DIELITHOTHEK

Legal

Privacy policy

Courtesy translation. Only the German version of this page is legally binding (Die deutsche Fassung ist maßgeblich).

1. Controller

The controller within the meaning of the General Data Protection Regulation (GDPR) is:
Die Lithothek gGmbH, represented by its managing director Matthias Fieser
Am Brunnen 18
85551 Kirchheim
Germany
Telephone: 089 28934873
Telephone (Stufenheim): 089 90198102
Email: info@die-lithothek.de

2. General information on data processing

Protecting your personal data is important to us. We process personal data only within the framework of the statutory provisions (GDPR, the German Federal Data Protection Act (BDSG) and the German Telecommunications Digital Services Data Protection Act (TDDDG)). This website does not set cookies, does not store anything in your browser and does not use any analytics or tracking tools. Fonts, scripts and the images of the pages are loaded from our own servers, not from third-party providers. There are no embedded maps, videos or social media content.

3. Hosting and server log files

This website and our collection database run on a rented server (virtual server) operated by Hostinger International Ltd., 61 Lordou Vironos Street, 6023 Larnaca, Cyprus. The server is located in a data centre in Germany. We operate the server ourselves; Hostinger provides the hardware, the data centre and the network connection and also makes weekly backup copies of the entire server.

When you visit the website and when collection data is loaded (see section 4), our web server automatically stores access data in log files (server log files): IP address in shortened form, date and time, the address requested including the search and filter details it contains, HTTP status code, the amount of data transferred, the page visited before (referrer, where your browser sends it) and the browser and operating system (user agent). We need this data to deliver the website, to find errors and to detect and repel attacks. The data is not combined with other data sources. Without this data your browser cannot technically retrieve the website; there is no statutory or contractual obligation to provide it.

We store the IP address in the log files only in shortened form: for IPv4 addresses the last of the four number blocks is set to zero (203.0.113.77 becomes 203.0.113.0), for IPv6 addresses only the first 48 bits are kept. The server processes the full address to answer your request; it is not written to the log files.

We delete the log files automatically after 14 days at the latest. Until then they may also be contained in the weekly backup copy of the server at Hostinger, until that copy is replaced.

The legal basis is our legitimate interest in providing the website securely and in working order (Art. 6(1)(f) GDPR). We have a data processing agreement with Hostinger (Art. 28 GDPR), which forms part of Hostinger's terms of service. Hostinger in turn uses further service providers, including companies based in the USA. Where personal data is transferred to a country outside the EU in the process, this takes place on the basis of the EU Commission's standard contractual clauses (Art. 46(2)(c) GDPR).

4. Collection data and images from our database

The “Collection” pages, the individual specimen pages and the key figures on the “About us” page load their content directly in your browser from our collection database at daten.die-lithothek.de when you open them. This also applies to the photographs of the collection specimens. This address belongs to us and runs on the same server (section 3); no third-party provider is involved.

In doing so, your browser transmits the usual technical data (in particular the IP address, the user agent and the address of our website as the origin) as well as your search and filter entries, for example a mineral or locality name you have typed in. These requests are made without logging in and without cookies and are logged as described in section 3. The legal basis is our legitimate interest in making our collection publicly accessible and searchable (Art. 6(1)(f) GDPR).

5. Cookies and tracking

This website does not use cookies, does not store any data in your browser and does not use any services for audience measurement or user tracking. No profiling takes place. A cookie consent banner is therefore not required in the current technical set-up. The choice of language is not stored either: the language switcher is an ordinary link.

Only staff who log in to our collection management system at daten.die-lithothek.de receive a login cookie there. It is strictly necessary for the login (Section 25(2) No. 2 TDDDG) and does not concern visitors to this website.

6. Contact by email or telephone

This website has no contact form. If you contact us by email or telephone, we process your details (e.g. name, email address, content of the message) in order to deal with your enquiry. The legal basis is Art. 6(1)(b) GDPR where a contract or an enquiry about one is concerned, and otherwise our legitimate interest in answering (Art. 6(1)(f) GDPR). We delete the details when they are no longer needed and no statutory retention obligations stand in the way.

