Privacy notice

The following notes give a simple overview of what happens to your personal data when you visit this website. Personal data is any data by which you can be personally identified. Detailed information on data protection can be found in our privacy notice set out below this text.

When you visit this website, your browsing behaviour may be evaluated statistically. This is done mainly with so-called analysis programs.

Detailed information on these analysis programs can be found in the following privacy notice.

The provider is Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany (hereinafter Hetzner). The server running the website and its database is located in a Hetzner data centre in Germany.

For details, see Hetzner’s privacy policy: https://www.hetzner.com/legal/privacy-policy/.

Hetzner is used on the basis of Art. 6 (1) (f) GDPR. We have a legitimate interest in presenting our website as reliably as possible.

We manage the server through the service Ploi (ploi.io), based in the Netherlands. Ploi sets up the server and deploys new versions of the website; for this the service has technical access to the server. We do not evaluate any personal data through Ploi.

It is used on the basis of Art. 6 (1) (f) GDPR. Our legitimate interest lies in running the website securely and maintainably.

The emails of this website – sign-in links with their code and your messages from the contact form – are sent via the SMTP relay service of Google Workspace. The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Google processes the recipient’s address and the content of the respective email.

A transfer of data to the USA cannot be ruled out. Google LLC is certified under the EU-US Data Privacy Framework; the transfer is based on the adequacy decision of the European Commission (Art. 45 GDPR). For details, see Google’s privacy policy: https://policies.google.com/privacy.

Sending takes place on the basis of Art. 6 (1) (b) GDPR where it is necessary for using your account (such as the sign-in link), and otherwise on the basis of Art. 6 (1) (f) GDPR. Our legitimate interest lies in reliable delivery.

The operators of these pages take the protection of your personal data very seriously. We treat your personal data confidentially and in accordance with the statutory data protection regulations and this privacy notice.

When you use this website, various personal data is collected. Personal data is data by which you can be personally identified. This privacy notice explains which data we collect and what we use it for. It also explains how and for what purpose this is done.

We point out that data transmission over the internet (e.g. when communicating by email) can have security gaps. Complete protection of data against access by third parties is not possible.

The controller for data processing on this website is:

Sebastian Widmann Ringstr. 19a 76228 Karlsruhe Germany

Phone: +49 721 85143099Email: contact@cleody.com

The controller is the natural or legal person who alone or jointly with others decides on the purposes and means of processing personal data (e.g. names, email addresses, etc.).

Unless a more specific storage period is stated in this privacy notice, your personal data remains with us until the purpose for the data processing no longer applies. If you assert a legitimate request for erasure or withdraw your consent to data processing, your data will be deleted unless we have other legally permissible reasons for storing your personal data (e.g. retention periods under tax or commercial law); in the latter case, the data will be deleted once these reasons no longer apply.

If you have consented to data processing, we process your personal data on the basis of Art. 6 (1) (a) GDPR or Art. 9 (2) (a) GDPR, insofar as special categories of data under Art. 9 (1) GDPR are processed. In the case of express consent to the transfer of personal data to third countries, data processing is also carried out on the basis of Art. 49 (1) (a) GDPR. If you have consented to the storage of cookies or to access to information on your device (e.g. via device fingerprinting), data processing is additionally carried out on the basis of § 25 (1) TDDDG. Consent can be withdrawn at any time. If your data is required for the performance of a contract or for pre-contractual measures, we process your data on the basis of Art. 6 (1) (b) GDPR. Furthermore, we process your data where this is necessary to fulfil a legal obligation, on the basis of Art. 6 (1) (c) GDPR. Data may also be processed on the basis of our legitimate interest under Art. 6 (1) (f) GDPR. The legal bases relevant in each individual case are set out in the following paragraphs of this privacy notice.

In the course of our business we work with various external parties. In some cases this requires personal data to be transmitted to these external parties. We pass personal data on to external parties only where this is necessary for the performance of a contract, where we are legally obliged to do so (e.g. passing data to tax authorities), where we have a legitimate interest in doing so under Art. 6 (1) (f) GDPR, or where another legal basis permits it. When using processors, we pass our customers' personal data on only on the basis of a valid data processing agreement. In the case of joint processing, a joint processing agreement is concluded.

Many data processing operations are only possible with your express consent. You can withdraw consent already given at any time. The lawfulness of the data processing carried out until the withdrawal remains unaffected by it.

In the event of infringements of the GDPR, data subjects have the right to lodge a complaint with a supervisory authority, in particular in the member state of their habitual residence, their place of work or the place of the alleged infringement. The right to lodge a complaint is without prejudice to any other administrative or judicial remedy.

You have the right to have data that we process automatically on the basis of your consent or in performance of a contract handed over to you or to a third party in a common, machine-readable format. If you request the direct transfer of the data to another controller, this will only be done insofar as it is technically feasible.

Within the scope of the applicable statutory provisions, you have the right at any time to free information about your stored personal data, its origin and recipients and the purpose of the data processing and, where applicable, a right to rectification or erasure of this data. For this and any other questions on the subject of personal data, you can contact us at any time.

You have the right to request that the processing of your personal data be restricted. To do so, you can contact us at any time. The right to restriction of processing exists in the following cases:

For security reasons and to protect the transmission of confidential content, such as orders or enquiries you send to us as the site operator, this site uses SSL or TLS encryption. You can recognise an encrypted connection by the address bar of the browser changing from "http://" to "https://" and by the lock symbol in your browser bar.

