Our website address is: https://www.eisenbahnarchiv.de.

If you use our services—whether you register with us for a fee and create a user account, subscribe to our newsletter, or contact us via the contact form—and accept our Privacy Policy by clicking on it in each case, the following provisions regarding data collection, processing, and use, as set forth in our Privacy Policy, apply.

Data Processing Agreement with netcup GmbH

When you visit this website, personal data is processed. The categories of data processed include: technical connection data related to server access (IP address, date, time, page accessed, browser information). Purpose of processing: monitoring technical functionality and enhancing the operational security of our web server, delivering and making the website available, and anonymizing and compiling statistics. The legal basis for processing: a legitimate interest that outweighs the rights and freedoms of the data subjects (Art. 6(1)(f) GDPR). Legitimate interests in this context: a strong economic interest in the secure and functional operation of the technical systems. Data is transferred to: the data processor netcup GmbH, Daimlerstraße 25, 76185 Karlsruhe, Germany.

Data Processing Agreement with CleanTalk Inc.

We use the CleanTalk spam protection service on our website, provided by CleanTalk Inc., 711 S Carson St, Suite 4, Carson City, NV 89701, USA. Purpose: The service analyzes form submissions (e.g., in contact forms or comment sections) to detect and block automated spam attacks. In doing so, data such as your IP address, email address, and the text you entered are temporarily transmitted to CleanTalk’s servers and analyzed there. Legal basis: Processing is based on our legitimate interest pursuant to Art. 6(1)(f) GDPR to protect our website from misuse, malware, and spam. Data transfer (USA): Data processing takes place on servers in the USA. We have entered into a Data Processing Agreement (DPA) and Standard Contractual Clauses (SCCs) with CleanTalk to ensure an adequate level of data protection. The data is anonymized or deleted after analysis. Further information on data processing can be found in CleanTalk’s privacy policy at: cleantalk.org.

Use of Nextcloud (Hetzner)

For internal collaboration, data storage, and document management, we use a Nextcloud instance hosted by Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany. The processing of your data (e.g., username, email address, uploaded files) is based on our legitimate interest in the efficient and secure organization of our workflows (Art. 6(1)(f) GDPR) or for the performance of a contract (Art. 6(1)(b) GDPR).
To protect your data, we have entered into a data processing agreement (DPA) with Hetzner in accordance with Article 28 of the GDPR.

SSL or TLS encryption

This site uses SSL or TLS encryption for security reasons and to protect the transmission of confidential information, such as orders or inquiries that you send to us as the site operator. You can recognize an encrypted connection by the fact that the address bar of your browser changes from “http://” to “https://” and by the lock icon in your browser bar.

When SSL or TLS encryption is enabled, the data you transmit to us cannot be read by third parties.

Privacy Policy

We collect, process, store, and use personal data only when it is necessary to provide our services or offerings. We regularly review and update our security measures to prevent any form of manipulation, destruction, or unauthorized access to personal data.

We may only collect, process, and use personal data or disclose it to third parties with your consent.

Your consent is given either in writing or by actively clicking on a corresponding declaration or by actively opening a paid user account.

We will only disclose data to third parties if we are legally obligated to do so based on enforceable official or court orders, or if we suspect that our offers and services are being misused.

We assure you that your data will be handled in accordance with applicable data protection laws and regulations. Under no circumstances will we disclose personal data to third parties.

Personal Data

You voluntarily provide us with personal data—such as your name (first and last name, nickname), address, email address, etc.—when you register your user account, place an order, submit an inquiry, fulfill a contract, or use other services such as our newsletter. Without this information, we would not be able to provide our services.

You may view, correct, delete, or block the personal data we hold at any time, or withdraw your consent to its use.

