Privacy policy

Responsible operator of the platform Timeline.pics ("controller") to the user ("data subject") is:

Sebastian Zipp
E-mail: sebastian@timeline.pics
Phone: +49 152 31 775 234

Address:
Sebastian Zipp
Neubiberger Str. 41
81737 Munich, Germany

Personal data are collected solely for the provision and implementation of the service on the Timeline.pics platform and are not otherwise processed. The service includes among others

• the release of content (photos, videos, milestones) within closed user groups, which are by managed by the data subject
• writing comments
• liking content
• the handling of payment transactions

The principle of data minimization is respected, that is, as little data as possible and only as much data as necessary are collected and stored. The data subject is able to access personal information, to correct or delete independently, so that they are always factually correct and if necessary, are up to date.

Personal data is processed in a manner that ensures adequate security of the data, in particular protection against unauthorized access and unintentional loss.

The personal data required for the proper operation of the platform will become processed in accordance with the provisions of the General Data Protection Regulation (GDPR). Below is a description of the purpose of and the extent to which the controller collects, stores and employs user data.

The lawfulness of processing is given by

a) the consent to the processing by the data subject. This applies to all user accounts, as both the creation of free and paid accounts and one-time payment transactions (purchase of a voucher) can only be carried out in connection with the consent for processing.

b) the fulfillment of a contract, that the data subject obtains with the controller by purchasing a paid service (subscriptions or purchase of a voucher).

The controller undertakes to provide the following information relating to the processing of personal data to the data subject in an understandable and easily accessible form. The information will be given by e-mail. When requested by the data subject, the information may be provided orally, provided that the identity of the data subject is proven by other means.

The controller shall not refuse to act on the request of the data subject, unless the controller demonstrates that it is not in a position to identify the data subject.

The controller provides information on action taken on a request within one month of receipt of the request. That period may be extended by two further months where necessary, taking into account the complexity and number of the requests. The controller informs the data subject of any such extension within one month of receipt of the request.

All of the information below is provided free of charge. Where requests from a data subject are manifestly unfounded or excessive, in particular because of their repetitive character, the controller may refuse to act on the request.

If the controller has reasonable doubts concerning the identity of the natural person making the request, the controller may request the provision of additional information necessary to confirm the identity of the data subject.

The controller collects and processes different personal data according to the requirements. The following list represent the maximum case of all collected data. In some cases, not all of the listed data will be collected, especially for free user accounts.

When websites are accessed, non-personal data are automatically stored in log files on the server (not just Timeline.pics). This refers to

• your anonymised IP-address,
• your browser,
• your installed operating system,
• the pages visited on Timeline.pics,
• date and time of your visit.

These data do not betray a visitor's identity. They are stored for the purpose of maintaining and ensuring the operation of the website in order, for example, to be able to comprehend an attempted attack on the website or, if there are concrete indications, the legitimate suspicion of unlawful use. The log files are automatically deleted after 14 days.

With your user registration on Timeline.pics, i.e. with the creation of a free user account, the following personal data are requested and stored:

• first name,
• last name,
• e-mail address.

When registering, no postal address or payment information is requested and stored, for reasons of data austerity.

Only when a user creates a paid account, i.e. either decides to do so at the first login or upgrades from the free account at a later point, the following personal data are additionally requested and stored for the purpose of invoicing:

• Address
• Post code and city
• Country

The service provider MOLLIE (mollie.com), which is based in the Netherlands, is used by the person in charge to process payment transactions.
For the payment process, the user is forwarded to a page provided by MOLLIE on which the payment will be processed via an encrypted connection (HTTPS).

MOLLIE processes the following personal data:

• Payment data (e.g. bank account number or credit card number)
• IP address
• Internet browser and device type
• in some cases the first and last name
• in some cases address data
• in some cases information about the product or service

Payment methods are represented by the service provider MOLLIE via unique identification keys. The person responsible saves no payment data (account or credit card data), but only these identification keys in order to perform recurring payments for a subscription.

