Privacy Policy

1. Controller

The controller responsible for data processing on this website is:

deinabi.com
Esders & On UG (haftungsbeschränkt)
Schleidenstraße 1-3
22083 Hamburg, Germany
Email: datenschutz@deinabi.com

2. What data we process

We process personal data that you provide to us yourself, that arises when you use our platform, or that is technically required to provide our services.

• First and last name
• Email address
• Phone number
• School and graduating year
• Login, verification and account data
• Uploaded content such as photos, profiles, quotes and yearbook content
• Voting, ranking and event data
• Payment and booking information for paid services
• Delivery address, chosen shipping method and delivery status for orders
• Roles in the graduation committee (Abikomitee) and entries in the activity log
• Theme week (Mottowoche) content such as photos, votes and groups
• Support and communication content, in particular messages via WhatsApp, Instagram, email or other support channels
• Verification data in support, such as email address, phone number, one-time codes, timestamps and technical metadata
• Technical usage data such as IP address, device information and log data
• Cookie and consent information

3. Purposes and legal bases of processing

We process your personal data in particular for the following purposes:

• Providing, registering and managing user accounts
• Creating and organising yearbooks, rankings, events and content
• Authentication and security, for example via SMS or email verification
• Communicating with you, for example for support, service or contractual purposes
• Handling support requests via our internal support chat, including automated pre-screening, AI-assisted draft replies and handover to real team members
• Processing payments and paid services
• Audience measurement, conversion tracking and marketing, insofar as you have consented
• Complying with legal obligations and preventing abuse and fraud

Depending on the case, processing is based on Art. 6(1)(a) GDPR (consent), Art. 6(1)(b) GDPR (performance of a contract), Art. 6(1)(c) GDPR (legal obligation) or Art. 6(1)(f) GDPR (legitimate interest).

4. Storage, security and deletion

We take technical and organisational measures to protect your data against loss, manipulation, unauthorised access or unauthorised disclosure.

• SSL/TLS encryption for data transfers
• Access restrictions and role-based permissions
• Secure authentication and hashing methods
• Regular maintenance and security updates

We store personal data only for as long as is necessary for the respective purposes or as required by statutory retention obligations.

Closed support chats and the associated messages, internal notes, assignments and verification data are generally deleted automatically after 24 months. Short-lived one-time code verifications in support are deleted after 30 days at the latest. Longer retention only takes place if this is necessary to handle open matters, to establish, exercise or defend legal claims, or due to statutory retention obligations.

5. Specific processing activities

5.1 Login, security and abuse prevention

Students log in with their phone number. To confirm, we send a one-time code by SMS; sending is handled by Brevo as our processor (see section 9.2). If your number is registered with WhatsApp, the code may be sent via WhatsApp instead (WhatsApp Business Platform by Meta, see section 9.5); if it does not arrive, you can request it by SMS. Committee admins log in with an email address and password and additionally confirm the login with a one-time code (second factor), which we send by email to the stored address (sent via Brevo). We store passwords only as a hash.

To prevent abuse (e.g. mass code requests or login attempts), we limit the number of requests per IP address, phone number or email address within certain time windows. The counters required for this are only kept for the duration of the respective time window. For the daily limits on sending SMS, we store for each SMS sent only irreversible hashes of the phone number and IP address, not the number or IP address itself.

The legal basis is Art. 6(1)(b) GDPR (provision of the user account) and Art. 6(1)(f) GDPR; our legitimate interest lies in account security and protecting the platform against abuse.

5.2 Orders, delivery address and shipping

For orders (e.g. yearbook, graduation merch, paper tickets for the graduation ball), you choose between free collective shipping to your school and shipping to an address of your choice.

Collective shipping to the school: If you choose collective shipping, we store your explicit consent to delivery to the school and handover by the committee, together with the time of consent and the version of the consent text, so that we can prove the consent. For the handover, the committee sees which people in their year ordered which items and the number of orders per shipping method.

Shipping to your address: If you choose shipping to your own address, we process your name and delivery address exclusively for shipping and processing the order. For this purpose, we pass the delivery data to the commissioned printer or production partner and to the shipping provider; the address is also stored with our payment provider Stripe as the shipping address of the payment. The committee does not see your delivery address.

