Last updated: July 2026. This policy describes which data this specific website actually processes. It does not replace a legal review. We recommend having it reviewed regularly by a qualified lawyer or data protection professional.
1. Controller
Andre Wienholz von Herslo Weg 17 22457 Hamburg Germany Email: support@link-drin.de
2. Overview of processing activities
We process personal data only to the extent necessary to operate this web directory: to provide the website, manage user accounts and listings, moderate reviews and send emails that directly result from your use of the service, such as registration confirmations or listing-status notifications. We do not use a web analytics or tracking tool such as Google Analytics and we do not use social login.
For optional online payments, we use Stripe Checkout. A connection to Stripe is established only after you deliberately start the payment process.
3. Provision of the website and server log files
When you access this website, our hosting provider automatically collects technical information in server log files, including the IP address, date and time of access, requested page, browser type and referring URL. This processing is used to ensure technical stability and security, for example to detect attacks, and is based on our legitimate interests pursuant to Art. 6(1)(f) GDPR. Log files are deleted or anonymised after no more than 30 days.
This website is hosted by ALL-INKL.COM – Neue Medien Münnich, Hauptstraße 68, 02742 Friedersdorf, Germany. A data-processing agreement is in place with the hosting provider.
4. Cookies
We use only technically necessary cookies and no tracking, marketing or analytics cookies.
Session cookie: This cookie maintains your login to a business/member or administrator account while the browser session remains active or until you sign out. Protection against form manipulation (CSRF protection) is handled within the session and does not require an additional cookie.
Login cookie (“Remember me”): If you enable “Remember me” when signing in, we additionally set a persistent cookie named linkdrin_remember. It can automatically sign you in on a later visit even after the original session has expired. It does not contain a readable username or password. It contains only a random access token whose verification value is stored by us and renewed as required. The cookie is valid for a maximum of 30 days or until you manually sign out or revoke it through your account.
Both cookies are protected with HttpOnly, Secure and SameSite=Lax attributes. They are required for operation of the website or for the convenience feature you have chosen and therefore do not require separate consent. The cookies are used exclusively for authentication and not for tracking, marketing or analytics.
5. Registration and user account
When you create a business/member account, we process the information you provide, such as your name or company name, email address and password stored as a non-reversible hash, to provide and manage your account pursuant to Art. 6(1)(b) GDPR.
You can permanently delete your member account yourself in the member area under “My account”. This removes the account, your own listings including associated uploads, and account-related convenience and extension data. Where individual billing or evidence records must continue to be retained, they are stored separately from the active member account and from deleted listings.
6. Listings in the directory
When you submit a listing, we process the information you provide, such as name/company, category, description, location, address, telephone number, email address, website and logo, for the purpose of publishing the listing in the directory after our review pursuant to Art. 6(1)(b) GDPR. Once a listing has been approved, this information is publicly visible on the website. Therefore, only provide information that you want to be made public.
For approved listings, we also collect anonymous statistical data: a timestamp when the listing page is viewed and a timestamp when “Visit website” is clicked, with identical actions deduplicated once per session. We do not store IP addresses, referrer addresses or visitor profiles for these statistics. Views and clicks by the signed-in listing owner and by directory administrators are deliberately excluded. Listing owners see only aggregated statistics for their own approved listing, for example views and clicks for a selected period, and never individual visitor records. The underlying raw timestamp data is stored for technical reasons for approximately 400 days and then automatically deleted. This analysis is intended solely to provide listing owners with simple internal performance information and is not an external analytics or marketing tool. The legal basis is Art. 6(1)(f) GDPR, our legitimate interest in providing a privacy-conscious assessment of listing performance.
Owners of a listing with active Premium Plus may voluntarily add links to their public social-media profiles, for example Instagram, Facebook, YouTube, TikTok, LinkedIn, Pinterest or X. We store the selected platform and the submitted profile URL pursuant to Art. 6(1)(b) GDPR. These links are displayed only while Premium Plus is active for the listing. We do not embed social-media feeds, tracking pixels or other third-party scripts from those platforms. When a visitor clicks such a link, the request is first handled by an internal redirect endpoint and then forwarded in a new tab to the selected platform. From that point onward, the privacy policy of the respective provider applies. If Premium Plus expires or the plan changes, stored links remain internally available but are no longer displayed publicly. The listing owner can permanently delete them through the account at any time.
