* our Matrix service, consisting of the "Homeserver"; `https://matrix.pub.solar`, as well as the web-based Element-Messenger ([chat.pub.solar](https://chat.pub.solar/)),
* our Mastodon service at `https://mastodon.pub.solar`.
Benjamin Bädorf, Jhonas Wernery, Hendrik Sokolowki
c/o MiOM 202
Wilhelm-Mauser-Straße 47 Halle 5,
D-50827 Köln
[crew@pub.solar](mailto:crew@pub.solar)
## Contact for data protection issues
If you have any questions regarding data protection, please contact us at [crew@pub.solar](mailto:crew@pub.solar) or at the postal address given above.
If a user chooses to use any of the services provided by us, the following data will be required and therefore collected by pub.solar in the authentication service:
Necessary information related to the operation and functioning of the services which may include, for example, IP address, User Agent, etc. More detailed information about this and how we handle it can be found in the Privacy notices per service.
When a user makes an online donation to pub.solar, we collect personal data such as, but not limited to, username (if any), country (in case of extra storage request for tax purposes), transaction IDs or bank account/reference. The purpose for which we use this data is merely administrative (verification of regular donations, accounting management) and is maintained under the same security measures described in the "How do we store your data?" section. Since all the data we collect is previously processed by a third-party payment processor such as PayPal, Patreon or Liberapay, by using these or similar services, their use of your information is based on their terms of service and policies, not ours, so we encourage you to review those policies carefully.
Any additional information that the user chooses to supply while using the services provided by us (whether it is chats, posts, emails, etc.). This additional information is optional and with the user's consent.
A valid email address: required for account creation. This email address is deleted from our database after the account has been approved/denied, unless the user chooses during the registration process, to keep it for password reset process.
This service requires login with pub.solar credentials.
Everything (files, calendars, contacts, news, tasks, bookmarks, etc.) is stored unencrypted in a database, unless an application provides external encryption (none so far). This is a limitation of the software we are utilizing for this service (Nextcloud).
We do not currently encrypt files when you upload them because we've had some bad experiences with dataloss incurred through end-to-end encryption.
Server logs, which store information such as, but not limited to, your IP address, your username, an app currently used, error messages and User Agent, are stored for a period of 24 hours after which they are deleted from the server. No backup of log files is created. Logs are kept to prevent brute-force attacks on accounts and to provide quick insight when debugging issues.
This service requires login with pub.solar credentials.
Server logs, which store information such as, but not limited to, your IP address, your username, error messages and User Agent, are stored for a period of 24 hours after which they are deleted from the server. No backup of log files is created. Logs are kept to prevent brute-force attacks on accounts and to provide quick insight when debugging issues.
All git data such as, but not limited to, usernames, email addresses, messages, code, files, versions, pull requests, etc., are stored on the server in the database as is (plain-text).
This service requires login with pub.solar credentials.
Server logs, which store information such as, but not limited to, your IP address, your username, error messages and User Agent, are stored for a period of 24 hours after which they are deleted from the server. No backup of log files is created. Logs are kept to prevent brute-force attacks on accounts and to provide quick insight when debugging issues.
All git data such as, but not limited to, usernames, email addresses, messages, code, files, versions, pull requests, etc., are stored on the server in the database as is (plain-text).
This service requires login with pub.solar credentials.
Basic account information: If you register on this server, you may be asked to enter a username, an e-mail address and a password. You may also enter additional profile information such as a display name and biography, and upload a profile picture and header image. The username, display name, biography, profile picture and header image are always listed publicly.
Posts, following and other public information: The list of people you follow is listed publicly, the same is true for your followers. When you submit a message, the date and time is stored as well as the application you submitted the message from. Messages may contain media attachments, such as pictures and videos. Public and unlisted posts are available publicly. When you feature a post on your profile, that is also publicly available information. Your posts are delivered to your followers, in some cases it means they are delivered to different servers and copies are stored there. When you delete posts, this is likewise delivered to your followers. The action of reblogging or favouriting another post is always public.
Direct and followers-only posts: All posts are stored and processed on the server. Followers-only posts are delivered to your followers and users who are mentioned in them, and direct posts are delivered only to users mentioned in them. In some cases it means they are delivered to different servers and copies are stored there. We make a good faith effort to limit the access to those posts only to authorized persons, but other servers may fail to do so. Therefore it's important to review servers your followers belong to. You may toggle an option to approve and reject new followers manually in the settings. Please keep in mind that the operators of the server and any receiving server may view such messages, and that recipients may screenshot, copy or otherwise re-share them. Do not share any sensitive information over Mastodon.
IPs and other metadata: When you log in, we record the IP address you log in from, as well as the name of your browser application. All the logged in sessions are available for your review and revocation in the settings. The latest IP address used is stored for up to 12 months. We also may retain server logs which include the IP address of every request to our server.
The personal data will be deleted from our server after 15 months of inactivity. The deletion requests are forwarded to the federated servers. However, we have no influence on their execution.
Financial data, for example from donations, will have to be kept for 10 years, required by German tax law.
Data regarding your pub.solar assocation membership will be deleted after you leave the assocation.
## Where is the personal data stored?
We run our all of our services on dedicated servers of the company [Hetzner GmbH](https://hetzner.com/). The data on these servers is encrypted at rest. Backups are made to several locations, the data is encrypted before it is sent to the backup locations.
## Data subject rights
When we process personal data about you, you have the following rights:
* right of access to the data processed and right to obtain a copy of it,
* right of rectification if we process incorrect data about you,
* right to deletion, unless exceptions apply as to why we are still storing the data, for example, retention obligations or limitation periods
* right to restriction of processing,
* right to withdraw consent to data processing at any time,
* right to object to processing in the public or legitimate interest,
* right to data portability,
* right to lodge a complaint with a data protection supervisory authority if you believe that we are not processing your data properly. The State Commissioner for Data Protection and Freedom of Information in Nordrhein-Westfalen is responsible in our case. However, if you are in another federal state or not in Germany, you can also contact the data protection authority there.
## What we do not do with your data
We do not collect any other data than what is needed to provide you the service.
We do not, in any way, process, analyze your behavior or personal characteristics to create profiles about you or your usage of the services. We have no advertisements or business relationships with advertisers.
We do not sell your data to any third party.
We do not share your data to any third party unless in case of federated services which requires certain data to be shared in order to operate (e.g. other email service provider needs to know your email address to be able to deliver emails).
We do not require any additional information that is not crucial for the operation of the service (we do not ask for phone numbers, private personal data, home address).
We do not read/look nor process your personal data, emails, files, etc., stored on our servers unless needed for providing the service, troubleshooting purposes or under suspicion of breaking our Terms Of Services in which case we ask for prior permission from you or inform you afterwards of all actions taken against the account in the transparency report addressed to account holder.
We have created the basic structure of this data protection information with the help of [DS-GVO.clever-Tools](https://www.baden-wuerttemberg.datenschutz.de/ds-gvo.clever/) and adapted it to our needs. We have also used parts of [Datenschutzerklärung der TU-Dresden](https://doc.matrix.tu-dresden.de/privacy/) and adjusted them accordingly. Text is licensed [CC BY-SA 4.0](https://creativecommons.org/licenses/by-sa/4.0/deed.de).
