Legal
The German version is legally binding.
In brief: we do not use cookies for analytics or advertising, we do not embed anything from Google or other providers, and in the guest portal we count in a way that makes no one recognisable. That is why there is no consent banner here either.
MyGuideKey GbR, Ralph Maximini and Jürgen Greis
Im Pieter 14, 54331 Oberbillig
kontakt@myguidekey.de ·
+49 (0) 6501 803 4097
Each time a page is accessed, our provider automatically stores information in server log files: date and time, the address accessed, amount of data transferred, browser type and operating system, the previously visited page and the IP address. This data is technically necessary to deliver the page and to detect attacks. The legal basis is our legitimate interest in secure operation, Art. 6(1)(f) of the General Data Protection Regulation (GDPR). This data is not combined with other data.
Our web host is STRATO AG, Pascalstraße 10, 10587 Berlin. It processes this data on our behalf on the basis of a data processing agreement pursuant to Art. 28 GDPR. The servers are located in Germany.
The fonts used are hosted on our own server. No fonts, scripts, maps or videos are loaded from third-party providers. Your IP address is therefore not transmitted to any third party when you visit these pages.
On myguidekey.de/112 you can tap “Poison control for my location” to highlight the poison control number responsible for where you are. Only after this tap does your browser ask whether it may share your location. The coordinates are matched against stored borders exclusively on your device; they are not transmitted to us or to third parties and are not stored. If the page switches country, the address only contains the code of the country and German state (e.g. “land=DE&bl=RP”), no coordinates. The legal basis is your consent via the browser prompt (Art. 6(1)(a) GDPR, § 25(1) TDDDG); you can withdraw it at any time in your browser settings.
Emergency card customers receive a personal code with their delivery note. It unlocks the “My emergency” section on myguidekey.de/112 on up to three devices (emergency contacts with a call button, “Where am I?”, own details to read out).
What we store: For each activation we store the code, a randomly generated device identifier, the device type and browser (e.g. “iPhone · Safari”; derived from the browser’s user agent, which itself is not stored) and the date and time. You then receive an e-mail at the address of your order so that you notice every activation. Your browser keeps the device identifier in your device’s storage; for an installed app it is also part of the app’s start address. At most every twelve hours the page uses this identifier to check with us whether access is still valid. We do not count visits and do not store locations. The legal basis is performance of the contract (Art. 6(1)(b) GDPR); storing the identifier on your device is strictly necessary for the service you requested (Section 25(2) No. 2 TDDDG). We delete released devices and blocked codes after twelve months, and the other access data together with the order data.
What stays on your device only: Your details in “My emergency” (emergency contacts, name, blood group, allergies, medication, notes) are stored exclusively by your browser on your device. They are not transmitted to us or to third parties; we have no access to them. “Where am I?” only requests your location after you tap it, via the browser’s prompt, and merely displays it. Only if you choose “Send location” does your device pass it to the app you select. You can delete the details at any time with “Delete all details” or by clearing the browser data or removing the app. The details are as well protected as your device – please use a screen lock.
If you write to us using the form, we process the information you provide there: name, business (if applicable), email address, phone number (if applicable), your selection under “You are …” and your message. We use it solely to answer your enquiry.
The legal basis is your consent pursuant to Art. 6(1)(a) GDPR and, insofar as the initiation of a contract is concerned, Art. 6(1)(b) GDPR. You may withdraw your consent at any time without any particular form; this does not affect the lawfulness of the processing carried out up to that point.
Your enquiry reaches us as an email. We keep it for as long as necessary to handle it and for any follow-up questions, and then delete it — after three years at the latest, unless statutory retention periods prevent this. To protect against bots, the form uses an invisible field and measures the time until submission. No personal data is transmitted to third parties in the process.
Most of our pages – including the home page, the guest portal and the first-aid page – set no cookies. Only when you open a form (contact, order), sign in to the customer area or arrive via a partner business’s flyer do we set a single, technically necessary session cookie (“mgksid”). It contains only a random identifier and protects the forms against forged requests. If you arrive via a partner business’s flyer, it remembers that business’s promotional code for the duration of your visit so that we can attribute your enquiry to the business. The cookie expires when you close your browser and is not used for analytics or advertising. The legal basis is Section 25(2) no. 2 of the German Telecommunications Digital Services Data Protection Act (§ 25 Abs. 2 Nr. 2 TDDDG) in conjunction with Art. 6(1)(f) GDPR.
If you order key tags or request a quote, we process the information from the order form: company, contact person, address, email address, phone number (if applicable), VAT identification number and order reference, as well as the quantity ordered and your comments. We store this in our database and use it to prepare the quote, perform the contract and issue the invoice. The legal basis is Art. 6(1)(b) GDPR.