We show you the delivery status and, where applicable, the tracking number in your dashboard.

We delete delivery addresses as soon as the order has been fully processed and no further queries or claims arising from the delivery are to be expected. Where order data forms part of records that must be retained under tax or commercial law (e.g. invoices and accounting records), we retain them for the statutory periods (§ 147 AO, § 257 HGB) and restrict processing to this purpose.

The legal basis is Art. 6(1)(b) GDPR (performance of a contract), Art. 6(1)(c) GDPR for retention, and Art. 6(1)(f) GDPR for proof of consent to collective shipping.

5.3 Payments

We process payments via Stripe (see section 9.3). You enter your payment details (e.g. card number or IBAN) directly with Stripe; we do not receive them. Stripe automatically informs our server about the status of payments (so-called webhooks). In doing so, Stripe transmits in particular a payment ID, amount, currency, payment status and the details we provided for matching (e.g. order type, school, account ID and shipping method). We verify the authenticity of these messages using a signature. The legal basis is Art. 6(1)(b) GDPR.

Sales links for ticket sales: If someone buys a ticket via a student’s personal link (the link only contains a random code), we store this attribution and count tickets and revenue minus refunds for a leaderboard. The committee sees it with names, the rest of the year only first name and initial; you can hide yourself from the year in your account settings. The legal basis is Art. 6(1)(f) GDPR.

5.4 Committee roles and activity log

Committee members can be given roles (e.g. chair, treasurer, yearbook committee). The roles determine which areas of a year a member may edit. For this, we process the assignment “account – year – role” and who assigned the role.

So that the committee can trace who created, changed, deleted, approved, ordered or refunded something in a year’s admin area, we keep an activity log. We store: the acting account and its role, the type and time of the action, the affected area, a short description, the names of the changed fields and – only for non-sensitive fields – their values, as well as a truncated, irreversible hash of the IP address to detect abuse. Passwords, access codes, tokens, phone numbers and payment or bank details are not logged; email addresses only appear truncated (e.g. “m•••••r@gmail.com”).

The log is visible to the chairs of the respective year (as long as the year does not split permissions by committee: all committee members). Entries are deleted automatically after 24 months. If an account is deleted, it only appears in the log as “Deleted account”. The legal basis is Art. 6(1)(f) GDPR; our legitimate interest and that of the committee lies in the traceability of joint organisation and the prevention of abuse.

Committee in the student list: Registered students of a year see the committee members with their names and committee roles at the top of the student list, so they know who is responsible for what. The legal basis is Art. 6(1)(b) GDPR (provision of the year’s organisation). In addition, we show a WhatsApp button next to each committee member containing the mobile number stored in their account, so that classmates can contact the responsible person directly with organisational questions. The legal basis is Art. 6(1)(f) GDPR; our legitimate interest and that of the year lies in making the people who have voluntarily taken on the organisation easy to reach. The number is only visible to registered students of the same year, not to the public. Every committee member can object to this at any time under Art. 21 GDPR, most easily by switching off the display in the “Abikomitee” area; the number will then no longer be shown immediately. Switching it off hides the WhatsApp buttons of the entire committee of that year; your own objection remains in place even if another committee member switches the display back on. For this, we only store that and since when an objection was made. Anyone using the button opens WhatsApp (Meta) – we do not transmit any data to Meta ourselves; WhatsApp’s privacy policy applies. We cannot retrieve numbers that someone has already saved.

5.5 Profile representatives

The committee can appoint students of a profile (course group) as profile representatives via an invitation link. For this, we store which account is appointed for which profile and who sent the invitation. Profile representatives do not see orders or payment data of other students. The legal basis is Art. 6(1)(b) GDPR.

5.6 Linking several graduating years of a school

Years of the same school can be linked on deinabi.com – by confirmation from the chair of an already linked year, by confirmation with a school email address (confirmation code), or by the deinabi team. For the school, we store its name, town, federal state and, where applicable, its email domain; when confirming via school email, we additionally store the confirmed address as proof of the link.