If you do not want to entrust payment data to MOLLIE, the payment service provider mentioned above, it is possible to pay by bank transfer after getting in contact and receiving a manually invoice first.
A monthly payment interval is not possible on account of the higher administrative expenditure.

Incoming payments by bank transfer are processed on the account statements of BNP Paribas (branch office Germany). For bank statements a retention period of 10 years applies.

The controller uses two types of cookies. Session cookies are used to save your current login status. These cookies expire when the browser is closed, at the latest after four hours, or immediately when you click on the "Logout" link.

If you use the "stay logged in" function, so that you do not have to log in again each time you visit Timeline.pics, a so-called permanent cookie is set.

Detailed information about the cookies set on Timeline.pics:

timeline_session: Contains information about the logged in user. Is valid for four hours.

XSRF-TOKEN: Is used to secure input forms against so-called cross-site scripting attacks. The duration corresponds to the duration of the user session (four hours).

remember_web_[0-9,a-z]: Only set if the user selects "stay logged in". Contains a unique number that identifies the browser to Timeline.pics. The cookie has a term of five years, it is immediately deleted when the user clicks on "Logout".

timeline_2fa: Only set if the user uses so-called two-factor authentication. Contains a unique number that Timeline.pics can use to check, that a valid one-time code has already been queried in this browser. The cookie has a term of one month. It will be deleted immediately when the user clicks on "Logout".

The data subject can be notified by e-mail about certain events. Before such e-mails can be sent by the responsible person to the data subject, they must identify themselves via a confirmation e-mail as the owner of the registered e-mail address ("double opt-in"). You can set up notifications by e-mail for specific events, e.g. if one of your photos / videos is commented on. Before you can receive such e-mails, a confirmation mail will be sent to check whether you are the owner of the e-mail address you entered ("double opt-in").

The controller does not use web analytics, for reasons of data austerity. The usage of the website is not analyzed; we find this fact to be worth mentioning. A privacy notice regarding webanalytics is therefore not necessary.

On Timeline.pics, no share functions or other so-called social plugins of social networks are integrated. Moreover, individual photos / videos can not be shared on social networks, as they are only visible with an active login (only for registered users). Privacy policies for social networks are therefore not necessary.

The controller take the necessary technical and organizational measures to ensure a level of protection appropriate to the risk in the processing of personal data.

The connection to Timeline.pics is encrypted via an SSL server certificate issued by Let's Encrypt Authority.

The data subject is always forwarded to an encrypted connection, even if the url was entered without "https" in the address bar of the browser.

The password associated with the account is not in plaintext, but is composed with a random value ("salt") and stored as an encrypted hash value ( see "Bcrypt" on Wikipedia). It is thus no longer possible to draw conclusions as to the unencrypted password.

The data subject can optionally secure his or her user account with two-factor authentication (2FA).

The controller secures all personal data as well as the photos and videos uploaded by the data subject with daily backups to protect them against accidental or deliberate manipulation, loss and destruction.

In Germany, each person holds the right to their own image, which is a particular form of the fundamental personal rights. This law says that every human being can decide whether or not images of themselves are published at all (see "Personality Rights, Germany" on Wikipedia).

On Timeline.pics, pictures and videos from private environments are uploaded and shared with a closed utility group. Nevertheless, the personal right to one's own picture are valid to the point that, before the publication of any pictures, you have to obtain the permission to publish with the persons concerned or their parents in the case of legal minors.

Naturally, data protection regulations also apply to the personal data of children and adolescents who register with Timeline.pics. However, Timeline.pics strongly recommends that persons under the age of 16 can only register an account with Timeline.pics with the consent of their parents or educational advisors and, in particular, to upload photos to their own timelines only with their consent!

These data protection regulations apply from April 28th 2018 and replace the data protection regulations valid up to this deadline.