Owners of a listing with active Premium Plus may also voluntarily upload up to five of their own images for a gallery on the listing detail page pursuant to Art. 6(1)(b) GDPR. Each uploaded image is technically checked, resized to a suitable display format and completely regenerated. This process automatically removes embedded metadata such as camera details, GPS location information or comments. We store the generated image files and technical information including file size, dimensions, file type and approval status. A newly uploaded image becomes public only after we have manually reviewed and approved it. If Premium Plus expires or the plan changes, already uploaded images remain stored internally but are no longer displayed publicly. The listing owner can permanently delete uploaded images through the account at any time.
With an active Premium Plus plan, the listing owner may also voluntarily submit an extended business profile. This can include structured information about services, special features, regions served, languages, payment methods, accessibility, parking and service options, as well as up to three action buttons, one additional external booking, shop or offer link and a temporary business notice. We store only the information submitted by the operator and display it publicly only after manual review and approval pursuant to Art. 6(1)(b) GDPR. While an updated version is being reviewed, a previously approved version remains visible unchanged. The information is shown publicly only while Premium Plus is active. After expiration or a plan change, the information remains stored internally but is no longer displayed and can be completely deleted by the listing owner at any time. If the “Plan route” action is selected, the visitor is forwarded to Google Maps only after deliberately clicking the action. The publicly provided address or location is then passed to Google Maps. From that point onward, Google's privacy provisions apply. No Google map or Google script is automatically loaded by Link-Drin as a result.
For aggregated performance information relating to a Premium Plus listing, we also anonymously count whether visitors click an approved action button or the additional external link, open a social-media link, or open an approved gallery image in the large view. We store only the time, listing number, type of interaction and the technically required identifier for the selected action, platform or image number. No IP address, referrer or visitor profile is stored. Repeated identical interactions within the same session are not counted more than once, and actions by the signed-in listing owner or administrators are excluded. Listing owners see only aggregated totals for selected periods. Individual interaction records are automatically deleted after approximately 400 days, just like the other listing statistics. The legal basis is Art. 6(1)(f) GDPR, our legitimate interest in a data-minimising assessment of performance without external tracking.
7. Online payment with Stripe Checkout
If you voluntarily pay for a Premium plan online, you are redirected to a payment page hosted by Stripe. Stripe processes the payment and billing information that you enter there. Link-Drin does not receive or store complete card or bank-account details.
We store only the information required to assign and document the payment, such as the listing, plan, amount, currency, payment status, Stripe session or payment identifier and relevant timestamps.
For the subsequent invoice, Stripe Checkout also requests the billing name, complete billing address and a billing email address. A company name and tax ID may be provided voluntarily. After payment has been confirmed, Link-Drin stores this information together with a technical Stripe customer identifier as an immutable invoice snapshot. The information is processed for contract performance, invoice creation, documentation and compliance with commercial and tax-law obligations pursuant to Art. 6(1)(b) and (c) GDPR. It is not used for advertising or to create a payment profile.
Stripe communicates the payment status to Link-Drin through a signed webhook. Only this server-side verified message is treated as payment confirmation. A simple redirect back to our website is not sufficient. Further information about Stripe's processing of personal data is available in Stripe's privacy information. Online payments are one-time payments. No subscription is created and no automatic renewal is triggered.
8. Recommend a website
You can use the “Recommend a website” form to suggest a website without creating a user account. We process the website address you enter, the normalised domain determined from it on the server, an optional category, an optional reason for the recommendation, and the time at which the suggestion was received. We use this information exclusively to review the suggestion and decide whether the website may be suitable for inclusion in the directory pursuant to Art. 6(1)(f) GDPR, our legitimate interest in maintaining a useful, spam-free directory.
A suggestion is never published automatically and is always reviewed manually. When the public form is submitted, we do not automatically retrieve content, preview images or other metadata from the suggested website.
During the later manual review, however, an administrator can deliberately and separately trigger retrieval of publicly available website information to assist with the review and a possible transfer into a directory listing pursuant to Art. 6(1)(f) GDPR. Information retrieved for this purpose may include page titles, description text, location information, image candidates, the website icon (favicon) and publicly embedded structured data. This information is stored together with the suggestion but is not published automatically and serves only as an aid for the subsequent manual review. We notify our administration internally by email when a new suggestion is received.