After linking, a year can once take over templates from another year of the same school: names of teachers (where applicable with subject and abbreviation), profile names, profile and ranking questions, and theme week rules. This content is copied, not permanently shared; later changes in one year do not affect the other. Student data (profiles, answers, photos, votes, orders) is not taken over.

The legal basis for taking over teachers’ names is Art. 6(1)(f) GDPR (simplifying organisation; only names and, where applicable, subject/abbreviation are taken over, which are known in the school context anyway). Teachers can object to the processing at any time (contact: info@deinabi.com); the entry will then be removed in the affected years.

The school search during registration can be used without logging in and only shows the name, town and federal state of schools, not years or people.

5.7 Teachers and “teacher missing” reports

For rankings and the yearbook, the committee maintains a list of teachers (name, where applicable subject and abbreviation). Students can report that a teacher is missing from the list. For this, we store the reported name, where applicable the subject, the time and the accounts of the reporting people (so that each person reports a teacher only once). The committee sees the report and the number of reporters, but not who reported. The legal basis is Art. 6(1)(f) GDPR. The teachers’ right to object under section 5.6 applies accordingly.

5.8 Theme week (Mottowoche)

For the theme week, we process suggestions and votes on the themes, the schedule and – insofar as the committee uses these features – the following data:

• Photo wall: uploaded photos, the name of the uploader and the theme day. Photos are re-encoded before storage, and embedded metadata (e.g. location, camera data) is removed. The photos are kept in non-public storage and are only visible to members of your own year. Whoever uploaded a photo can delete it again.
• Votes (“costume of the day”): one vote per person and day for a photo. Only the results are shown. If the committee has enabled the theme week page for the yearbook, the winning photo (with the uploader’s name) and other photos of the day appear in the yearbook.
• Group costumes: name and description of the group and its members.
• Approval link for the school management: The committee can generate a link through which the school management, without an account of its own, can view the themes, schedule and rules of the theme week and give feedback on each theme. No photos, votes or student names can be accessed via the link. We only store a hash of the link and the school management’s feedback. The committee can revoke the link at any time.
• Email reminder (optional): If the committee enables the reminder, we send an email on the evening before a theme day to the email address stored in the accounts of the year’s students. Sending is handled by Brevo (see section 9.2).

The legal basis is Art. 6(1)(b) GDPR (provision of the features used by you or your year). Please only upload photos whose publication within the year the people shown have agreed to.

5.9 Theme finder (Motto-Finder)

In the theme finder, you can enter your own ideas for the wheel of fortune. These ideas are stored only locally in your browser (local storage) and are not transmitted to us. If you create a share link, the ideas are contained in the link itself; when the link is opened, we process it technically like any page view (e.g. in server logs). You can remove the ideas at any time in the theme finder or by clearing your browser data.

5.10 Deletion of inactive accounts

We delete accounts that have not been used for a long time according to the following rules. An account is only considered for deletion if both apply: the last activity (e.g. login) was at least 12 months ago, and the graduating year is over (from 1 August of the graduation year). If no graduation year is stored for an account, it will not be deleted automatically.

Before deletion, we notify you three times – 60, 30 and 7 days in advance – by email to the address stored in the account or, if none is stored, by SMS (sent via Brevo, see section 9.2). The notices contain a “keep account” link, which is valid for 90 days and can be used once. If you log in or use the link, the account remains and the period starts again. Deletion takes place no earlier than 60 days after the first notice. After deletion, you will receive a short confirmation.

Accounts are not deleted automatically as long as a merch order is open for them (not yet paid, or paid but not yet shipped), nor are admin accounts as long as a yearbook order from their school is open or other members of their year are still using the account.

What happens to your profile, profile page, photos (including theme week photos), votes, comments, orders and other content follows the same rules as for self-initiated deletion (section 5.12). We keep a log of deleted accounts that only contains an irreversible hash of the account ID, the time, the role, the graduation year and the number of deleted entries. To determine the last activity, we store the time of last use for each account.

The legal basis is Art. 6(1)(c) GDPR in conjunction with Art. 5(1)(e) GDPR (storage limitation) or Art. 6(1)(f) GDPR. Regardless of this, you can delete your account yourself at any time (section 5.11).

