Privacy policy

This privacy policy applies to the websites mapasso.de and mapasso.com. The Mapasso Shopify app has its own privacy policy.

Who is responsible

Maik Gossen, DD-Gossen, Im Siekertal 6, 32545 Bad Oeynhausen, Germany. Contact: info@mapasso.de.

What data we process on these websites

When you visit: IP address, browser and time, processed by Cloudflare to deliver and protect the page
For demo and contact requests: name, email, store URL, industry, message (processed by Formspree, see below)
When you book a call: name, email address, time and your note (processed by Cal.com, see below)
Google Analytics 4 (only with your explicit consent, see below)

Contact and demo form (Formspree)

Contact and demo forms on mapasso.de and mapasso.com are processed by the service Formspree (provider: Formspree Inc., 2261 Market Street #4903, San Francisco, CA 94114, USA) and forwarded to our email address info@mapasso.de.

Data processed: the form fields you fill in (name, email, store URL, industry, message), plus your IP address and user agent (for spam protection).

Legal basis: Art. 6(1)(b) GDPR (steps prior to entering into a contract) or Art. 6(1)(f) GDPR (legitimate interest in responding to your inquiry). Formspree processes the data in the USA. According to Formspree, the transfer is based on standard contractual clauses (Art. 46 GDPR). We delete inquiries once they have been dealt with, no later than six months, unless a contract follows.

More information: Formspree Privacy Policy.

Booking a call (Cal.com)

On mapasso.de, we link to a booking page for a call with us. The booking takes place on the Cal.com website (Cal.com, Inc., USA), and the call runs on Cal Video. We do not embed any Cal.com script on mapasso.de itself.

If you book a call, we process your name, email address, the time and your note in order to hold the call with you (Art. 6(1)(b) GDPR, steps prior to entering into a contract, or Art. 6(1)(f) GDPR, legitimate interest in answering questions about Mapasso). We delete the booking no later than six months after the call.

Cal.com processes your details in the USA. Cal.com is certified under the EU-U.S. Data Privacy Framework. The transfer is based on the European Commission's adequacy decision (Art. 45 GDPR). Booking confirmations go to a mailbox at Google (Google Ireland Limited), where the appointment is also stored in the calendar. According to Google, it also processes data outside the EU.

On the Cal.com website, Cal.com's own privacy policy also applies: cal.com/privacy.

Website hosting

Both websites run on Cloudflare Pages. Cloudflare is a US provider with a global edge network. When you visit, Cloudflare processes your IP address to deliver the page and protect it from attacks (Art. 6(1)(f) GDPR). Cloudflare is certified under the EU-U.S. Data Privacy Framework, and the transfer is based on the European Commission's adequacy decision (Art. 45 GDPR). We do not store our own logs with IP addresses. Cloudflare processes the IP address as our processor only for delivery and security. Cloudflare does not state a fixed retention period for this.

Google Analytics 4

We use Google Analytics 4 (provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland) to understand how visitors use our websites. Google Analytics sets cookies and transfers data (including the anonymized IP address, browser type, pages visited and time on page) to Google servers in the EU and the USA. The transfer is based on the European Commission's adequacy decision (Art. 45 GDPR).

We only use Google Analytics if you have explicitly consented in the cookie banner. Without your consent, no analytics tracking takes place (Consent Mode v2, default: denied). IP anonymization is enabled.

Legal basis: Art. 6(1)(a) GDPR (consent). You can withdraw your consent at any time by setting the local storage item mapasso_consent to denied in your browser or by deleting your browser cookies.

Property ID: G-LT4VHDE7VM. More about privacy at Google: policies.google.com/privacy. Opt-out browser add-on: tools.google.com/dlpage/gaoptout.

Google deletes event data after 2 months and user-level data after 14 months. Both websites use the same Google Analytics property. You give or refuse consent separately on each website. Withdrawing it on one website does not affect the other.

Public passport pages

When you scan a QR code on a product, a passport page opens at mapasso.de/01/<product-id>. When the page is requested, Cloudflare and Fly.io process your IP address to deliver the page and protect it from abuse. Fly.io is certified under the EU-U.S. Data Privacy Framework (Art. 45 GDPR). Our app server's logs contain no IP addresses and are deleted after 7 days. Cloudflare and Fly.io process the IP address as our processors only for delivery and security and do not state a fixed retention period for this. For the statistics of the merchant who published the passport, we store only the following:

Time of the request
Country, derived from the IP address. We do not store the IP address itself.
Device type as a broad category (smartphone, tablet or desktop)
Browser language (two-letter code)
The website you came from, hostname only

The legal basis is our legitimate interest in secure operation and in request statistics for the merchant (Art. 6(1)(f) GDPR).

The merchant creates the content of a passport. This includes manufacturer details with address and contact. Published passports remain available as long as the merchant uses the app. We delete them no later than 30 days after the app is uninstalled, as set out in Section 8 of our terms and conditions. How the app processes this data is explained in the app privacy policy.

Your rights

Access, rectification, erasure, restriction, portability. Send requests to info@mapasso.de.

Objection: If we process data on the basis of legitimate interests (Art. 6(1)(f) GDPR), you can object at any time on grounds relating to your particular situation (Art. 21(1) GDPR). You can withdraw your consent at any time with effect for the future (Art. 7(3) GDPR).

Objection to advertising: You can object to the use of your data for advertising at any time (Art. 21(2) GDPR), informally by email to info@mapasso.de. After that, we no longer use it for this purpose.

You also have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR).

Last updated: 5 November 2026