Privacy information

Controller

The controller within the meaning of the General Data Protection Regulation (GDPR) is the school that gave you the parents' letter. Its contact details and its data protection officer are in the parents' letter and at the start of the questionnaire.

Purpose and legal basis

The school uses your answers to make routes to school safer, for example for a school route plan. Taking part is voluntary. The legal basis is your consent (Art. 6(1)(a) GDPR). You can withdraw your consent at any time by deleting your entry with your code. The withdrawal applies from then on. Anything processed before the withdrawal remains lawful. If you do not take part, there are no disadvantages for you or your child.

What is stored

• Your entry: the route to school, the transport, dangerous spots, good spots and your comments, plus the versions of the consent text and of the privacy information you agreed to (one date each). It is encrypted on your device before it is sent.
• If the route starts at home, your address is not stored. The stored route starts at the junction before your street section; for a cul-de-sac, only where it joins the next street, and the cul-de-sac itself is not stored. This is calculated on your device. Hazards and good spots are stored exactly, even when they are close to your home.
• A check value (hash) of your access code, so that you can change or delete your entry later. The code itself is not stored.
• The month of the last change and the enrolment year of the letter.
• Names, addresses, email addresses and IP addresses are not stored. Your IP address is only processed briefly in memory to protect the website against misuse.

Encryption

Your entry is encrypted with the school's public key. Only the school has the matching private key, on paper. Neither the operator nor the hosting provider can read your entry. The check code in the questionnaire must match the check code in the parents' letter.

Who receives the data

• The school decrypts the entries and evaluates them.
• The municipality only receives summarised results, for example for the school route plan, never individual entries. The school only passes on comments after checking them.
• The website's operator processes the encrypted entries on behalf of the school (Art. 28 GDPR).
• The hosting provider is Sliplane GmbH, c/o ECOSIA, Gerichtstraße 23, 13347 Berlin, as a sub-processor. Sliplane uses data centres of Hetzner Online GmbH and, for backups, of Impossible Cloud GmbH, both in Germany. No data goes to countries outside the EU.

No automated decisions

There is no automated decision-making and no profiling.

How long it is stored

Your entry is deleted automatically when the year group finishes primary school. The date is in the parents' letter. If the school ends the survey earlier, all answers are deleted at once. Only a check value of your code stays until the date in the parents' letter, so that we can tell you that everything was deleted. You can delete it yourself at any time. Backups are permanently cleared of the data no later than 30 days after expiry or deletion.

Your rights

With your code you can replace and delete your entry at any time.

The school and the operator do not know which entry is yours. Without your code, they cannot link you to an entry. Requests for access, rectification, erasure, restriction or data portability (Art. 15 to 20 GDPR) can therefore only be met with the code (Art. 11 GDPR).

You can complain to a data protection supervisory authority, for example the State Commissioner for Data Protection and Freedom of Information of Baden-Württemberg.

No cookies, no tracking

Zebrio sets no cookies and uses no analytics tools. For parents, Zebrio stores nothing in the browser. All content, including the map, comes from our own server. No services of other providers are loaded.

Storage in the school's browser

In the analysis and the planning tool, Zebrio keeps data in the browser's storage (localStorage), only on the device the school works on: which comments the school has approved and which places it has hidden (check values only, no texts or routes), and the draft of its school route planning, so that nothing is lost when the page is closed. This data does not go to our server and cannot be seen on other devices.

To delete it: the approvals in the analysis under "Einstellungen" with "In diesem Browser löschen", the planning in the planning tool with "Neu beginnen". To delete everything at once, clear Zebrio's stored site data in your browser's settings.