Privacy policy

The controller under the GDPR is the provider named in the imprint: Paul Dellert, Am Bauershof 11, 96224 Burgkunstadt, Germany, info@kavolu.com.

When you open the site, the hosting provider automatically processes access data: IP address, date and time, the address requested, volume transferred, referrer and browser identification.

The legal basis is Art. 6(1)(f) GDPR; the legitimate interest is the secure and reliable operation of the site. Hosting provider: Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany, with whom a data processing agreement under Art. 28 GDPR is in place; the servers are located in Germany. Retention: 7 days, after which the logs are deleted automatically.

An account is optional; the site works fully without one. Anyone who creates one provides a first and last name, an email address and a password, and optionally a phone number and a preferred departure point. We also store when the account was created and when it was last changed.

The password is never stored in the clear. What is stored is an scrypt hash with a random salt, which we cannot read either.

The legal basis is Art. 6(1)(b) GDPR: the processing is necessary to provide the account you asked for. The data is kept for as long as the account exists. You can delete it yourself at any time under “My account → Profile”, which removes all associated data, sign-ins and outstanding confirmation links.

To register, to confirm a changed address and to reset a password we send emails containing a single-use link. Those links are stored as a hash only and expire after one hour (password) or 24 hours (address confirmation). They are sent from the mailbox service@kavolu.com at united-domains GmbH, Gautinger Straße 10, 82319 Starnberg, Germany, with whom a data processing agreement under Art. 28 GDPR is in place.

To make attacks on other people's accounts harder, we record failed sign-in and registration attempts together with the email address and the IP address. Those entries are deleted once they are more than an hour old; the clean-up runs every five minutes, whether or not the site is being used. Expired sign-ins and lapsed confirmation links are removed in the same pass. The legal basis is Art. 6(1)(f) GDPR; the legitimate interest is protecting our users' accounts.

Account data lives in a database file on the same server in Germany that serves the site (Hetzner Online GmbH). It is not passed on to anyone.

Once you sign in we set two cookies. “kavolu_session” holds a random string by which your sign-in is recognised and cannot be read by scripts on the page. “kavolu_konto” holds nothing but the value “1” and exists only so the header can show “My account” instead of “Sign in”; it contains no name, no address and no identifier.

Both are strictly necessary to provide the sign-in you asked for. No consent is therefore required for them under § 25(2) no. 2 TDDDG, and the processing that follows rests on Art. 6(1)(b) GDPR.

Without “stay signed in” both are deleted when you close the browser, and after 12 hours at the latest. With it they last 90 days. Signing out deletes them immediately.

Apart from the two cookies described under “Sign-in cookies”, kavolu.com sets no cookies and embeds no analytics, advertising or social media services. No profiling takes place.

Filter settings are passed in the address bar (URL) only and are never stored on your device.

Fonts are served from our own server together with the page. There is no connection to Google Fonts or any other third-party provider.

Prices and bookings do not happen on kavolu.com. The booking button takes you off this site and onto the website of the operator concerned (for example BlaBlaCar Bus or FlixBus), whose privacy policy applies from that point on.

The link carries the chosen route and, where you have entered them, the travel day and the number of passengers, so that the operator can fill them in for you. As with any link, your browser sends its identification to the destination; we suppress the address of the referring page (rel="noreferrer"). We transmit nothing else and receive no notice from the operator of whether you book.

We currently take part in no partner or affiliate programme. Should that change, we will extend this section beforehand with the network involved, the cookies set and the legal basis.

You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction (Art. 18), data portability (Art. 20) and objection (Art. 21).

You may also lodge a complaint with a data protection supervisory authority. The authority responsible for us is the Bavarian Data Protection Authority (BayLDA), Promenade 27, 91522 Ansbach, Germany.