When SSL or TLS encryption is activated, the data you transmit to us cannot be read by third parties.

We hereby object to the use of contact details published under the imprint obligation for sending unsolicited advertising and information material. The operators of the pages expressly reserve the right to take legal action in the event of unsolicited advertising being sent, for instance by spam emails.

This website can be reached at packlist.cleody.com, in German and in English. Which language you see depends on the address you open, your choice in the language switcher or your browser’s language setting.

This website sets only technically necessary cookies. There are no cookies for advertising or analysis purposes and no third-party cookies; this is why we do not ask for consent. In detail:

The provider of the pages automatically collects and stores information in so-called server log files, which your browser automatically transmits to us. These are:

You can send us a message through the contact form. We process your email address, your message and – if you give it – your name. The details are not stored in the website’s database but delivered to us as an email (via Google, see section 2) so that we can reply to you.

Processing takes place on the basis of Art. 6 (1) (b) GDPR where your message concerns your account, and otherwise on the basis of our legitimate interest in answering the enquiries addressed to us (Art. 6 (1) (f) GDPR). We keep the email until your request has been dealt with, unless statutory retention periods prevent this.

If you contact us by email, phone or fax, your enquiry, including all personal data arising from it (name, enquiry), is stored and processed by us for the purpose of handling your request. We do not pass this data on without your consent.

This data is processed on the basis of Art. 6 (1) (b) GDPR where your enquiry is related to the performance of a contract or is necessary for pre-contractual measures. In all other cases the processing is based on our legitimate interest in handling the enquiries addressed to us effectively (Art. 6 (1) (f) GDPR) or on your consent (Art. 6 (1) (a) GDPR) where this was requested; consent can be withdrawn at any time.

The data you send us by way of contact enquiries remains with us until you ask us to delete it, withdraw your consent to its storage, or the purpose for storing the data no longer applies (e.g. once your request has been dealt with). Mandatory statutory provisions – in particular statutory retention periods – remain unaffected.

To use Packlist, your email address is enough. There is no password: you sign in with a link or a six-digit code that we send you by email and that is valid only once and only for 15 minutes.

For each sign-in request we store the email address, the link and code only as a checksum, and the IP address and identifier of the browser the request came from, in order to detect misuse. We delete these entries one day after they expire.

For your account we store your email address and the language you chose; you receive our emails in this language. Processing takes place to carry out the user relationship established by your account (Art. 6 (1) (b) GDPR).

Under “Account” in the account menu you can at any time download all your lists and templates in a common, machine-readable format and delete your account yourself. On deletion, all lists and templates are deleted at once and for good, and you are signed out on all devices. Otherwise we store the data for as long as your account exists.

Lists, sections, items and templates you create – titles, descriptions, departure dates, names, what is packed and your review of a trip – are stored so that we can show them to you and reuse them for the next trip. They are visible only to you; there is no sharing function. As you type, the website suggests items from your earlier lists and templates; these are evaluated for this purpose only for you.

Deleted lists and templates first go to the trash and are deleted for good after 30 days.

Processing takes place on the basis of Art. 6 (1) (b) GDPR.

We embed a small statistics script from info.cleody.com. This address leads to a server we run ourselves; the data is not passed on to other companies. No cookies are set.

When a page is opened, your browser transmits to this server: the address of the page (without query parameters, except campaign identifiers such as “utm_source”), its title, the page you came from, your screen width and the width of the browser window, whether your device has a touchscreen, the language set, and how long you stayed and how far you scrolled. On the pages of your packing lists and your own templates, the title is the name you gave the list or template yourself. If you click a link to another website or a link that downloads a file (such as PDF, ZIP, Office, audio or video files), the address of that link is recorded as well, without query parameters. If your browser provides it (for example Chrome or Edge), the version number of your operating system is also transmitted with every page view. As with any request on the internet, the server technically receives your IP address.

Your IP address is not stored. From it, your browser’s identifier and a random value that is generated anew every day and deleted afterwards, the server only forms an anonymous checksum in order to group the page views of one day. After that, it is no longer possible to trace your IP address, not even for us. The raw data is deleted after 400 days at the latest.

You can object to the measurement: open a page of this website with ?statistics_ignore=1 added to the address. The script stores the objection in your browser’s local storage and no longer records your visits; with ?statistics_ignore=0 you lift it again.

Processing takes place on the basis of Art. 6 (1) (f) GDPR. We have a legitimate interest in understanding how our service is used in order to improve it.

To detect and fix errors quickly, the website reports technical errors and loading-time measurements to Outpost, a service we operate ourselves on our own server at Hetzner in Germany. The data is not passed on to other companies, and no cookies are set.

In the event of an error, the following is transmitted: the error message, the requested address, details of the browser and operating system, the last steps before the error (such as clicks and pages opened) and, if you are signed in, the internal identifier of your account. Passwords, tokens and cookies are removed before sending. Individual entries of the application log (see server log files) may contain an email address. In addition, for some visits we measure the loading times of pages together with the device class.

The processing is carried out on the basis of Art. 6(1)(f) GDPR. We have a legitimate interest in a fast and error-free website.