deleted after 30 days, unused login links after one day. I keep a log of the emails sent (recipient, subject, time) for 30 days in order to be able to resolve delivery problems (Art. 6(1)(f) GDPR).

11. Retention periods

• Enquiries without an order: deleted no later than two years after the last message.
• Orders, invoices and related emails: as long as required by tax and commercial retention obligations (§ 147 AO, § 257 HGB), at most ten years after the end of the year of the order.
• Scooter register: as described in section 10.

12. Your rights

You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and to object to processing based on legitimate interests (Art. 21). You can withdraw any consent you have given at any time with effect for the future (Art. 7(3)). A short email to hallo@scoottec.de is enough.

You also have the right to lodge a complaint with a data protection supervisory authority. The authority responsible for me is the Bavarian State Office for Data Protection Supervision (BayLDA), Promenade 18, 91522 Ansbach, Germany.