5.11 Deleting your account yourself and downloading your own data

You can delete your account at any time in the account settings under “Deine Daten” (your data). Beforehand, we show you what happens to your content. For security, you confirm the deletion with a one-time code: students receive it by SMS to the stored phone number, committee admins by email to the stored address. Alternatively, you can request deletion via the form on the German privacy page (“Meine Daten löschen”) or by email to info@deinabi.com; we will then delete the account according to the same rules.

In two cases, deletion is temporarily not possible: if you are the last person chairing a committee whose year still has other members, please first transfer the chair to another committee member so that the year remains manageable. If you have a paid order that has not yet been shipped, deletion is possible once it has been shipped; in urgent cases, contact info@deinabi.com.

Independently of this, you can download your own data as a file at any time (Art. 15 and Art. 20 GDPR): account data, your profile page, your own photos (as time-limited links), your ranking and theme week votes, the comments you wrote yourself, and your orders. Content of other people – such as comments others wrote about you, or their profile pages – is not included; a print-ready version of the yearbook is not part of the export.

The legal basis is Art. 17 GDPR and Art. 15 and 20 GDPR respectively; for confirmation by code, Art. 6(1)(f) GDPR (protection against deletion by unauthorised persons).

5.12 What happens to content when an account is deleted

Deleting an account removes your personal data without making your year’s shared content unusable. The following applies:

• Account and login: profile, phone number, email address, password, sessions and registered devices are deleted immediately; logging in is no longer possible afterwards.
• Orders and payments: for statutory retention (§ 147 AO, § 257 HGB, ten years from the end of the calendar year of the order), name, delivery address, items, amount, order and payment date and order number are retained. Phone number, email address and the link to the account are removed.
• Yearbook content (profile page, profile and collage photos, comments by you and about you, your ranking votes and votes for you, theme week photos): if your year’s yearbook has not yet been submitted, it is deleted; the committee only sees a neutral note in the progress view that accounts were deleted, without names. If the yearbook has already been submitted or is in production, this content remains unchanged in the book until delivery (your account and login are still deleted immediately) and is deleted afterwards.
• Votes and groups: votes in the theme week and in polls, as well as memberships in theme week groups and at graduation ball tables, are deleted.
• Suggestions and reports: your suggestions (e.g. for ranking questions) remain available to the year without your name; your support for suggestions and your “teacher missing” reports are removed.
• Merch designs and name lists: designs belong to the year and are retained, without you as the creator. Your name is removed from name lists of designs not yet produced and will not be included if they are recreated. Products already ordered, printed or approved for printing remain unchanged.
• Tasks, announcements and the committee’s activity log: entries are retained and show “Deleted account” instead of your name.

Products already delivered (e.g. printed yearbooks or hoodies) naturally cannot be changed. The legal basis for retaining order data is Art. 6(1)(c) GDPR; for freezing submitted yearbook content until delivery, Art. 6(1)(b) and (f) GDPR (performance of the contract with the year).

5.13 Retention of year content

We also delete a year’s shared content once the year is completed: profile pages and profile photos, photos and collages, comments, rankings, suggestions and polls, theme week content, entries on the “Auslandsjahr” (year abroad) page, the teacher list and reports, merch designs with print files and uploads, and the list of people in yearbook orders. We do not store book PDFs permanently. Deletion takes place 12 months after the end of the year; this is the latest of the following dates: 1 August of the graduation year, the graduation ball, delivery of the last order. As long as a paid order has not yet been shipped or the yearbook is in production, nothing is deleted.

“Auslandsjahr” (year abroad) page: if the committee enables it, it can invite people without an account via a personal link. Only first name, last name, a photo (without embedded metadata) and a quote for the yearbook are stored; the committee can edit and delete the entries.

The committee (admins with a stored email address) receives a notice by email 60, 30 and 7 days in advance. If the year ordered its yearbook from us and it has been delivered, the committee can request an archive until deletion: photos and collage images as well as a preview of the book as a PDF in screen resolution with a watermark, no print data. Without a delivered order, there is no archive of the year’s content. Every person can download their own data themselves at any time (section 5.11).

