Who is responsible
Yekta IT GmbH, Ruhrallee 9, 44139 Dortmund, Germany, info@yekta-it.de. More details in the legal notice.
In short
- Without an account we create no record about you; our database only holds the short-lived technical entries listed under "Technically necessary".
- No analytics, no tracking, no advertising and no fonts, scripts or images from other servers.
- There is only one cookie, a session cookie, and only when the website has to remember something for you between two page views – your login, a message after you submit a form (such as "forgot password"), or your choices in the assistant for logging in.
- Ticks you set on lists that are not yours, and the dismissed notice about an account, stay in your browser (see "Ticks and notices in your browser").
- What you create as private is seen by no one except you and the people you share it with.
Without an account
You can use the list assistant without an account. Your answers (destination, duration, travellers, activities) are only part of the page address; we do not store them. If you want to save the result as a list and first need to log in or register, we remember your answers and deselected items in your session so nothing is lost. For this the website sets the session cookie (see below).
With an account
Your account
For an account we store your user name, your e-mail address and your password as a one-way hash, plus the times of registration, last login and last visit, and the language and time zone from your settings. Once you have logged in through a link from an e-mail, we store a checksum of your e-mail address as "confirmed"; only then can you write comments. If your address changes, it counts as unconfirmed again. Legal basis is the performance of the user agreement (Art. 6 (1) (b) GDPR).
Lists and items
We store your lists with title, description, entries, quantities, notes, sections, check marks, departure date and classification (for example destination and activity). Every list has a visibility:
- Private (default): only you and the accounts you share it with.
- Anyone with the link: everyone who knows the secret link. You can create a new link at any time; the old one then stops working.
- Public: everyone, including search engines. Public lists appear in our search, in the best lists and in the sitemap, and get an address containing their title. Your user name is not shown on the list.
If you share a list with another account, that person can read it and – if you allow it – edit it; you see each other's user names. Items you create yourself are private. If you suggest one for the catalog, the editorial team sees its name, its description, your user name and on how many lists it is used, but not your lists; if they approve it, it becomes part of the public catalog. If someone copies your public list or a list you share with them, the copy belongs to that person.
Ratings, comments, reports
When you rate a public list, we store your stars with your account and the time; others only see the average and the number of ratings. Comments are shown publicly with your user name and the date. We store your IP address neither for ratings nor for comments. When you report a list or a comment, we store your account, the time, the reason and your optional message; the editorial team receives an e-mail (without your name) and sees the report in its overview.
E-mails
We only write to you about your account: registration, forgotten password, confirmation of your e-mail address, deletion of your account, decisions of the editorial team about your suggestions, and when the editorial team sets your list to private after a report. There is no newsletter.
Technically necessary
Ticks and notices in your browser
If you tick items on a list you cannot edit, take over an idea on a best list or dismiss the notice about an account, only your browser stores this (in local storage, not as a cookie). We learn nothing about it; none of it is sent to us. If you delete the site data in your browser, it is gone. No consent is needed because you trigger the function yourself (§ 25 (2) no. 2 TDDDG).
Session cookie
A cookie with a random identifier keeps you logged in, holds a message after a form or holds your remembered choices in the assistant. On the server we keep the session data, your IP address and the time of your last request with it. The cookie expires after 23 days or when you log out; the related session data on the server expires after about 55 hours without use and is then deleted automatically. The website sets no other cookies (§ 25 (2) no. 2 TDDDG; Art. 6 (1) (b) and (f) GDPR).
Protection against abuse
The forms for registering, requesting a new password and commenting are protected against automated submissions: by a small JavaScript check in your browser, and for registering and commenting also by a hidden field with a time check. If this protection is triggered, we keep your IP address briefly; the entry is deleted after five minutes at the next regular clean-up. We count failed logins per IP address and account to slow down password guessing; these entries expire after six hours at most. We also count every request for a new password, per IP address (the entry expires after one hour at most) and per account (after six hours at most), so that nobody can trigger mails in bulk. Comments and reports are limited to ten per hour per account. Legal basis is our legitimate interest in secure operation (Art. 6 (1) (f) GDPR).
Logs
The website keeps an event and error log (for example logins, failed logins, pages not found or errors while saving). An entry contains the time, the requested address, the previously visited address (referrer), the account and the IP address; only the latest 1000 entries are kept, older ones are deleted automatically. In addition, the web server logs requests and errors (IP address, time, requested address, browser identifier) for troubleshooting and to fend off attacks. These logs are rotated daily; the latest three are kept and older ones are deleted automatically, so entries are gone after four days at most. The logs are not analysed for visitor statistics. Legal basis is Art. 6 (1) (f) GDPR.
Server and search
Website, database and search index run on a server operated on our behalf by Hetzner Online GmbH (Industriestr. 25, 91710 Gunzenhausen, Germany) in a data centre in Falkenstein, Germany (data processing agreement under Art. 28 GDPR). Only public lists and catalog items go into the search index, without user names. E-mails are sent by this server itself.
How long we keep data
As long as your account exists. You can delete your account yourself at any time: "My account" → "Edit" → "Cancel account"; for safety you confirm this through a link sent by e-mail. Together with the account we delete your lists, your private items, your ratings, comments and reports, and your shares on lists of others. Copies others made of your public lists belong to them and remain; the reference to your original disappears. If you put your own items on a list of another account, that account gets its own copy of them without any link to you. Items the editorial team took into the catalog from your suggestions stay in the catalog without any link to you. If the administration deletes an account and assigns its content to "Anonymous", the comments of that account remain without a name as "Anonymous"; everything else is deleted as described.
To protect against data loss, we regularly make backup copies of the database. Deleted data may remain in them for some time. We use these copies only to restore the website after a failure.
What does not happen
No analytics or audience measurement, no advertising, no profiling, no automated decisions. The website loads nothing from other servers; no one learns your IP address from your visit except us and our hosting provider. No disclosure to third parties and no transfer to countries outside the EU.
Your rights
You have the right of access, rectification, erasure, restriction of processing, data portability and objection (Art. 15 to 21 GDPR). Write to us at info@yekta-it.de. You can also lodge a complaint with a data protection supervisory authority; the authority responsible for us is the State Commissioner for Data Protection and Freedom of Information of North Rhine-Westphalia (LDI NRW).
Last updated: October 2026