Since 25 October 2026 our email mailboxes have been operated by Hostinger International Ltd., 61 Lordou Vironos Street, 6023 Larnaca, Cyprus. We have a data processing agreement with Hostinger (Art. 28 GDPR), which forms part of Hostinger's terms of service and also covers its email services. What is said in section 3 applies to Hostinger's use of further service providers and to transfers to countries outside the EU.

Until the move is complete, older emails are also still held in our previous mailboxes at STRATO GmbH, Otto-Ostrowski-Straße 7, 10249 Berlin. We have a data processing agreement with STRATO (Art. 28 GDPR).

7. Data backup

We back up our database, uploaded files and the collection images daily, in encrypted form, with Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, in a data centre in Germany (Falkenstein). Hetzner cannot read the backed-up data. The log files of the web server (section 3) are not part of this backup. We keep daily copies for 7 days, weekly copies for 4 weeks and monthly copies for 6 months. We have a data processing agreement with Hetzner (Art. 28 GDPR).

8. Names and profiles of people

Profiles. This website publishes profiles of collectors, donors and contributors with their name and, where applicable, a photograph and short biography. We do this only with the consent of the person concerned (Art. 6(1)(a) GDPR), and in the case of deceased persons in agreement with their relatives. Consent can be withdrawn at any time with effect for the future; the profile is then removed.

Names on the pages of the collection. For the collection specimens we name people where this forms part of the documentation of the collection: as the author of a photograph, as the person who identified a mineral, as the collector, and as the person who triggered an event in the history of the specimen (for example a donation, a find, a purchase or an exchange). Names may also appear in the checked descriptions and image captions. We only show the name, never an address, contact details or prices. The information comes from our own collection records, from the details given when a specimen was received and from our former collection database.

Where the person has consented, the legal basis is their consent (Art. 6(1)(a) GDPR); otherwise it is our legitimate interest in documenting the provenance and identification of the specimens of a non-profit, publicly accessible collection in a traceable way (Art. 6(1)(f) GDPR). Naming the author of a photograph is also required by copyright law (Section 13 of the German Copyright Act, UrhG). The names remain visible for as long as the specimen belongs to the collection, or until consent is withdrawn or an objection is made. Anyone who does not wish to be named can tell us so informally at any time (section 11); we will then remove the name from the website, for photographs together with the photograph where necessary. Data of deceased persons is not subject to the GDPR; we nevertheless treat requests from relatives in the same way.

9. Recipients and processors

We do not pass on personal data arising from your visit to this website to third parties. The technical service providers that act on our behalf (processors under Art. 28 GDPR) are:

The names mentioned in section 8 are publicly visible on the website to all visitors.

10. External links

This website contains links to external websites (e.g. Mineralienatlas, mindat.org, where applicable a donation page). When you click such links you leave our website; we have no influence on how the operators of these external sites process data.

11. Your rights as a data subject

Within the framework of the statutory requirements you have the right of access (Art. 15 GDPR), rectification (Art. 16 GDPR), erasure (Art. 17 GDPR), restriction of processing (Art. 18 GDPR) and data portability (Art. 20 GDPR). You can withdraw consent that you have given at any time with effect for the future (Art. 7(3) GDPR).

Right to object (Art. 21 GDPR): Where we process data on the basis of our legitimate interest (Art. 6(1)(f) GDPR, sections 3, 4, 6 and 8), you may object at any time on grounds relating to your particular situation. We will then no longer process the data unless we can demonstrate compelling legitimate grounds that override your interests, or the processing serves the establishment, exercise or defence of legal claims.

To exercise your rights, an informal message to the controller named above is sufficient.

12. Right to lodge a complaint with a supervisory authority

You have the right to lodge a complaint with a data protection supervisory authority about the processing of your personal data (Art. 77 GDPR). The authority responsible for Die Lithothek gGmbH, as a non-public body based in Bavaria, is:

Bavarian State Office for Data Protection Supervision (Bayerisches Landesamt für Datenschutzaufsicht, BayLDA)
Promenade 18
91522 Ansbach
Germany
www.lda.bayern.de

13. Automated decision-making

There is no automated decision-making, including profiling, within the meaning of Art. 22 GDPR.

14. Status of this privacy policy

This privacy policy is current as of October 2026. As the website develops, it may become necessary to amend this privacy policy.