Depending on the service you request, different types of data will be collected:

a) Paid registration for the website:
First name, last name, username, and email address are required. Acceptance of the Terms and Conditions, the exclusion of the right of withdrawal for digital products, and the Privacy Policy are required. The following information is also collected: date of registration, payment ID, number of logins, and date of last login.
Your login data will be deleted no later than four weeks after your paid registration expires.

b) Newsletter subscription:
To do this, we need your email address as well as information that allows us to verify that you are the owner of the email address provided and that you consent to receiving the newsletter.

To ensure that newsletters are sent with the recipient’s consent, we use the double opt-in process. As part of this process, the potential recipient is added to a mailing list. The user then receives a confirmation email, which allows them to confirm their subscription in a legally compliant manner. The email address is only added to the mailing list once this confirmation has been received.

We use this information solely to send you the requested information and quotes.

We do not use any external service providers, such as Sendinblue GmbH, for our newsletter software. Your data remains with us.

You may revoke your consent to the storage of your data and email address, as well as their use for sending the newsletter, at any time—for example, by clicking the “Unsubscribe” link in the newsletter.

Data protection measures are subject to constant technical updates; for this reason, we ask that you review our Privacy Policy periodically to stay informed about our data protection practices.

Emails containing promotional information about our services and offers are sent only with the user’s express consent.
Users may opt out of receiving newsletters or statistical tracking at any time. An option to opt out is included in every email. We are required to log subscriptions in order to verify proper registration. After you unsubscribe from our newsletter, your data will be stored for four weeks before being completely deleted.

c) Orders from the online archive (e.g., photos):
First name, last name, and email address are required fields; users may also voluntarily provide their ZIP code, city, street address, and phone number. Consent to the Terms and Conditions, a waiver of the right of withdrawal for digital products, and acceptance of the Privacy Policy are required.
The retention period is 10 years, as it is based on commercial and tax law retention periods.

d) Email inquiries:
Name, email address, subject line, and message. Consent to the Privacy Policy is required. Your email address will be used solely to respond to your inquiry and not for promotional purposes.

Information that you send to us unencrypted via electronic mail (email) may potentially be read by third parties during transmission. We are generally unable to verify your identity and do not know who is behind an email address. Legally secure communication via email is therefore not guaranteed. We use filters against unsolicited advertising (“spam filters”), which in rare cases may mistakenly classify normal emails as unsolicited advertising and delete them automatically. Emails containing malicious programs (“viruses”) are also automatically deleted by us. The retention period is four weeks.

e) Accessing our website:
When you access this or other websites, your web browser transmits data to our web server, which is located within the European Union. The following data is recorded during an active connection for communication between your web browser and our web server:

Date and time of the request
Full IP address of the requesting computer
Name of the requested page
Page from which the file was requested

For technical security reasons, particularly to prevent attempted attacks on our web server, we store this data for four weeks. We will only compare this data with other databases or disclose it to third parties—even in part—if we are legally required to do so by enforceable official or court orders, or if we suspect that our offerings and services are being misused.

f) Registration for events:
Name, email address, first and last names of any additional people you have listed for whom you are registering, as well as the message you entered in the registration form. Consent to the Privacy Policy is required. Your email address will be used solely for registration for the respective event series and not for promotional purposes.

Information that you send to us unencrypted via electronic mail (email) may potentially be read by third parties during transmission. We are generally unable to verify your identity and do not know who is behind an email address. Legally secure communication via email is therefore not guaranteed. We use filters against unsolicited advertising (“spam filters”), which in rare cases may mistakenly classify normal emails as unsolicited advertising and delete them automatically. Emails containing malicious programs (“viruses”) are also automatically deleted by us.

