Privacy Policy

Urday (https://urday.de) is a platform that helps people in Germany find local services, discover service providers who speak different languages, explore events and access useful local information. Service providers can create a profile on Urday and publish information about their business and services.

This Privacy Policy explains which personal data we process when you visit our website, register an account, create a provider profile or contact us, for what purposes we do so, on which legal basis, and which rights you have under the EU General Data Protection Regulation (GDPR).

The controller responsible for data processing on Urday is:

When you visit the website

• Technical data that your browser transmits automatically when you access the website, such as your IP address, date and time of the request, the page requested, the referring page, browser type and version, and operating system.
• Your selected language (en, de or ru).
• Usage statistics collected with our web analytics tool (see section 7).

When you register or log in

• Email address, password (stored only in hashed form), first and last name, and the account type you choose (user or service provider).
• Optional information such as a phone number, profile photo or a short description.
• The date and version of the Terms of Service and Privacy Policy you accepted and, if you opted in, your consent to receive marketing communications.
• If you log in with Google or Facebook: the data provided by these services (see section 5).

When you use the platform

• Content you create, such as provider profiles, listings, ratings and reviews, favourites and comments.
• Messages you exchange with other users or service providers via the chat function.
• Booking and payment-related data if you use booking or payment functions (see section 8).
• Messages you send us via the contact form or by email (name, email address, subject and message).

When you publish a provider profile

• The business and contact information you publish (see section 6).
• Aggregated counters for your profile, such as the number of profile views and clicks on your email, phone or WhatsApp contact options.
• If you receive payouts through Urday: the information required for this, such as bank details and data related to your Stripe account.

We process personal data for the following purposes and on the following legal bases:

• Providing the platform and your account (Art. 6(1)(b) GDPR): registration, login, provider profiles, listings, chat, bookings, favourites and other functions you request.
• Answering enquiries (Art. 6(1)(b) or (f) GDPR): processing messages you send us via the contact form or by email.
• Security and stability (Art. 6(1)(f) GDPR): delivering the website, protecting against misuse and spam (for example by limiting the number of requests per IP address), and troubleshooting. Our legitimate interest is the secure and reliable operation of Urday.
• Reach measurement (Art. 6(1)(f) GDPR): cookieless, privacy-friendly statistics on how the website is used, so we can improve it (see section 7).
• Displaying events and external content (Art. 6(1)(f) GDPR): showing events and information from partners and other sources, including images loaded from their servers.
• Marketing communications (Art. 6(1)(a) GDPR): only if you have given your consent. You can withdraw your consent at any time with effect for the future.
• Legal obligations (Art. 6(1)(c) GDPR): for example retention obligations under commercial and tax law for payment-related data.

Storing information on your device or accessing information already stored there (for example cookies) is based on § 25(2) No. 2 of the German Telecommunications Digital Services Data Protection Act (TDDDG) where this is strictly necessary to provide the service you requested, and otherwise on your consent under § 25(1) TDDDG.

You can register with your email address and a password. We send you an email to verify your email address and, if requested, an email to reset your password. Your password is stored only in hashed form.

After logging in, a session token is stored in your browser (cookie or local storage) so that you remain logged in. The session currently expires after 24 hours.

Google Login

You can log in with your Google account. In this case you are redirected to Google, and Google transmits to us your name, email address, a Google account identifier and, if available, your profile picture. We use this data to create or identify your Urday account. Google's privacy policy applies to the processing by Google: https://policies.google.com/privacy. You can revoke Urday's access at any time in your Google account settings.

Facebook Login

You can log in with your Facebook account. In this case you are redirected to Facebook, and Meta transmits to us your name, a Facebook account identifier, your email address (if your Facebook account has one and you allow it to be shared) and, if available, your profile picture. We use this data to create or identify your Urday account. Meta's privacy policy applies to the processing by Meta: https://www.facebook.com/privacy/policy. You can remove Urday's access at any time in your Facebook settings.

Logging in via Google or Facebook is voluntary. The legal basis is Art. 6(1)(b) GDPR.

Service providers can create a profile on Urday. The information you enter for publication is publicly visible to all visitors of the website and can be found via search engines. This may include:

• business name, description, category and services offered;
• logo, banner and gallery images;
• contact details such as email address, phone number, website, address and social media links;
• opening hours and spoken languages;
• ratings and reviews from users.

Profile changes may be reviewed by an Urday administrator before they are published. Please only publish information you want to make public. The legal basis is Art. 6(1)(b) GDPR.

Cookies are small text files that are stored in your browser. Similar technologies include the browser's local storage. We currently use the following:

Necessary cookies and storage

• Next-Locale – stores your selected language. Session cookie.
• next-auth.csrf-token – protects login requests against cross-site request forgery. Session cookie.
• next-auth.callback-url – remembers the page to return to after logging in. Session cookie.
• next-auth.session-token – keeps you logged in after logging in with Google or Facebook; currently valid for up to 24 hours.
• next-auth.state and next-auth.pkce.code_verifier – secure the login process with Google or Facebook; valid for 15 minutes.
• Local storage – stores your login session and user data when you log in with email and password, as well as notifications and temporary selections within the platform.

The legal basis for these cookies is § 25(2) No. 2 TDDDG and Art. 6(1)(b) and (f) GDPR.

