Privacy Policy

1. Controller

Buddes GmbH St.-Johannes-Weg 5 97845 Neustadt am Main, Germany Represented by: Sascha Budde Phone: 0172-2002502 Data protection contact: dsgvo@buddes.de

2. Scope

This policy covers the website amusementrides.com (the "Platform"), a business-to-business catalogue of amusement rides. It explains what we process when you browse the Platform, register an account, contact us, or – as a manufacturer – present rides on it.

3. Hosting and server log files

The Platform runs on a virtual server rented from Hostinger International Limited, located in a data centre in Frankfurt am Main, Germany (European Union). No website data is stored outside the EU on our own infrastructure.

Each request is written to a server log file containing your IP address, the date and time, the requested address, the referring page and your browser identification. These logs are used to operate the service securely and to investigate faults and attacks. They are deleted automatically after 14 days.

To keep spam out of our forms without using a captcha service, each submission is checked against a per-connection limit. For this we store a keyed cryptographic hash of your IP address together with the form type and a timestamp – never the address itself, and the records are deleted after 24 hours. Forms also contain a hidden field that only automated scripts fill in and a signed timestamp; neither is stored. Legal basis: Art. 6 (1) (f) GDPR – our legitimate interest in a stable and secure service.

4. Cookies

The Platform sets only the following cookies. None of them are used for advertising, tracking or analytics, and we do not use any analytics service.

- "session" – keeps manufacturers and administrators signed in. Set only after a successful login, expires after 7 days. - "member" – keeps registered visitors signed in. Set only after a successful login or registration, expires after 30 days. - "consent" – stores your decision about embedded videos so we do not have to ask again.

The first two are strictly necessary to provide the login you requested and therefore do not require consent (Section 25 (2) TDDDG). The "consent" cookie stores your own choice. Fonts (Montserrat) are served from our own server; no request is made to Google when you visit a page.

5. Visitor accounts

Registration is voluntary and free. We store first and last name, email address, the park or company you work for, its website, your phone number, the category you selected (park operator/owner, park developer, or other), a cryptographic hash of your password, the number of sign-ins and the date of your last visit. We use this to give you access to ride details, 3D data and inquiries. Legal basis: Art. 6 (1) (b) GDPR – performance of the user agreement.

6. Manufacturer accounts

Manufacturers provide company name, contact person, contact email address, phone number, business address, website, country, a company description and a logo, plus a username and a hash of their password. We publish company name, logo, website, country and description. Contact person, contact email, phone number and business address are shown only to signed-in visitors on the ride pages; they are never published to anonymous visitors. Legal basis: Art. 6 (1) (b) GDPR.

7. Inquiries and contact forms

When you send an inquiry we store your name, email address, company, your message and the ride it relates to. We keep inquiries to process them and for follow-up.

If your inquiry concerns a specific ride, we pass it on to the manufacturer of that ride so they can answer you. The manufacturer receives your name, your company, your email address and your message – by email where they have given us an address for it, and in every case in their own account area on the Platform, where inquiries about their rides are listed. We stay in copy so we can follow up.

The manufacturer then processes your details as an independent controller, not on our behalf, and under their own privacy policy. Their obligations towards you follow from data protection law directly; our terms additionally oblige them to use inquiry data only to answer your inquiry. The manufacturers currently presented on the Platform, with their country, are listed on the home page and on every ride page.

An inquiry about a ride whose manufacturer is not registered with us, and a general contact inquiry that does not concern a specific ride, stay with us and are not passed on.

Legal basis: Art. 6 (1) (b) GDPR – passing your inquiry to the manufacturer is what you asked us to do and is necessary to deal with your request; in addition Art. 6 (1) (f) GDPR for our own legitimate interest in following up on inquiries. You can object to the processing at any time under Art. 21 GDPR, and you can of course also contact a manufacturer directly instead of using our form.

8. Favourites, park inventory and satisfaction ratings

Signed-in visitors can mark rides as favourites. Park operators and owners can additionally record which rides stand in their park and rate their satisfaction on a scale from 0 to 10. Published on the ride page are only the average value and the number of ratings – never which park gave which rating. Administrators can see the individual ratings internally. Legal basis: Art. 6 (1) (b) GDPR for the account function; Art. 6 (1) (f) GDPR for the aggregated display.

9. Uploads

Manufacturers upload photos, logos and 3D models (GLB files). These are stored on the server in Frankfurt. Photos and logos are published; 3D models are shown to premium members in a 3D viewer and are not offered for download. Photos are reduced to web size when they are uploaded; 3D models are stored unchanged, and on upload only their file type and dimensions are read automatically.

10. Email delivery

Emails (registration confirmations, inquiry notifications, password reset links) are sent through Resend, Inc., 2261 Market Street, San Francisco, CA 94114, USA, acting as our processor. The recipient address, subject and message content are transferred for this purpose. The transfer to the USA is based on the EU standard contractual clauses. Legal basis: Art. 6 (1) (b) and (f) GDPR.

11. AI-assisted ride research

Manufacturers can have technical ride data looked up online. For this, the ride name and the manufacturer's company name and country are sent to Anthropic PBC, 548 Market Street, San Francisco, CA 94104, USA. No personal data of visitors is transmitted, and the request is only made when a manufacturer actively presses the button. Legal basis: Art. 6 (1) (f) GDPR.

12. Embedded videos

Ride pages may embed videos from YouTube (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland) or Vimeo (Vimeo.com, Inc., 330 West 34th Street, New York, NY 10001, USA). These embeds are loaded only after you have consented; until then a placeholder is shown and no connection to those providers is made. Once loaded, your IP address, browser information and the page you are on are transmitted to the provider, and the provider may set cookies. For Vimeo the transfer to the USA is based on the EU standard contractual clauses. You can withdraw your consent at any time via "Cookie settings" in the footer. Legal basis: Art. 6 (1) (a) GDPR – your consent.

13. Storage periods

- Server log files: 14 days - Spam-protection records (hashed IP): 24 hours - Accounts: until you delete the account or ask us to delete it. A deleted account disappears from the site at once and is kept in an internal trash for 30 days, so that an accidental deletion can be undone; after that it is removed for good. On request we delete it immediately, without that waiting period. - Inquiries: until the business purpose is fulfilled, then in line with statutory retention obligations - Password reset links: 60 minutes, then invalid; the record is removed with the account

14. Your rights

You have the right to access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and to object (Art. 21 GDPR). Where processing is based on consent you may withdraw it at any time with effect for the future. Please contact dsgvo@buddes.de.

You also have the right to lodge a complaint with a supervisory authority. The authority responsible for us is the Bavarian Data Protection Authority (Bayerisches Landesamt für Datenschutzaufsicht, Promenade 18, 91522 Ansbach, Germany).

15. No automated decision-making

We do not use your data for automated decision-making or profiling.

16. Changes

We will update this policy when the Platform changes. The version shown here is the current one.