Privacy / Datenschutz

Controller

Dr. Thomas Prüm
c/o POSTFLEX PFX-658-034
Emsdettener Straße 10
48268 Greven
Germany
admin@railreg.de

No data protection officer has been appointed; the statutory thresholds of § 38 BDSG are not met.

The short version

This site and the app are a personal collection of notes. This is a private, non-commercial website: it offers no goods or services, carries no advertising and generates no income. There are no user accounts, no registration, no newsletter, no cookies, no analytics, no tracking pixels, no advertising and no third-party content loaded from other servers. The site uses the fonts already installed on your device; no web fonts are downloaded. What remains is what any web server records in order to deliver a page, and a copy of the content held locally on your own device so that it can be read offline.

Website

Server log files. Each time a page is retrieved, the hosting provider’s web server records the retrieving IP address, the date and time of the request, the resource requested, the HTTP status code, the volume of data transferred, the referring URL where one is transmitted, and the browser and operating system identification. This is technically necessary in order to deliver the page and to maintain the security and stability of the server.

Legal basis: Article 6(1)(f) GDPR. The legitimate interest lies in the operation, security and troubleshooting of the site. The data are not merged with other sources and are not used to identify individual visitors.

Hosting. The site is hosted by IONOS SE, Elgendorfer Str. 57, 56410 Montabaur, Germany (Amtsgericht Montabaur, HRB 24498). IONOS processes the data described above on the controller’s behalf on the basis of a data processing agreement pursuant to Article 28 GDPR. The servers are located in the European Union.

In the log files that IONOS makes available to the controller, IP addresses are shortened; they are retained for a maximum of eight weeks and are then deleted. Any further processing of connection data by IONOS for the security and operation of its own infrastructure takes place on IONOS’s own responsibility and is described in its privacy information.

Fonts. No web fonts are loaded. Text is displayed in typefaces already present on your device; no connection to Google Fonts or to any other external font service is established.

Cookies, offline copy and local storage. The site sets no cookies and writes nothing to local or session storage. To make the notes readable without a connection, the site registers a service worker: your browser keeps a copy of pages, the stylesheet and images you have visited in its own cache on your device. This copy is used only to display the site; it is not transmitted to the controller or to anyone else and can be removed at any time by clearing the site data in your browser. Storing it is strictly necessary to provide the offline function you use (§ 25(2) no. 2 TDDDG); no personal data are processed in the process. A web app manifest is provided so that the site can be added to a home screen; this involves no processing of personal data either.

Calendar. The events listed on the site are maintained in a public Google calendar. The list on the page is generated in advance on the controller’s side and served from this server; viewing the events page does not establish a connection to Google. Only if you choose to follow the link to add the calendar to Google Calendar or to subscribe to the iCal feed is a connection to Google established; Google then processes your data on its own responsibility (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland).

Outbound links. Pages link to legislative sources, authorities, operators and third-party publications. Following such a link takes you to a site whose operator alone is responsible for its data processing.

The rail.reg app

What the app retrieves. On launch, and periodically in the background, the app and its home-screen widget download files from this server — content.json, events.json and widget.json. These contain the same notes and events that appear on the website. The request reaches the web server described above and is recorded in its log files in the same way as a page retrieval, including the IP address of the device.

What stays on the device. The downloaded content is stored on the device so that the notes remain readable offline, together with the version identifier of the content last seen and any notes you mark as favourites. All of this is removed when the app is deleted. None of it is transmitted anywhere.

What the app does not do. It has no accounts and no login. It contains no analytics, no crash reporting and no advertising framework. It requests no access to contacts, location, camera, microphone, photos or calendar. It creates no user profile and takes no automated decisions. In Apple’s App Privacy terminology the app is declared as Data Not Collected.

Notifications. If you permit notifications, the app compares the published content with the version last seen and posts a local notification when something new has been added. This happens entirely on the device. There is no push server, no device token is generated or transmitted, and no third party is involved. Permission can be withdrawn at any time in the iOS settings.

App Store. Downloading and updating the app takes place through Apple’s App Store. Apple processes the data associated with that on its own responsibility; the controller receives only aggregated, anonymous statistics and no information identifying individual users. See Apple’s privacy policy for details.

Contact by email

If you write to the address given above, your message and the data it contains — your email address, and whatever you choose to include — are processed in order to deal with your enquiry. Legal basis: Article 6(1)(f) GDPR; the legitimate interest lies in answering your message. Messages are deleted once the matter is concluded and no retention obligation applies. Writing to this address does not establish a client relationship, and no professional or commercial services are offered here.

Ordinary email is not an encrypted medium. Please do not send confidential material without prior agreement on a suitable channel.

Your rights

You have the right to obtain information about the personal data concerning you (Article 15 GDPR), to have inaccurate data rectified (Article 16), to have data erased (Article 17), to obtain restriction of processing (Article 18), to data portability (Article 20) and to object to processing based on Article 6(1)(f) GDPR (Article 21). To exercise any of these, write to the address above.

You also have the right to lodge a complaint with a supervisory authority (Article 77 GDPR). The competent authority for the controller is the Bayerisches Landesamt für Datenschutzaufsicht (BayLDA), Promenade 18, 91522 Ansbach, Germany.

There is no statutory or contractual obligation to provide personal data. Neither the website nor the app takes automated decisions within the meaning of Article 22 GDPR, and neither profiles its users.

Changes

This notice will be amended where the site or the app changes in a way that affects the processing described. The version in force is the one published here.

Last reviewed: 25 October 2026. See also Imprint and Disclaimer.