Stripe

We use the payment service provider Stripe for payment functions. The Stripe.js script is only loaded when you open a payment form on Urday. Stripe then sets the cookies __stripe_mid (validity 1 year) and __stripe_sid (validity 30 minutes) for fraud prevention and may set further cookies on Stripe's own domains. In doing so, data such as your IP address and information about your browser and device is transmitted to Stripe. The legal basis is § 25(2) No. 2 TDDDG and Art. 6(1)(f) GDPR; our legitimate interest is secure payment processing and the prevention of payment fraud. Stripe's privacy policy: https://stripe.com/privacy.

Web analytics (Umami)

To understand how our website is used, we use a self-hosted instance of the open-source analytics software Umami, which runs on the server analytics.selimsalman.de. Umami does not set cookies. When you visit a page, information such as the page visited, the referring website, browser, operating system, device type, screen size, language and the country derived from your IP address is transmitted to this server. We use the results only in aggregated form. The legal basis is Art. 6(1)(f) GDPR; our legitimate interest is the analysis and improvement of our website.

We do not use Google Analytics or the Meta (Facebook) Pixel.

You can delete cookies and local storage at any time in your browser settings and configure your browser to block cookies. If you block necessary cookies, some functions, such as logging in, may no longer work.

We do not sell your personal data. We only pass on data where this is necessary for the purposes described in this policy. Recipients may include:

• Hosting provider: our website, database and backend services run on servers operated by a hosting provider on our behalf.
• Google: for login with a Google account (see section 5).
• Meta (Facebook): for login with a Facebook account (see section 5).
• Stripe: for payment functions and fraud prevention (see section 7). Payment details you enter in the Stripe payment form, such as card data, are transmitted directly to Stripe; we do not store them. If you receive payouts as a service provider, Stripe processes the data required for onboarding and payouts.
• Cloudinary: for storing and delivering images uploaded to Urday, such as profile pictures, logos and gallery images.
• Email service provider: for sending emails, such as email verification, password reset, booking notifications and messages from the contact form.
• Umami analytics server (analytics.selimsalman.de): for reach measurement (see section 7).
• Providers of event and image content: some events and articles contain images that are loaded directly from third-party servers (for example image hosting or content delivery services of our partners). When these images are displayed, your browser connects to those servers and transmits your IP address.
• Other users: the content of your public provider profile, your public reviews and the chat messages you send are visible to the respective recipients.
• Authorities: where we are legally obliged to do so.

Where service providers process personal data on our behalf, they do so on the basis of our instructions.

If you click on a link to an external website (for example the website of an event organiser), the privacy policy of that website applies.

Your data is stored in our database and on the systems of the service providers named in section 8. We use technical and organisational measures to protect your data against loss, misuse and unauthorised access. These include encrypted transmission via HTTPS, storing passwords only in hashed form, and access restrictions for administrative functions.

Please note that no transmission over the internet is completely secure. Keep your login details confidential.

We store personal data only for as long as it is required for the respective purpose. Account and profile data is generally stored for as long as your account exists. When your account is deleted, we erase your personal data unless statutory retention obligations (for example under commercial or tax law) require us to keep certain data; such data is restricted and erased once the retention period expires.

Messages you send us are stored for as long as needed to handle your enquiry. Technical data and cookies are stored for the periods stated in sections 5 and 7 or for as long as necessary for security purposes.

You have the following rights regarding your personal data:

• Right of access (Art. 15 GDPR)
• Right to rectification (Art. 16 GDPR)
• Right to erasure (Art. 17 GDPR)
• Right to restriction of processing (Art. 18 GDPR)
• Right to data portability (Art. 20 GDPR)
• Right to object to processing based on Art. 6(1)(f) GDPR for reasons arising from your particular situation (Art. 21 GDPR)
• Right to withdraw consent at any time with effect for the future (Art. 7(3) GDPR)

To exercise your rights, please contact us at info@eleventures.ai.

You also have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR). The authority responsible for us is the State Commissioner for Data Protection and Freedom of Information of North Rhine-Westphalia (LDI NRW), Kavalleriestraße 2–4, 40213 Düsseldorf, Germany.

You cannot currently delete your Urday account yourself. Account deletion is carried out by an authorised Urday administrator. To have your account and the associated personal data deleted, please proceed as follows:

1. Send an email to info@eleventures.ai.
2. Use the subject: "Urday Data Deletion Request".
3. State the email address associated with your Urday account.
4. If you use or used Facebook Login, please mention this in your email.
5. An authorised administrator verifies your request and carries out the deletion. We may contact you to confirm that the request comes from the account holder.
6. Your data is erased in accordance with the GDPR, subject to applicable statutory retention obligations.

When your account is deleted, your public provider profile is also removed from Urday. Independently of this, you can remove Urday's access to your Google or Facebook account at any time in the settings of the respective account.

Some of the service providers we use (for example Google, Meta, Stripe and Cloudinary) belong to groups of companies based outside the European Union or the European Economic Area, in particular in the USA. Personal data may therefore be transferred to third countries.

Such transfers take place only in accordance with Art. 44 et seq. GDPR, for example on the basis of an adequacy decision of the European Commission (such as the EU-U.S. Data Privacy Framework for certified companies) or standard contractual clauses.

Urday is not intended for children under the age of 16. We do not knowingly collect personal data from children under 16. If you believe that a child has provided us with personal data, please contact us at info@eleventures.ai so that we can delete it.

We may update this Privacy Policy if our services or the legal requirements change. The current version is always available on this page; the date of the last update is shown at the top.

If you have any questions about data protection at Urday, please contact us: