Controller and contact
Josef Holub
goodboards – Josef Holub
Sonnenstraße 2
86949 Windach
Deutschland
Phone: 08193-2849307
E-Mail: info@goodboards.eu
Website delivery and server logs
When you visit, the server processes technical connection data, such as your IP address, time of access, requested address and browser or protocol information sent with the request. Depending on the hosting configuration, this data may be recorded in server logs. This supports secure delivery, reliable operation and troubleshooting. The legal basis is Article 6(1)(f) GDPR, reflecting the legitimate interest in operating a secure, functioning website.
The hosting provider, actual logging and retention arrangements depend on the deployed service. Relevant criteria include security, troubleshooting needs and any applicable legal obligations. Contact the controller above for details of the current hosting provider, the log data actually recorded and the applicable retention periods.
Technical session cookie
When you use forms, the board advisor or the administration login, this website uses its own GOODBOARDSSID session cookie. It connects a request to a server-side session for security tokens against abusive form requests (CSRF), temporarily retained form input and notices, and administration authentication. It is not used for analytics, advertising or cross-site tracking. If a session already exists, the browser may also send the cookie with subsequent page requests.
The cookie contains a session identifier; form input and authentication state are not stored in the cookie itself. Its lifetime is set to the browser session, with no fixed expiry date. Browsers may restore sessions. Ending a browser session does not guarantee deletion of all server-side data. These security and session functions serve the legitimate interest in providing secure, requested functionality under Article 6(1)(f) GDPR.
Inquiries and email
When you submit the inquiry form, the website stores your name, email address, optional phone number, message, selected product and variant if applicable, and the submission time and privacy acknowledgment in its database. If email delivery is enabled, the inquiry is additionally forwarded through the mail service (SMTP) configured by the controller. Failed email delivery does not delete the saved inquiry. Access is available to the controller, authorised staff and the hosting and, where applicable, mail providers used for operation. The application does not send inquiries to advertising or analytics services.
Processing supports answering your request and, where appropriate, pre-contract advice: Article 6(1)(b) GDPR for contract-related requests, or Article 6(1)(f) GDPR based on the interest in responding to your message. Required fields are marked in the form. Inquiries remain stored until the controller deletes them, considering their purpose and applicable legal retention obligations; the application does not impose an automatic general deletion period.
Board advisor and login protection
The board advisor processes riding preferences and shoe-size class, plus optional weight, for the current model and size comparison. The application does not create a permanent personal advisory profile in its database. Details you subsequently include in a submitted inquiry become part of that inquiry. The comparison is for guidance and does not place an order.
To protect against abusive logins, login-attempt times and a value derived from the IP address using a server key are temporarily processed as a technical attempt counter. This security counter is not used for visitor analytics. The legal basis is Article 6(1)(f) GDPR, reflecting the interest in preventing unauthorised access.
Local resources and external links
The website provides its own fonts, scripts, styles, images and icons locally. It does not use its own analytics or marketing services. External websites are contacted when you choose to follow a link. The optional Google maps described below are an exception.
Optional Google map and location search
The dealer finder and test-day pages load Google Maps only after you choose “Activate Google Maps”. This feature makes no connection to Google beforehand. Once activated, data including your IP address, browser and device information and the requested URL may be sent to Google. After map activation, an address search in the dealer or test-day finder sends the entered address to Google’s geocoding service. The website requests your device location only through “Use my location” and the additional browser permission. The dealer finder sends search coordinates to the website server to calculate distances and, while the map is active, to Google to display the location. The nearby test-day finder calculates straight-line distances in the browser; the application does not save the selected location in its database or browser storage. While the map is active, Google processes the selected location to display it.
After activation, the test-day map also sends the saved Google place IDs of the venues to the geocoding service to determine their map positions. This does not require your device location. Activation applies only to the current page; the application does not store it in a cookie, localStorage or sessionStorage. The website does not create a permanent search or location profile. The test-day list remains visible without map activation. Dealers are loaded and displayed only after Google Maps is activated. Reloading the page deactivates the map; this does not recall data already transferred. The optional integration is based on your consent under Article 6(1)(a) GDPR. Google may also process data outside the EU and use its own cookies or similar technologies. Google provides further information about recipients, international processing and retention.
Optional contact through WhatsApp
If a WhatsApp contact number is configured, the website provides plain links to WhatsApp. No WhatsApp widget is embedded and no connection to WhatsApp is made before you open a link. Clicking leaves this website and opens a WhatsApp service. A prepared message can include the public product name, selected variant and its EAN; personal inquiry-form input is not included in the link. You can edit the message before sending it. You can also contact us by inquiry form, email or phone.
Telegram bot and notifications
If the controller enables the Telegram integration and specifies recipients, submitted website inquiries are additionally forwarded through the Telegram Bot API to those authorised recipients. This includes your name, email address, optional phone number, message, selected product and variant, and the inquiry identifier. Telegram processes the transmitted contents. Failed deliveries may remain in a protected queue on the website server so authorised staff can retry them. The inquiry also remains in the website database and is forwarded by email if email delivery is configured.
If you open and start the public bot in Telegram, the website receives the Telegram identifiers and messages supplied to the bot. The interactive board advisor processes your riding preferences and shoe-size class, plus optional weight, as temporary conversation state on the server. This advisory state expires after 48 hours of inactivity; /abbrechen resets the current consultation. Advisor answers are not automatically forwarded to the team as a website inquiry. For nearby test days and dealers, you can explicitly share your location in the private Telegram chat or enter coordinates. The bot also reads the dealer source approved for public display; distances are calculated on the website server. The website processes those coordinates for the current search, does not save them in conversation state and does not forward them to administrators as an inquiry. Result maps and route links show event venues or dealer addresses. Telegram also processes messages and shared locations under its own terms. No external AI service is used for this feature. Merely visiting the website does not contact Telegram through the bot link.
Bot usage is measured through pseudonymous counts of active private chats, messages, button clicks, topics and completed consultations. Statistics cover the last 90 days. Telegram identifiers are transformed using a server key; names, usernames, message content, locations and body or shoe-size answers are not stored in these statistics. Expired statistical data is removed during subsequent bot processing. The results are available only to authorised administrators.
Your rights
Subject to the statutory conditions, you may request access, rectification, erasure, restriction of processing and data portability, and object to processing based on legitimate interests. Contact the controller above to exercise these rights. You may lodge a complaint with a data protection supervisory authority, particularly in the country of your usual residence, workplace or the alleged infringement.
Spam protection for contact and product inquiries
Inquiries are checked on the website server using local rules for known advertising campaigns and typical spam patterns. No contents are sent to an external screening or CAPTCHA service. To limit abusive submissions, a value derived from the IP address using the server key and the times of form attempts are also processed. The counter considers at most the preceding hour; expired counter files are periodically cleaned up during later form requests. Spam protection stores neither raw IP addresses nor additional message copies. It is not used for visitor analytics. The legal basis is Article 6(1)(f) GDPR, reflecting the legitimate interest in preventing spam and abuse. If an inquiry is rejected in error, you can contact us by email or phone.
Online orders, payments and shipping
When online purchasing is enabled, we process your name, billing and shipping addresses, email, company name where applicable, optional phone number, cart, order, payment, invoice and shipping data to enter into and fulfil the contract (Article 6(1)(b) GDPR). Your email is verified before a binding purchase. Verified customer details are matched and updated by email; issued invoices remain unchanged. A technical session and access tokens protect the cart, forms and order view. A local keyed IP attempt counter prevents abuse, not visitor analytics (Article 6(1)(f) GDPR).
Invoices and order and shipping information are sent through the configured SMTP service; delivery attempts are logged. If you choose a configured PayPal payment, PayPal (Europe) S.à r.l. et Cie, S.C.A., Luxembourg, receives the necessary order references, amounts and shipping details. Payment status and transaction IDs are verified and stored server-side. No PayPal script is embedded or payment order sent without selecting PayPal. For GLS deliveries, the necessary delivery details are used for fulfilment; tracking numbers and shipping and confirmed delivery times are stored. An enabled status interface sends the tracking number to GLS. Opening a tracking link is additionally subject to GLS privacy notices.
Invoices and accounting records subject to retention are generally retained for eight years from the end of the year of issue, without prejudice to longer tax-related retention duties (Article 6(1)(c) GDPR). Other contract and technical records follow their purposes and applicable statutory periods. Uncompleted checkout drafts are not invoices; their personal data is cleaned separately as part of operations. Order data is not used for marketing without a separate legal basis. Contact the controller above for access or correction.
PayPal – Privacy · GLS – Privacy
Electronic withdrawal
The “Withdraw from contract” function processes your name, the email address for the receipt, your contract or affected-goods references, the declaration and its receipt time in UTC. The declaration is retained in the website database and sent through the configured SMTP service to authorised staff for processing and to your specified email address as a receipt. Delivery statuses and attempts are logged. The legal bases are contract administration and the statutory duty to receive and acknowledge electronic withdrawals (Article 6(1)(b) and (c) GDPR). Retention follows withdrawal processing and applicable statutory retention and evidentiary periods. The data is not used for marketing. A local keyed IP attempt counter protects against abusive mail delivery (Article 6(1)(f) GDPR); it stores no raw IP addresses. No customer account or prior email verification is required.