Privacy policy

1. Who is responsible

The controller under the EU and UK General Data Protection Regulation (GDPR) is the operator of Nivelmap (nivelmap.com). For anything about your data, write to privacy@nivelmap.com. Other contact details are on the Imprint page.

2. Visiting the site: server logs

When you open a page, your browser sends technical information that every website receives: IP address, date and time, the address requested, the referring page, browser and operating system (user agent) and the response status. We use it only to deliver the pages, keep the service secure and find errors.

Server log files are deleted after no more than 14 days, unless a specific entry is needed to investigate an attack; it is then kept only until that is resolved. We do not combine log data with other sources or use it to build profiles.

Legal basis: Art. 6(1)(f) GDPR (our legitimate interest in running a secure, working website).

3. Cloudflare (content delivery and security)

All requests pass through Cloudflare, Inc. (101 Townsend St, San Francisco, CA 94107, USA), which caches pages and protects the site against attacks and abuse. To do this Cloudflare processes your IP address and the request data listed above. Cloudflare may set a strictly necessary security cookie (such as __cf_bm) to tell people from bots; it is not used for tracking.

Cloudflare is certified under the EU-US Data Privacy Framework, and transfers are additionally covered by the European Commission’s standard contractual clauses. Legal basis: Art. 6(1)(f) GDPR. More: cloudflare.com/privacypolicy.

4. Cookies and storage in your browser

Nivelmap itself sets no cookies and uses no analytics, advertising or social-media tracking. Your language is part of the web address, so we do not need to remember it.

The site installs a small service worker. It keeps static files (fonts, icons, the map library) and copies of up to 30 pages you recently opened in your browser’s cache, so the site loads faster and the last pages stay readable offline. This data stays on your device and is never sent to us. You can delete it at any time by clearing the site data in your browser.

Legal basis: Art. 6(1)(f) GDPR; storing this on your device is strictly necessary for the function you use (Art. 5(3) ePrivacy Directive).

5. “Gauges near me” (your location)

Only if you press the button, your browser asks for permission to share your location. If you agree, the coordinates are rounded to about 100 metres and sent to our server once, to find the nearest gauges. They are not logged or stored and are not passed to anyone. You can withdraw the permission at any time in your browser settings.

Legal basis: your consent, Art. 6(1)(a) GDPR.

6. Map tiles, images and weather

Map: the map is only loaded when you open it or scroll it into view. Your browser then loads map tiles directly from OpenFreeMap (tiles.openfreemap.org), which receives your IP address and user agent as for any web request.

Photos: some pages show a photo from Wikimedia Commons. It is loaded directly from the servers of the Wikimedia Foundation (upload.wikimedia.org, USA), which receive your IP address.

Weather: forecasts come from Open-Meteo. Our server requests them for the gauge’s coordinates; no data about you is passed to Open-Meteo.

Legal basis for the map and photos: Art. 6(1)(f) GDPR (our interest in showing maps and pictures without hosting them ourselves).

Links to other websites (agencies, Wikipedia, route planning) only send data to those sites when you click them. Their own privacy policies apply there.

7. When you e-mail us

If you write to us, we use your address and message only to reply and to handle your request. We delete the correspondence when it is no longer needed, normally within 12 months, unless we must keep it longer by law. Legal basis: Art. 6(1)(f) GDPR, or Art. 6(1)(b) where your request relates to a contract.

8. Embedded widgets and the API

If another website embeds a Nivelmap widget, or a program uses our data API, the requests reach our servers and Cloudflare in the same way as a page visit, and section 2 and 3 apply. Widgets set no cookies.

9. Your rights

Under the GDPR you have the right to:

• access the personal data we hold about you (Art. 15);
• have incorrect data corrected (Art. 16) or deleted (Art. 17);
• restrict processing (Art. 18) and receive your data in a portable format (Art. 20);
• object at any time to processing based on our legitimate interests (Art. 21);
• withdraw consent at any time, without affecting processing done before (Art. 7(3));
• lodge a complaint with a data protection supervisory authority, for example the authority where you live, such as the Information Commissioner’s Office (ICO) in the United Kingdom or the Data Protection Commission in Ireland.

10. Other points

We do not sell personal data, we do not make automated decisions about you, and you are not obliged to provide any data to use the site. Because we keep log data only briefly and cannot link it to a person, we may be unable to identify you in it; tell us the date, time and IP address and we will check.

We update this policy when the site changes. The date of the latest version is shown at the bottom of this page.