We retain invoices and the associated business records for as long as commercial and tax law requires (usually eight to ten years, Art. 6(1)(c) GDPR). Enquiries that do not result in an order are deleted after three years at the latest.
For your emergency card we process the details that are laser-engraved on the card: name, date of birth, blood type, allergies, medication, pre-existing conditions, implants, emergency contacts and references to advance directives. Some of this is health data. We process it only with your explicit consent (Art. 9(2)(a) GDPR) and only to produce the card.
The details are stored encrypted, never sent by e-mail and deleted immediately after the card has been produced. After that, neither we nor third parties have access to them. Until the card is produced you can withdraw your consent at any time by e-mail; we will then delete the details at once. We keep your name, address, e-mail address and order data for as long as commercial and tax law require (Art. 6(1)(b) and (c) GDPR).
If you tick the optional box when ordering, we will send you a single e-mail 12 months later asking you to check your details, with a personal discount code for a new card. For this we use your e-mail address, your name, the order date and the language of the order (Art. 6(1)(a) GDPR). The e-mail contains no health data. You can withdraw your consent at any time – via the link in the e-mail or with a short message to us. After it has been sent, we will not send any further reminders.
Customers log in with their customer number and password. For this purpose, we set a technically necessary session cookie that remembers your login for the duration of your visit and expires when you log out or after a longer period of inactivity. It contains no content and is not used for analytics. The legal basis is Art. 6(1)(b) GDPR in conjunction with § 25 Abs. 2 Nr. 2 TDDDG.
We store passwords exclusively as a cryptographic hash; we do not know them in plain text. To protect against systematic password guessing, we count failed attempts and temporarily lock access.
We keep a log of who changed which configuration and when, and of when we, as the operator, accessed customer data. This serves traceability towards our customers and ourselves. The legal basis is Art. 6(1)(f) GDPR.
As the operator, we have access to all data in the customer area – for example to help with questions, to enter content on request or to fix errors. Only Ralph Maximini and Jürgen Greis have access; every access to a customer’s data is recorded in the log. The legal basis is Art. 6(1)(b) GDPR.
If you have forgotten your password, you can request a link to the e-mail address stored with us. The link is valid for 60 minutes and can be used only once; we only store a hash value of it and delete the requests after 30 days. When entries in the portal expire, we send a reminder by e-mail – at most every 14 days, and it can be switched off in the customer area. The legal basis is Art. 6(1)(b) GDPR.
We keep invoices and the related data for as long as commercial and tax law requires (currently eight years, Section 147 of the German Fiscal Code, Section 257 of the German Commercial Code) – even if a customer account is deleted. The legal basis is Art. 6(1)(c) GDPR.
We process the content that a customer maintains in their portal on the customer’s behalf. If it contains personal data — such as names and phone numbers of contact persons — we conclude a data processing agreement with the customer.
The portal that a guest sees after scanning the QR code requires no login and sets no cookies.
We count page views so that our customers can see whether their key tag is being used. Only the following is stored: the date, the hour, which tile was opened and whether the request came from a phone, a tablet or a computer. No IP address, no cookie, no device identifier. Two visits by the same person cannot be recognised as coming from the same visitor. This does not create any link to an individual; the legal basis for this counting is Art. 6(1)(f) GDPR.
The current temperature is shown in the header of the portal. The guest’s phone itself sends this request to Open-Meteo (Open-Meteo GmbH, Switzerland). In the process, the guest’s IP address is transmitted to this service, together with the name of the town — not the location of the device. The guest’s location is not requested. The legal basis is our legitimate interest in providing useful guest information, Art. 6(1)(f) GDPR. If the service is unavailable, the line remains empty and nothing else changes.
The town name and the associated coordinates are cached in the guest’s browser so that the request does not have to be made again on every visit. This stored data does not leave the device and cannot be read by us.
We do not sell data and do not pass it on for advertising purposes. Data is only transmitted to our web host in the context of data processing on our behalf, to Open-Meteo to the extent described above, and where we are legally obliged to do so.
You have the right of access to the data stored about you (Art. 15 GDPR), to rectification (Art. 16), to erasure (Art. 17), to restriction of processing (Art. 18), to data portability (Art. 20) and to object to processing based on a legitimate interest (Art. 21). You may withdraw any consent you have given at any time.
To do so, simply contact us informally at kontakt@myguidekey.de.
In addition, you have the right to lodge a complaint with a data protection supervisory authority. The authority responsible for us is the Landesbeauftragte für den Datenschutz und die Informationsfreiheit Rheinland-Pfalz (State Commissioner for Data Protection and Freedom of Information of Rhineland-Palatinate), Hintere Bleiche 34, 55116 Mainz.
We update this policy when our services change. The version published here at any given time applies.
Last updated: October 2026