To protect against abusive repeated submissions, we use the same IP-based rate-limiting mechanism that is used elsewhere on the website. The IP address processed for this purpose is not stored together with the suggestion itself. It is processed separately in the existing rate-limiting mechanism and is subject to the same automatic deletion after 30 days described under the retention section below.
9. Reviews
When you submit a review, we process the name provided, the rating and the comment for display after editorial review pursuant to Art. 6(1)(f) GDPR, our legitimate interest in maintaining a spam-free directory. The IP address may be processed temporarily for abuse prevention.
10. Email communication
We send emails only when they are directly related to your use of the service, for example registration confirmation, listing-status notifications, notifications about new reviews of your listing or password-reset messages pursuant to Art. 6(1)(b) GDPR. We do not send a newsletter or advertising emails.
11. Contacting us
If you contact us by email, for example at support@link-drin.de, we process the information you provide in order to handle and respond to your request pursuant to Art. 6(1)(b) or (f) GDPR.
12. Online licence verification of the software
Where this installation uses a Link-Drin Studio licence that can be verified online, the software may send an encrypted HTTPS request at defined intervals to the licence service provided by the software manufacturer. Only technical licence and installation data required for activation, entitlement verification, abuse prevention and update entitlement is transmitted, such as the domain, installation ID, client public key, product version, build and schema version, and licence and revision identifiers. Directory content, passwords, payment data and private keys are not transmitted.
Whether a manufacturer licence service is used and which service is involved depends on the locally installed licence and configuration. Before production use, the operator of the website must ensure that the actual manufacturer or recipient, legal basis, processing or contractual relationship and relevant retention period are correctly reflected in this Privacy Policy.
13. Retention periods
We store personal data only for as long as necessary for the purposes described above or for as long as statutory retention obligations apply. Submitted listings and reviews are stored for as long as they are required for the directory or until deletion is requested, subject to any overriding retention obligations.
Website recommendations described in section 8 follow a multi-stage process. New recommendations and those still under review are stored until the review is completed. If a recommendation is rejected, identified as a duplicate or otherwise closed, it is first archived internally and is then visible only in a separate administrative view. An archived recommendation is automatically and permanently deleted 180 days after its processing has been completed. An administrator may permanently delete an archived recommendation earlier. Permanent deletion also removes internal notes and any website data retrieved during the manual review. After permanent deletion, the same website address can be recommended again. If a recommendation is accepted and converted into a directory listing, the original recommendation may remain stored to the extent required for administration and traceability of the resulting listing.
Payment, booking and invoice data, including the billing address confirmed through Stripe, is retained for as long as necessary for contract performance, possible refunds or chargebacks and compliance with statutory commercial and tax retention requirements. Invoices and cancellation documents therefore remain unchanged even if listing or account information is changed later. Technical webhook records do not contain a complete payment record; they contain only the event information required for secure, one-time processing and traceability.
Additional fixed automatic deletion periods apply to technical logs and security data. Failed login attempts and IP-based form-attempt counters, including those used by the “Recommend a website” form, are deleted after 30 days. Password-reset links are deleted after no more than 7 days or immediately after use. Reviews that have not been confirmed by email are deleted after 96 hours. Individual view, click, visitor-statistics and Premium Plus interaction records are deleted after approximately 400 days. These periods are enforced by an automated daily cleanup process.
14. Your rights
Under the GDPR, you have the right of access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and the right to object to processing (Art. 21). You also have the right to lodge a complaint with a competent data protection supervisory authority. To exercise your rights, use the contact details provided in the Legal notice.
15. Favourites and personal saved list
When this feature is enabled, signed-in users can save listings and events as private favourites pursuant to Art. 6(1)(b) GDPR, because the personal saved list is provided as part of the user account. A favourite is associated only with the respective user account and is used only to display that user's personal saved list in the account area.
Favourites are never publicly visible to other visitors or users. There is no public list of favourites and no public favourite count. You can remove your own saved favourites at any time. If your user account or the relevant listing is permanently deleted, the associated favourites are also automatically deleted. If an administrator disables the feature, existing favourites remain stored and become available again when the feature is re-enabled. Disabling the feature does not delete existing favourite data.