This English version is a convenience translation provided for ease of understanding; in the event of any discrepancy, the German version (Datenschutzerklärung) prevails.
The protection of your data matters to us. This policy applies to the website herbtrack.de. A separate privacy policy applies within the HerbTrack platform (app.herbtrack.de).
Our data protection officer (Art. 37 GDPR, Section 38 BDSG) is Kristina Bischof; for any data protection questions and to exercise your rights, you can reach her at hello@herbtrack.de.
We host this website with Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany. The servers are located in Germany; no transfer to third countries takes place. Processing is based on our legitimate interest in the secure and efficient provision of the website (Art. 6(1)(f) GDPR). A data processing agreement pursuant to Art. 28 GDPR is in place with Hetzner.
This website keeps no permanent access log files: the upstream reverse proxy does not record individual page views. During operation, only technical operational logs of the server containers are produced (e.g. start-up and error messages). These are rotated automatically and limited in size (older entries are overwritten); no analysis relating to your person takes place. They serve exclusively the secure operation, error analysis and defence against attacks — the legal basis is our legitimate interest in the functionality and IT security of the website (Art. 6(1)(f) GDPR). In order to deliver the page, your browser necessarily transmits your IP address for technical reasons; we do not systematically store it or combine it with other data to identify you.
This website makes do with a minimum of cookies. Necessary cookies (no consent required, § 25(2) TDDDG): the non-sensitive hint cookie herbtrack/presence (see below) and the cookie herbtrack/consent, which stores only your cookie choice (approx. 6 months). For statistics we use Google Analytics 4 — only with your consent.
Google Analytics 4 (analytics). To analyse how our site is used we use Google Analytics 4, a service of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Google Analytics uses cookies (including _ga and _ga_<ID>, each with a lifetime of up to 2 years) and collects a pseudonymous identifier (client ID) and usage data; the data is not anonymous. The legal basis is your consent under Art. 6(1)(a) GDPR in conjunction with § 25(1) TDDDG. No Google Analytics script is loaded before your consent and no data flows to Google; we activate measurement only after you agree via the cookie notice. Data may be transferred to Google LLC, USA; this is safeguarded by the EU-US Data Privacy Framework (Google LLC is certified) and additionally by the EU Standard Contractual Clauses. A residual risk of access by US authorities cannot be fully excluded. Your IP address is used only for coarse geolocation and is not stored by us; the retention period in Google Analytics is limited to 14 months. A data processing agreement pursuant to Art. 28 GDPR is in place with Google.
Withdrawal: you can withdraw your consent at any time with effect for the future — as easily as you gave it — via the “Cookie settings” link in the footer. Withdrawal stops further collection and deletes the analytics cookies (_ga, _ga_<ID>). Alternatively you can block cookies in your browser — the website remains fully usable.
Regarding the presence hint: if you are logged in to the HerbTrack app, the app sets a non-sensitive hint cookie (herbtrack/presence) on the shared domain. It contains no personal data, only the information “logged in: yes/no”, so that we can show you the “To the app” button at the top instead of “Create account”. The legal basis for this evaluation is our legitimate interest in convenient user guidance (Art. 6(1)(f) GDPR). The cookie is removed when the validity specified by the app login expires or upon logout. The actual session cookie of the app is never shared with this website.
We embed the “Poppins” font self-hosted (via @nuxt/fonts). As a result, loading the page establishes no connection to Google servers and transmits no IP address to third parties.
If you contact us by email, we process the details you provide in order to handle your enquiry. The legal basis is Art. 6(1)(b) GDPR where your enquiry concerns the conclusion or performance of a contract, otherwise Art. 6(1)(f) GDPR (our legitimate interest in responding to enquiries). Providing your data is voluntary; however, without it we cannot answer your enquiry. We do not pass on this data and delete it as soon as the enquiry has been dealt with and no retention obligations apply.
Via buttons such as “Create account” or “To the app”, you are redirected to the HerbTrack platform (app.herbtrack.de). Only there — after your input — does further processing take place; the platform’s own privacy policy applies to it.
On subpages under /csc we display factual register data about cannabis cultivation associations: name, town/federal state, status and — where published or maintained by the club itself — contact details (e.g. email, phone, website) and a description. In individual cases this information can be personal data (for instance where a club name or a contact address contains the name of a natural person). We do not collect this data from the data subjects themselves (Art. 14 GDPR): sources are our own research in publicly accessible sources (registers of associations, club websites, press coverage) and details maintained by clubs after claiming their entry in the HerbTrack platform (app.herbtrack.de); this website retrieves the data from there and displays it. The legal basis is our legitimate interest in a factual, public directory of cultivation associations (Art. 6(1)(f) GDPR). Internal data and information about boards or members are not published. Affected clubs and individuals can object to the processing at any time (Art. 21 GDPR) and request rectification or erasure of their entry (Art. 16, 17 GDPR) — informally via hello@herbtrack.de; we correct or remove entries promptly.
You have the following rights regarding your personal data: access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and the right to object to processing (Art. 21 GDPR). Where processing is based on consent, you may withdraw it at any time with effect for the future (Art. 7(3) GDPR) without affecting the lawfulness of processing carried out up to that point. On this website we process data on a statutory basis (Art. 6(1)(b) and (f) GDPR) and — for analytics with Google Analytics — on the basis of your consent (Art. 6(1)(a) GDPR), which you can withdraw at any time via “Cookie settings” in the footer. You may object at any time, pursuant to Art. 21 GDPR, to processing based on Art. 6(1)(f). No automated decision-making, including profiling (Art. 22 GDPR), takes place on this website.
You have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR). The authority responsible for us is the State Commissioner for Data Protection and Freedom of Information of Baden-Württemberg (Landesbeauftragter für den Datenschutz und die Informationsfreiheit Baden-Württemberg).
For security reasons, this site uses TLS encryption. You can recognise an encrypted connection by the “https://” and the padlock symbol in your browser’s address bar. The encryption serves the security of data transmission and fulfils our obligation to implement appropriate technical measures (Art. 32 GDPR).
This privacy policy is current as of July 2026. As the website develops or legal requirements change, it may become necessary to amend it.
We use a privacy-friendly analytics tool to understand how our site is used — only if you agree. It's not required to use the site.
Privacy