Privacy Policy

The following information provides an overview of what happens to your personal data when you use Eclipse Chaser Log. Personal data is any data that can be used to identify you personally. This privacy policy explains which data we collect, how we use it and which rights you have. It is based in particular on the requirements of the EU General Data Protection Regulation (GDPR).

We take the protection of your personal data very seriously. We treat your data confidentially and in accordance with the statutory data protection regulations and this privacy policy.

1. Controller

The controller responsible for data processing on this website within the meaning of the GDPR is:

Andreas Möller
Ernst-Reinke-Str. 3
10369 Berlin
Germany

E-mail: moeller@high-iso.de

The controller is the natural or legal person who alone or jointly with others decides on the purposes and means of processing personal data.

2. Hosting and infrastructure

Eclipse Chaser Log is operated on the cloud infrastructure of Amazon Web Services (AWS), provided by Amazon Web Services, Inc., 410 Terry Avenue North, Seattle, WA 98109, USA. We use AWS services for authentication (Amazon Cognito), data storage (Amazon DynamoDB), file storage and content delivery (Amazon S3 and Amazon CloudFront), application logic (AWS Lambda and Amazon API Gateway) and the sending of system e-mails such as confirmation and password-reset messages (Amazon SES).

When you access the website, our infrastructure automatically collects and stores technical information that your browser transmits, such as your IP address, the date and time of the request, the requested resource and the browser and operating system used. This data is required to deliver the website, to guarantee its stability and security, and cannot be assigned to specific persons by us. The legal basis is our legitimate interest in the secure and reliable operation of our services (Art. 6 (1) (f) GDPR).

We have concluded a data processing agreement (DPA) with AWS in accordance with Art. 28 GDPR, in which AWS undertakes to process the data of our users only in accordance with our instructions and to comply with the requirements of the GDPR.

3. Data transfer to third countries

Our AWS infrastructure processes and stores data in the AWS region US East (N. Virginia, us-east-1) in the United States of America. This means that your personal data is transferred to and processed in a third country outside the European Union and the European Economic Area.

The transfer takes place on the basis of the Standard Contractual Clauses of the European Commission (Art. 46 (2) (c) GDPR) and, where applicable, the EU-U.S. Data Privacy Framework, which are intended to ensure an adequate level of data protection. Please note that in third countries an equivalent level of data protection to that within the EU cannot be fully guaranteed and that authorities in these countries may be granted access to the data under certain circumstances.

4. Cookies and local storage

Eclipse Chaser Log does not use cookies or local storage for tracking, advertising or web-analytics purposes. We only store information in your browser that is technically necessary to provide the functions of the service.

When you sign in, the authentication service Amazon Cognito stores session information (access, ID and refresh tokens) in the local storage of your browser. These tokens are required to keep you signed in and to authorise your requests. They are removed when you sign out.

In addition, we store your selected display language in your browser in order to show the website in the correct language on your next visit. The legal basis for this technically necessary storage is our legitimate interest in a functional website (Art. 6 (1) (f) GDPR) and, where the storage is strictly necessary to provide a service you requested, the performance of a contract (Art. 6 (1) (b) GDPR).

5. User account and authentication

To use the personalised functions of Eclipse Chaser Log, you can create a user account. Registration, sign-in and account management are handled by Amazon Cognito. When you register, we collect your e-mail address and a password of your choice. Your e-mail address serves as your user name and is used to verify your account and to enable password resets.

For security reasons, your password is not stored in plain text; it is managed exclusively by Amazon Cognito in an encrypted form. We use your e-mail address to send you system messages that are necessary to operate your account, such as the confirmation code for registration and password-reset messages.

The processing of this data is carried out for the purpose of providing your user account and is based on the performance of a contract or pre-contractual measures (Art. 6 (1) (b) GDPR).

6. Profile data

As part of your profile you provide your first name, last name and nationality. You can optionally upload a profile picture. This information is stored to identify you within the community and to display your eclipse observations together with your name.

Profile pictures are cropped in your browser, uploaded to Amazon S3 and delivered via the content delivery network Amazon CloudFront (cdn.eclipse-chaser-log.com). You can delete your profile picture again at any time in the user center.

The processing of your profile data is based on the performance of a contract (Art. 6 (1) (b) GDPR) and, in the case of the optional profile picture, on your consent (Art. 6 (1) (a) GDPR), which you give by uploading the picture and which you can withdraw at any time by deleting it.

