Privacy Policy

This English version is provided for your convenience. In the event of any discrepancy, the German version (Datenschutzerklärung) shall prevail.

1. Controller

The controller responsible for the processing of personal data on this website within the meaning of the General Data Protection Regulation (GDPR) is:

Top-O-Map TOM GmbH
Sonnenstrasse 31
97225 Zellingen
Germany
Email: tom@top-o-map.com

Authorized representatives: Thomas Stark, Melanie Schäffer, address as stated above.

2. Data Collection by the Server / Hosting Provider

Our website is hosted by netcup GmbH, Emmy-Noether-Straße 10, 76131 Karlsruhe, Germany. Whenever our website is accessed, the web server automatically stores the following data:

• IP address of the requesting device
• Date and time of access
• Address (URL) of the page accessed or of the selected map area
• Address (URL) of the previously visited page, or the page containing the integrated map
• Amount of data transferred and status of the request
• Name and version of the browser/App used
• Operating system used

This data is stored for the following purposes:

• Providing the online maps. This is the primary purpose for collecting the aforementioned data.
• Ensuring the proper operation of our IT systems
• Detecting and preventing attacks and misuse

The legal basis is Art. 6 (1)(f) GDPR. Our legitimate interest lies in ensuring the technically reliable and secure operation of this website. The log files are deleted after 7 days. Individual entries are retained for longer only if they are needed to investigate a specific attack or instance of misuse; they are deleted as soon as the incident has been fully investigated. netcup processes the data on our behalf as part of the hosting service. A data processing agreement pursuant to Art. 28 GDPR has been concluded with netcup GmbH. Server location: within the European Union.

3. Map Display and Location Search

The maps on this website consist of individual map tiles that your browser loads directly from the following servers while you use the website:

• tile.top-o-map.com – topographic map, relief map, and 3D map, operated by Top-O-Map TOM GmbH
• tile.openstreetmap.org – the OpenStreetMap map, operated by the OpenStreetMap Foundation
• tile.waymarkedtrails.org – hiking and cycling trail layers, operated by the Waymarked Trails project
• tiles.mapterhorn.com – the elevation model for displaying the 3D map is provided by Mapterhorn.com

When you use the location search, your search query is additionally transmitted to nominatim.openstreetmap.org, the search service of the OpenStreetMap Foundation.

For each of these requests, your browser technically transmits your IP address and the requested map location to the respective server. The data stored there is governed by the privacy policies of the respective operator. Without this transmission, the maps cannot be displayed. The legal basis is Art. 6(1)(f) GDPR. Our legitimate interest lies in providing the map display, which is the primary purpose of this website. The sources of the map data are listed on the Data Sources page.

4. Contacting Us by Email

If you contact us by email, we process your email address, your name if provided, and the content of your message. We use this data solely to process and respond to your inquiry. The legal basis is Art. 6(1)(b) GDPR if your inquiry relates to a contract or the initiation of a contractual relationship. Otherwise, the legal basis is Art. 6(1)(f) GDPR, based on our legitimate interest in responding to inquiries.

5. First-Party Cookies

Cookies are small text files that a website stores on your device. This website uses the following first-party cookies for the map functionality:

• map – stores the most recently displayed map area so that the map opens at the same location on your next visit. Storage period: 30 days.

The storage of your consent decision by the consent management system itself is technically necessary in order to remember your selection and is carried out independently of consent. The legal basis for this is Section 25(2) No. 2 TDDDG.

You can delete cookies in your browser settings and prevent their storage. The map will continue to function, but it will open at the default starting position each time you visit instead of the location last viewed. Without functional cookies, the usability of our services may be limited.

6. Payment Processing and Purchase of Usage Quotas via Stripe

We offer the option to purchase paid subscriptions and one-time usage quotas for our digital maps. A one-time usage quota entitles you to request or download map tiles up to the amount included in the purchased quota. The specific services included are explained in the respective product offer.

Payments are processed by the payment service provider Stripe.

6.1 Payment Process

If you wish to purchase a subscription or a one-time usage quota for our maps, you will be redirected to an external Stripe checkout page. Your payment details are entered exclusively on this page operated by Stripe.

6.2 Who Processes the Data?

Payment service providers:

• For users in the EU, EEA and Switzerland: Stripe Payments Europe Limited, 1 Grand Canal Street Lower, Grand Canal Dock, Dublin, D02 H210, Ireland.
• For users outside these regions: Stripe Inc., 510 Townsend Street, San Francisco, CA 94103, USA.