The retention period begins when you register and ends two weeks after the event takes place.

g) Our YouTube channel
Simply by visiting the YouTube page, personal data—such as the visitor’s IP address, operating system, language settings, location, and browser—may be transmitted to YouTube. Please note that we have no knowledge of the content of the data transmitted or how YouTube uses it. For more information, please refer to YouTube’s Privacy Policy at: https://policies.google.com/privacy (external link, opens in a new tab)
The provider is headquartered in the United States. The European Commission has adopted an adequacy decision classifying the United States as a safe third country (EU-U.S. Data Privacy Framework), without requiring further appropriate safeguards such as standard contractual clauses or additional measures. The provider is certified under the Data Privacy Framework.
The transfer of data via links on our website is based on YouTube’s Data Processing Terms, effective as of November 24, 2020.

Duration of storage

Unless otherwise specified in this Privacy Policy, personal data provided to us via our website will be stored only until the purpose for which it was provided has been fulfilled. Where commercial and tax law retention periods must be observed, certain data may be stored for up to 10 years.

Cookies

We use cookies in your browser to collect usage data automatically, such as to generate general statistics on the use of our website, to record the time of your visit, and to track the information you enter on our website. This is always done without collecting personal data such as your name, address, or email address. Cookies allow us to save the settings you choose on our site and to analyze general usage patterns.

If you wish to block cookies, you can do so in your browser settings. However, you will not be able to use some of our services if you delete cookies or choose to block or disable them. This applies to the following features of our website: logging in, downloading content, and subscribing to the newsletter.

You can find instructions on how to manage cookies here: Firefox, Chrome, Internet Explorer, Safari for Mac, and Safari for iOS.

Cookie validity: The cookie is valid for a period of 1 day.

The basis for the use of cookies is the technical necessity of using an analytics tool, whereby the data remains with us and is not shared with the analytics tool provider.

Here you can find our Cookie-Policy (EU).

Server log files

The website provider automatically collects and stores information in so-called server log files, which your browser automatically transmits to us. This information includes:

Browser type and version
Operating system used
Referrer URL
Hostname of the accessing computer
Time of the server request
IP address

This data is not combined with other data sources.

This data is collected on the basis of Article 6(1)(f) of the GDPR. The website operator has a legitimate interest in ensuring that the website functions properly and in optimizing it—to this end, server log files must be collected.

Google Web Fonts (Local Hosting)

This site uses so-called web fonts provided by Google to ensure consistent font display. To protect your privacy, we install and load these Google Fonts exclusively locally on our own web server. When you visit our website, no connection is made to Google’s servers. Consequently, no data (such as your IP address) is transmitted to or stored by Google. The use of these fonts is based on our legitimate interest in ensuring an appealing, consistent, and technically flawless presentation of our online content in accordance with Article 6(1)(f) of the GDPR.

Translated with DeepL.com (free version)

Social media buttons with privacy protection (Shariff)

Our website uses social media plugins (e.g., Facebook, Twitter, LinkedIn).

You can usually identify the plugins by the respective social media logos. To ensure data protection on our website, we use these plugins only in conjunction with the “Shariff” solution. This application prevents the plugins integrated into our website from transmitting data to the respective provider the moment you visit the site.

A direct connection to the provider’s server is established only when you activate the respective plugin by clicking the corresponding button (consent). As soon as you activate the plugin, the respective provider receives the information that you have visited our site using your IP address. If you are logged into your respective social media account (e.g., Facebook) at the same time, the respective provider can associate your visit to our site with your user account.

Activating the plugin constitutes consent within the meaning of Article 6(1)(a) of the GDPR. You may revoke this consent at any time with future effect.

The use of social media plugins is based on Article 6(1)(f) of the GDPR. The website operator has a legitimate interest in achieving the widest possible visibility on social media.

An initiative by heise.de for the “Shariff” click method (further information on the content and technical details)

Facebook Plugins (Like & Share Buttons)

Our website incorporates plugins from the social network Facebook, provided by Facebook Inc., 1 Hacker Way, Menlo Park, California 94025, USA. You can recognize the Facebook plugins by the Facebook logo or the “Like” button on our site. You can find an overview of the Facebook plugins here: https://developers.facebook.com/docs/plugins/?locale=de_DE.