Separately, we retain order and invoice data only to the extent described in section 5.12 for ten years from the end of the calendar year of the order and delete it afterwards. The legal basis is Art. 6(1)(c) GDPR in conjunction with Art. 5(1)(e) GDPR and § 147 AO, § 257 HGB.

5.14 Newsletter and product information by email

We only send the newsletter with your consent (Art. 6(1)(a) GDPR). After signing up (website, registration, checkout or account settings), you receive an email with a confirmation link; we only add you once you click it (double opt-in). As proof, we store your email address, the time of sign-up and confirmation, where you signed up, the version of the consent text and a truncated IP address (Art. 6(1)(c) and (f) GDPR). Unconfirmed sign-ups expire after 7 days.

If you have bought a yearbook from us, we may occasionally send information about similar products of our own to the email address provided at purchase, even without consent (§ 7(3) UWG, Art. 6(1)(f) GDPR). We point this out at the time of purchase.

You can withdraw your consent or object to this use at any time: via the link in every email, in the account settings or by email to info@deinabi.com. This incurs no costs other than transmission costs at basic rates. Sending is handled by Brevo (section 9.2); Brevo analyses whether emails are delivered and opened or links are clicked, so that we can improve the newsletter. After you unsubscribe, we keep the address with the time of unsubscription so that we do not contact you again and can prove the earlier consent. If you delete your account, we also delete the newsletter subscription for your account email.

A small newsletter notice may appear on public pages. If you close it, we remember this for 30 days only locally in your browser (local storage) so that it does not reappear.

6. Your rights

Within the statutory requirements, you have in particular the following rights:

• Access to the data we process
• Rectification of inaccurate data
• Erasure of your data
• Restriction of processing
• Data portability
• Objection to certain processing
• Withdrawal of consent given, with effect for the future

To exercise your rights, contact us at datenschutz@deinabi.com or use the functions on the German privacy page.

7. Support chat, WhatsApp and AI assistance

If you contact us via WhatsApp, Instagram, email or other support channels, we process the contact details, message content, attachments, timestamps, status information and technical metadata you transmit in order to handle your request.

An AI-based assistant may be used to support our support team. A limited excerpt of the previous chat history of the same request may be processed. The assistant does not make binding legal, tax, data protection, payment or refund decisions.

For questions about purchased tickets (e.g. ticket not received, wrong email address, transfer to another person), the assistant compares your details with the ticket and order data to make sure you are entitled: your WhatsApp number with the phone number given at purchase, first and last name and, where applicable, date of birth and payment details (last four digits of the card, or amount and day of payment, retrieved from our payment provider Stripe). After successful verification, the assistant can resend tickets by email, correct the email address on the ticket or, after your explicit confirmation, transfer a ticket to another person; in doing so, we process the new person’s name, email address and, where applicable, date of birth, and the previous ticket becomes invalid.

For account requests, we may verify you with a one-time code by email or SMS. In the chat, we do not confirm whether an account exists for a given email address or phone number.

Depending on the request, the legal basis is Art. 6(1)(b) GDPR, insofar as processing is necessary to handle contract-related requests, and Art. 6(1)(f) GDPR based on our legitimate interest in efficient, secure and traceable support. Where consent is required, processing is based on Art. 6(1)(a) GDPR.

8. Cookies and consent management

We use cookies and similar technologies to ensure the functionality of our website, to store consents and – after your consent – to carry out audience measurement and marketing.

Technically necessary cookies may be used without separate consent insofar as they are required to operate the website. We only use non-essential cookies and tracking technologies if you have expressly consented beforehand.

You can adjust or withdraw your choice at any time via our consent tool or the cookie banner.

9. Third-party providers and recipients

We use external service providers to provide our website and services technically, organisationally and economically. Depending on the provider, this may involve the processing of personal data.

If we use further third-party providers in future, we will update this privacy policy accordingly.

10. Right to lodge a complaint with a supervisory authority

You have the right to lodge a complaint with a data protection supervisory authority if you believe that the processing of your personal data is unlawful.