You can find Stripe's Privacy Policy at https://stripe.com/privacy .

6.3 What Data Is Processed?

Data processed by Stripe:

In connection with payment processing, Stripe processes the personal data required to conclude and fulfil subscription agreements and to process one-time purchases of usage quotas. This may include, in particular, the following data:

• Name and email address
• Billing address and, where applicable, other billing information
• Information about the payment method used and the payment data required to process the payment
• Payment amount, currency, payment status and transaction data
• Information about the product ordered or service purchased, in particular the subscription, plan and price, or the one-time usage quota purchased
• Customer, order, invoice and transaction identifiers
• IP address and technical information about the device and browser used
• Where applicable, location information, tax details and other information required for payment processing, legal obligations or fraud prevention

Payment details are entered directly on the Stripe checkout page and processed by Stripe. We do not store credit card or bank details ourselves. The specific data processed by Stripe depends on the payment method used and the Stripe services actually involved.

Data we receive from Stripe and store:

To process subscriptions and one-time purchases, allocate payments and activate the purchased map features, we receive the information required for these purposes from Stripe. This includes, in particular:

• Name and email address, where provided by Stripe
• Stripe customer ID and the payment, order and transaction identifiers required for allocation
• Information about the product purchased, in particular the subscription or one-time usage quota
• Price, currency, payment amount and payment status
• For subscriptions: start date, term, status and, where applicable, renewal and cancellation information
• For one-time purchases: purchase date and information about the product purchased
• Information about activation status and the association of the purchase with the API key used

API Keys, Server Access and Usage Quotas:

After successful payment, we activate the purchased usage quota. For this purpose, we provide an API key. The API key is used to verify usage entitlements, associate server access with the relevant purchase or subscription, and monitor the use of the available quota.

For subscriptions and one-time purchases, usage is deducted from the purchased quota. We process the information required to verify and manage the quota, including:

• API key or an identifier associated with it
• Association with the relevant purchase, product or subscription
• Amount of the purchased quota and remaining quota
• Number of map tiles charged against the quota
• Time of access and requested map resource
• IP address and other technical access data

This processing is necessary to provide the purchased service, verify usage entitlements and manage the available quota. The legal basis is Article 6(1)(b) GDPR, insofar as the processing is necessary to perform the purchase or subscription contract. Where data is additionally processed to protect our systems and detect or investigate misuse, Article 6(1)(f) GDPR may provide the legal basis. Our legitimate interest in this respect is the secure and proper operation of our map services.

6.4 Purpose and Legal Basis

The data is processed to handle payments, perform subscription agreements and one-time purchases of usage quotas, and activate and provide the purchased map features.

• Article 6(1)(b) GDPR (performance of a contract): Processing is necessary to handle the purchase or subscription contract, allocate payments, provide the purchased usage quota and manage its consumption.
• Article 6(1)(f) GDPR (legitimate interests): Our legitimate interest lies in providing secure, efficient and reliable external payment processing and preventing fraud.

6.5 Transfers of Data to Third Countries (USA)

Stripe may transfer personal data to its parent company, Stripe Inc., in the USA. For further information about the data protection safeguards used by Stripe, please see Stripe's Privacy Policy and https://stripe.com/legal/data-privacy-framework .

6.6 Data Retention Periods

Data stored by us:

We store the customer, purchase and payment data received from Stripe to the extent necessary to process the purchase, provide the purchased service and comply with legal obligations. Documents relevant under tax and commercial law are retained in accordance with the applicable statutory retention periods.

For subscriptions, we store the data required to provide the map features for the duration of the subscription and for a further period of 90 days thereafter. Once the subscription ends, the associated API key is blocked and access is deactivated.

For one-time purchases, we store the data required to provide and manage the purchased usage quota for as long as the quota remains available for use, until it has been fully consumed or otherwise terminated. We then retain this data for a further period of 90 days so that we can verify that the purchase was properly processed, respond to enquiries and investigate potential cases of misuse.

Usage data associated with API keys, particularly information about server access and quota consumption, is stored for a further 90 days after the relevant usage entitlement ends. After that, the data is deleted or anonymised unless statutory retention obligations or another lawful reason requires it to be retained for longer.

Technical server log files are deleted separately after 7 days, unless longer storage is required in an individual case to investigate security incidents.

Data stored by Stripe:

Stripe stores your data for as long as necessary to provide its payment services and comply with legal obligations. Certain transaction data must be retained by Stripe for specified periods under applicable law. For further information, please see Stripe's Privacy Policy and Stripe's information on data retention .

