Privacy Policy
D2D-Gebietsplaner – a service of Bonus Service BS GmbH
Version 1.1, as of 3 September 2026
The German version is authoritative. This translation is provided for convenience only. In case of discrepancies, the German text at
/de/legal/privacy-policyprevails.
1. Controller
Bonus Service BS GmbH Dorotheenstr. 5, 45130 Essen, Germany Managing Director: Uwe Cronenbroeck Phone: +49 201 89083160 E-mail: info@bonuski.de
2. Two separate roles
This policy covers two different kinds of processing:
- As controller we process your user account data, the server logs and your enquiries via the contact form.
- As processor we handle the data you enter into the service — in particular names of assigned staff. The data processing agreement applies, concluded automatically with the usage contract. You as controller determine the legal basis; Art. 28 GDPR is not itself a legal basis.
3. Server logs
When the site is accessed, information transmitted by your browser is logged: browser type and version, operating system, referrer URL, host name, time of the request and IP address.
Legal basis: Art. 6 (1) (f) GDPR. Legitimate interest: technically error-free operation and defence against attacks.
Retention: logs are overwritten on a rolling basis once 30 MB per service is reached. There is no fixed period technically; in practice it amounts to a few weeks. The data is neither combined with other sources nor analysed.
4. Cookies
We use strictly necessary cookies only, in particular to keep you signed in. These require no consent (§ 25 (2) no. 2 TDDDG). We use no tracking or marketing cookies and no analytics tools. The sign-in cookie is valid for 30 days.
5. Encryption
The application is accessible exclusively via a TLS-encrypted connection.
6. User account and sign-in
A user account is required. We process your name and e-mail address. The following sign-in methods are available:
- Password — only a non-reversible hash is stored, never the password itself.
- Magic link — a single-use sign-in link sent by e-mail.
- Passkey — sign-in via a key stored on your device; the private key never leaves it.
- Optionally two-factor authentication.
Sign-in via third-party accounts (such as Google or GitHub) does not take place; those methods are disabled.
Optionally you may upload a profile or organisation image (see section 10).
Legal basis: Art. 6 (1) (b) GDPR. Retention: until you delete your account, which you can do yourself at any time in the account settings.
7. Territory and assignment data (processing on behalf)
You create territories and may assign staff of your organisation to them by name. This involves name, period of assignment and a free-text note.
We process this data not as controller but exclusively on your behalf under Art. 28 GDPR. The legal basis and the information of the staff concerned are your responsibility. The data processing agreement applies automatically with the usage contract; it need not be requested separately.
Retention: until you delete the territory or the assignment, at the latest upon deletion of your account.
8. Street data and maps (OpenStreetMap)
To determine streets and house numbers we query the Overpass API of the OpenStreetMap project and display maps based on it.
These queries transmit only the postcodes you enter — no personal data. When map tiles load in your browser, your IP address is transmitted to the map servers.
Retrieved street data is cached for up to 30 days to avoid repeated queries. That data is public and contains no personal reference.
Provider: OpenStreetMap Foundation, St John's Innovation Centre, Cowley Road, Cambridge, CB4 0WS, United Kingdom. An adequacy decision of the European Commission exists for the United Kingdom. Legal basis: Art. 6 (1) (f) GDPR. Legitimate interest: providing the core function of the service.
9. Hosting
Application and database run at Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany. The server location is Germany. The database is reachable only via an internal network.
10. Object storage for images
Uploaded profile and organisation images are stored in Hetzner Online GmbH object storage at the Nuremberg, Germany location.
Legal basis: Art. 6 (1) (b) GDPR. An Art. 28 GDPR agreement is in place with Hetzner.
11. E-mail delivery
For sign-in, confirmation and invitation e-mails we use the mail server of Neue Medien Münnich (ALL-INKL.com), Hauptstraße 68, 02742 Friedersdorf, Germany. Server location is Germany. Legal basis: Art. 6 (1) (b) GDPR. An Art. 28 GDPR agreement is in place.
12. Contact form
If you write to us via the contact form, we process name, e-mail address and message to handle your enquiry. The message is sent to us by e-mail and is not stored in the application.
Legal basis: Art. 6 (1) (b) GDPR for contract-related enquiries, otherwise (f). Legitimate interest: answering enquiries. Retention: until the enquiry has been dealt with conclusively, unless commercial or tax retention obligations apply.
13. No payment data, no tracking, no AI
The service is currently provided free of charge; we collect no payment data. We use no analytics, tracking or advertising tools and do not process the data using artificial intelligence.
14. No automated decision-making
Automated decision-making including profiling within the meaning of Art. 22 (1) and (4) GDPR does not take place. The automated territory division concerns streets and addresses, not persons.
15. Recipients and third-country transfers
Your data is received solely by the processors named in this policy, and only to the extent necessary. No transfer to third countries outside the EU/EEA takes place. The OpenStreetMap Foundation named in section 8 receives no personal data from us.
16. Your rights
You have the right of access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction (Art. 18) and data portability (Art. 20 GDPR). Please contact info@bonuski.de.
If your request concerns data we process on behalf of a customer (section 7), we forward it to that customer, who then answers as controller.
17. Right to object under Art. 21 GDPR
You have the right to object at any time, on grounds relating to your particular situation, to processing of personal data concerning you which is based on Art. 6 (1) (f) GDPR. This concerns the processing described in sections 3, 8 and 12.
If you object, we will no longer process the data unless we can demonstrate compelling legitimate grounds which override your interests, rights and freedoms, or the processing serves to establish, exercise or defend legal claims.
18. Right to lodge a complaint
You may lodge a complaint with a supervisory authority. The authority responsible for us is:
Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen Kavalleriestr. 2–4, 40213 Düsseldorf, Germany Phone: +49 211 38424-0, e-mail: poststelle@ldi.nrw.de
19. Changes to this policy
We adapt this policy when the processing or the legal situation changes. The version published at the time of collection applies; the current one is always found here with version number and date.