Controller and contact
Josef Holub
goodboards – Josef Holub
Sonnenstraße 2
86949 Windach
Deutschland
Phone: 08193-2849307
E-Mail: info@goodboards.eu
Website delivery and server logs
When you visit, the server processes technical connection data, such as your IP address, time of access, requested address and browser or protocol information sent with the request. Depending on the hosting configuration, this data may be recorded in server logs. This supports secure delivery, reliable operation and troubleshooting. The legal basis is Article 6(1)(f) GDPR, reflecting the legitimate interest in operating a secure, functioning website.
The hosting provider, actual logging and retention arrangements depend on the deployed service. Relevant criteria include security, troubleshooting needs and any applicable legal obligations. Contact the controller above for details of the current hosting provider, the log data actually recorded and the applicable retention periods.
Technical session cookie
When you use forms, the board advisor or the administration login, this website uses its own GOODBOARDSSID session cookie. It connects a request to a server-side session for security tokens against abusive form requests (CSRF), temporarily retained form input and notices, and administration authentication. It is not used for analytics, advertising or cross-site tracking. If a session already exists, the browser may also send the cookie with subsequent page requests.
The cookie contains a session identifier; form input and authentication state are not stored in the cookie itself. Its lifetime is set to the browser session, with no fixed expiry date. Browsers may restore sessions. Ending a browser session does not guarantee deletion of all server-side data. These security and session functions serve the legitimate interest in providing secure, requested functionality under Article 6(1)(f) GDPR.
Inquiries and email
When you submit the inquiry form, the website stores your name, email address, optional phone number, message, selected product and variant if applicable, and the submission time and privacy acknowledgment in its database. If email delivery is enabled, the inquiry is additionally forwarded through the mail service (SMTP) configured by the controller. Failed email delivery does not delete the saved inquiry. Access is available to the controller, authorised staff and the hosting and, where applicable, mail providers used for operation. The application does not send inquiries to advertising or analytics services.
Processing supports answering your request and, where appropriate, pre-contract advice: Article 6(1)(b) GDPR for contract-related requests, or Article 6(1)(f) GDPR based on the interest in responding to your message. Required fields are marked in the form. Inquiries remain stored until the controller deletes them, considering their purpose and applicable legal retention obligations; the application does not impose an automatic general deletion period.
Board advisor and login protection
The board advisor processes riding preferences and shoe-size class, plus optional weight, for the current model and size comparison. The application does not create a permanent personal advisory profile in its database. Details you subsequently include in a submitted inquiry become part of that inquiry. The comparison is for guidance and does not place an order.
To protect against abusive logins, login-attempt times and a value derived from the IP address using a server key are temporarily processed as a technical attempt counter. This security counter is not used for visitor analytics. The legal basis is Article 6(1)(f) GDPR, reflecting the interest in preventing unauthorised access.
Local resources and external links
The website provides its own fonts, scripts, styles, images and icons locally. It does not use its own analytics or marketing services. External websites are contacted when you choose to follow a link. The optional Google maps described below are an exception.
Optional Google map and location search
The dealer finder and test-day pages load Google Maps only after you choose “Activate Google Maps”. This feature makes no connection to Google beforehand. Once activated, data including your IP address, browser and device information and the requested URL may be sent to Google. After map activation, an address search in the dealer or test-day finder sends the entered address to Google’s geocoding service. The website requests your device location only through “Use my location” and the additional browser permission. The dealer finder sends search coordinates to the website server to calculate distances and, while the map is active, to Google to display the location. The nearby test-day finder calculates straight-line distances in the browser; the application does not save the selected location in its database or browser storage. While the map is active, Google processes the selected location to display it.
After activation, the test-day map also sends the saved Google place IDs of the venues to the geocoding service to determine their map positions. This does not require your device location. Activation applies only to the current page; the application does not store it in a cookie, localStorage or sessionStorage. The website does not create a permanent search or location profile. The test-day list remains visible without map activation. Dealers are loaded and displayed only after Google Maps is activated. Reloading the page deactivates the map; this does not recall data already transferred. The optional integration is based on your consent under Article 6(1)(a) GDPR. Google may also process data outside the EU and use its own cookies or similar technologies. Google provides further information about recipients, international processing and retention.
Optional contact through WhatsApp
If a WhatsApp contact number is configured, the website provides plain links to WhatsApp. No WhatsApp widget is embedded and no connection to WhatsApp is made before you open a link. Clicking leaves this website and opens a WhatsApp service. A prepared message can include the public product name, selected variant and its EAN; personal inquiry-form input is not included in the link. You can edit the message before sending it. You can also contact us by inquiry form, email or phone.
Telegram bot and notifications
If the controller enables the Telegram integration and specifies recipients, submitted website inquiries are additionally forwarded through the Telegram Bot API to those authorised recipients. This includes your name, email address, optional phone number, message, selected product and variant, and the inquiry identifier. Telegram processes the transmitted contents. Failed deliveries may remain in a protected queue on the website server so authorised staff can retry them. The inquiry also remains in the website database and is forwarded by email if email delivery is configured.
If you open and start the public bot in Telegram, the website receives the Telegram identifiers and messages supplied to the bot. The interactive board advisor processes your riding preferences and shoe-size class, plus optional weight, as temporary conversation state on the server. This advisory state expires after 48 hours of inactivity; /abbrechen resets the current consultation. Advisor answers are not automatically forwarded to the team as a website inquiry. For nearby test days and dealers, you can explicitly share your location in the private Telegram chat or enter coordinates. The bot also reads the dealer source approved for public display; distances are calculated on the website server. The website processes those coordinates for the current search, does not save them in conversation state and does not forward them to administrators as an inquiry. Result maps and route links show event venues or dealer addresses. Telegram also processes messages and shared locations under its own terms. No external AI service is used for this feature. Merely visiting the website does not contact Telegram through the bot link.
Bot usage is measured through pseudonymous counts of active private chats, messages, button clicks, topics and completed consultations. Statistics cover the last 90 days. Telegram identifiers are transformed using a server key; names, usernames, message content, locations and body or shoe-size answers are not stored in these statistics. Expired statistical data is removed during subsequent bot processing. The results are available only to authorised administrators.
Your rights
Subject to the statutory conditions, you may request access, rectification, erasure, restriction of processing and data portability, and object to processing based on legitimate interests. Contact the controller above to exercise these rights. You may lodge a complaint with a data protection supervisory authority, particularly in the country of your usual residence, workplace or the alleged infringement.