When you visit our pages, the plugin only establishes a direct connection between your browser and the Facebook server if you are logged into your Facebook account AND click the “Like” button. This informs Facebook that you have visited our site using your IP address. If you click the Facebook “Like” button while logged into your Facebook account, you can link the content of our pages to your Facebook profile. This allows Facebook to associate your visit to our pages with your user account. Please note that, as the provider of these pages, we have no knowledge of the content of the data transmitted or how it is used by Facebook. For more information, please refer to Facebook’s Privacy Policy at: https://de-de.facebook.com/privacy/explanation.

If you do not want Facebook to associate your visit to our site with your Facebook account, please log out of your Facebook account.

X – Plugins

Our website incorporates plugins from the X Corp. (“X”) microblogging network. You can recognize the X plugins by the X-logo on our site.

When you visit a page on our website that contains such a plugin, a direct connection between your browser and the X server is established only if you are logged into your X account AND click the X-button. This informs X that you have visited our site using your IP address. If you click the X-button while logged into your X account, you can link the content of our pages to your X profile. This allows X to associate your visit to our pages with your user account. Please note that, as the provider of these pages, we have no knowledge of the content of the data transmitted or how it is used by X.

If you do not want X to be able to track your visit to our site, please log out of your X account.

For more information, please see X Privacy Policy: https://privacy.x.com/en

LinkedIn Plugin

Our website uses features provided by LinkedIn. The provider is LinkedIn Corporation, 2029 Stierlin Court, Mountain View, CA 94043, USA.

Every time you visit one of our pages that includes LinkedIn features, a connection to LinkedIn’s servers is established only if you are logged into your LinkedIn account AND click the “Recommend” button. LinkedIn is informed that you have visited our website using your IP address. If you click the LinkedIn “Recommend” button while logged into your LinkedIn account, LinkedIn is able to associate your visit to our website with you and your user account. Please note that, as the provider of these pages, we have no knowledge of the content of the data transmitted or its use by LinkedIn.

If you do not want LinkedIn to be able to track your visit to our site, please log out of your LinkedIn account.

For more information, please see LinkedIn’s Privacy Policy at: https://www.linkedin.com/legal/privacy-policy.

Good to know

The data controller is www.eisenbahnarchiv.de GmbH, Hauptstr. 35, 91174 Spalt, represented by its managing director, Andreas Ehrlich.

• If you have any questions regarding the collection, processing, or use of your personal data, or regarding the correction, restriction, or erasure of such data, or the withdrawal of consent you have provided, you may contact us at any time. We will respond to all reasonable requests promptly and free of charge in accordance with applicable law.

• You have the right to have incorrect data corrected or personal data deleted, provided that no legal retention obligation precludes this right.

• This Privacy Policy is updated on an ongoing basis; we will publish any changes on this page in a timely manner. To stay informed about the current status, you should visit this page regularly.

• This Privacy Policy applies exclusively to the websites of www.eisenbahnarchiv.de GmbH. If we link to other websites, we have no influence or control over whether other providers comply with data protection regulations.

Printouts for your records

Privacy Policy
Terms and Conditions

Contact Person

If you have any further questions regarding data protection in connection with this website, please contact our Data Protection Officer, Mr. Andreas Ehrlich, at Hauptstr. 35, 91174 Spalt, email: ma**@*************iv.de. Phone: 09175/2919838 (answering machine). Upon request, you will receive information about the data stored regarding your person and may have incorrect data corrected (Art. 10 and 11 of the Bavarian Data Protection Act). Provided the legal requirements are met, you may also request that the stored data be blocked or deleted (Art. 12 of the Bavarian Data Protection Act). Further information on data protection can also be found on the website of the Bavarian State Commissioner for Data Protection (www.datenschutz-bayern.de).

As of July 3, 2026 www.eisenbahnarchiv.de GmbH, Signed, Andreas Ehrlich