7. Eclipse observation logs

The core function of Eclipse Chaser Log is to record the solar eclipses you have observed. For each observation you can store the date, the observation location as geographic coordinates (latitude, longitude and elevation), the country, the type of eclipse, the weather conditions, the means of transport used to reach the location, whether the observation was successful and a free-text comment.

Please note that the geographic coordinates you enter can reveal your location at a specific point in time and that a free-text comment may contain further personal information. Please only enter data that you are willing to make available.

The processing of your eclipse observations is based on the performance of a contract (Art. 6 (1) (b) GDPR). It serves the purpose of providing the logging function you requested and calculating your personal statistics, such as the total time spent in the shadow of the moon.

8. Publicly visible data

Eclipse Chaser Log is a community platform. Please be aware that certain data is publicly accessible and can be viewed by any visitor without signing in, as well as retrieved via our public interface (API).

This publicly visible data includes your first name, last name, nationality, profile picture and your eclipse statistics, as well as your individual eclipse observations including the observation coordinates, weather, means of transport and comments. Public search engines may also index this information. If you do not wish certain data to be publicly visible, please do not enter it or delete it from your profile.

9. Google Maps

We use the map service Google Maps to display eclipse paths and observation locations on interactive maps. The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland ("Google").

To display the map content, your browser establishes a direct connection to Google's servers. In doing so, Google receives the information that you have accessed the corresponding page of our website, including your IP address. This data may be transferred to servers of Google LLC in the United States. We have no influence on this data transmission.

The use of Google Maps serves the appealing presentation of our online offering and makes it easier to find the locations we indicate. This constitutes a legitimate interest within the meaning of Art. 6 (1) (f) GDPR. Further information on the handling of user data can be found in Google's privacy policy at https://policies.google.com/privacy.

10. Data retention

We store your personal data only for as long as it is necessary for the purposes for which it was collected, in particular for as long as you maintain your user account. Temporary files created during a profile-picture upload are automatically deleted after processing.

If you request the deletion of your account, we will delete your personal data, unless statutory retention obligations require otherwise. Data that you have made publicly available may remain visible in caches of third parties, such as search engines, for a certain period after deletion, over which we have no influence.

11. Your rights

Under the GDPR you have the following rights with regard to your personal data:

  • Right of access (Art. 15 GDPR): You have the right to obtain information about the personal data we store about you.
  • Right to rectification (Art. 16 GDPR): You have the right to request the correction of inaccurate or incomplete data.
  • Right to erasure (Art. 17 GDPR): You have the right to request the deletion of your personal data.
  • Right to restriction of processing (Art. 18 GDPR): You have the right to request the restriction of the processing of your data.
  • Right to data portability (Art. 20 GDPR): You have the right to receive your data in a structured, commonly used and machine-readable format.
  • Right to object (Art. 21 GDPR): You have the right to object to the processing of your personal data that is based on our legitimate interests.
  • Right to withdraw consent (Art. 7 (3) GDPR): Where processing is based on your consent, you may withdraw that consent at any time with effect for the future.

To exercise your rights, or if you have any questions about the processing of your personal data, you can contact us at any time using the contact details provided in the "Controller" section above.

12. Right to lodge a complaint

Without prejudice to any other administrative or judicial remedy, you have the right to lodge a complaint with a data protection supervisory authority if you believe that the processing of your personal data infringes the GDPR (Art. 77 GDPR).

The supervisory authority responsible for us is the Berlin Commissioner for Data Protection and Freedom of Information (Berliner Beauftragte für Datenschutz und Informationsfreiheit). You may also contact the supervisory authority in your usual place of residence, place of work or place of the alleged infringement.

13. Data security

We use appropriate technical and organisational measures to protect your data against accidental or intentional manipulation, loss, destruction or unauthorised access. All data transmitted between your browser and our servers is encrypted using the industry-standard TLS (Transport Layer Security) protocol, recognisable by the "https://" prefix and the lock symbol in your browser's address bar. Our security measures are continuously improved in line with technological developments.

14. Changes to this privacy policy

We reserve the right to amend this privacy policy so that it always complies with the current legal requirements or in order to reflect changes to our services, for example when introducing new functions. The version published on this page applies to your renewed use of the service.