7. Voluntary Support via Ko-fi

If you would like to provide voluntary financial support for OnlineTopoMap or Top-O-Map, you can do so via the Ko-fi platform. The provider is Ko-fi Labs Limited, Company Number 11087704, registered with the UK's Information Commissioner's Office under registration number ZB401278 ("Ko-fi"). The support is voluntary and does not entitle you to any goods or services in return.

7.1 Process

Our About us, Use our maps and FAQ pages contain only a link to our Ko-fi page. Your data is transferred to Ko-fi only when you click this link and are redirected to the Ko-fi platform. Ko-fi processes your data under its own responsibility.

Depending on your choice, the payment itself is processed through PayPal (PayPal (Europe) S.à r.l. et Cie, S.C.A., 22-24 Boulevard Royal, L-2449 Luxembourg) or Stripe (Stripe Payments Europe Limited, 1 Grand Canal Street Lower, Grand Canal Dock, Dublin, D02 H210, Ireland). These providers also act under their own responsibility.

7.2 Data We Receive

In connection with your support, we receive the following data from Ko-fi or the payment service provider:

• The name or username you provide
• Your email address
• The amount and date of the support payment
• Any message you choose to include

We do not receive your bank account or credit card details.

Providing your data is neither a statutory nor a contractual requirement. However, support via Ko-fi is not possible without this data. Your use of OnlineTopoMap or Top-O-Map is independent of whether you provide support.

7.3 Purpose and Legal Basis

• Article 6(1)(a) GDPR (consent): Processing and allocating your contribution.
• Article 6(1)(c) GDPR (legal obligation): Compliance with statutory retention obligations under tax and commercial law.
• Article 6(1)(f) GDPR (legitimate interests): Where applicable, responding to your message or reacting to your contribution. Our legitimate interest lies in maintaining contact with our supporters.

7.4 Data Retention

The data is deleted as soon as it is no longer necessary for these purposes. Where statutory retention obligations apply (generally up to 10 years under Sections 147 of the German Fiscal Code (AO) and 257 of the German Commercial Code (HGB)), the data is retained until the relevant periods expire and is restricted from other use.

7.5 Transfers of Data to Third Countries

Ko-fi is based in the United Kingdom. The European Commission has adopted an adequacy decision for the United Kingdom, recognising that it provides a level of data protection comparable to that of the EU. For information about potential transfers of data by Stripe to the USA, please see Section 6.5.

7.6 Further Information

Further information about data processing can be found in the privacy policies of Ko-fi, PayPal and Stripe.

8. Fonts

The fonts used on this website, Playfair Display and DM Sans, are loaded from our own server. No connection to third-party servers is established in the process, and no data is transmitted to font providers.

9. Registration and User Accounts

This website does not provide registration or user accounts that allow users to manage personal profiles or make data visible to other users.

We provide API keys to enable certain map features. When an API key is used, it is technically validated to verify the user's entitlement, enable the associated map features, and monitor usage of the allocated or purchased quota. For this purpose, we process the API key and the technical information required for validation and attribution. Further details are provided in Section 6.3.

An API key does not replace a conventional user account. When a subscription expires or is terminated, the associated API key is deactivated and access to the relevant features is disabled. For one-time usage quotas, the entitlement to use the relevant features is governed by the terms of the respective purchase and ends when the quota has been used or its agreed validity period has expired.

10. Disclosure to Third Parties

Personal data is not sold or rented. Data is disclosed where necessary for hosting and the technical operation of our website, the display of maps, location searches, the handling of enquiries, payment processing, or the provision of purchased map features. For these purposes, data may be transferred to the service providers and providers mentioned in this Privacy Policy, in particular netcup, the map and search services used, Stripe for subscriptions and one-time purchases, and Ko-fi for voluntary contributions. Data may also be disclosed where we are legally required to do so or where another legal basis permits such disclosure.

11. Your Rights

Under the GDPR, you have the right to access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20), and objection to processing (Art. 21) of your personal data. You may withdraw any consent given at any time with effect for the future. To do so, please contact: widerruf@top-o-map.com

12. Right to Lodge a Complaint

You have the right to lodge a complaint with a data protection authority if you believe that the processing of your personal data infringes applicable data protection law. The data protection authority competent for us is the Bavarian Data Protection Authority (Bayerisches Landesamt für Datenschutzaufsicht – BayLDA), Promenade 18, 91522 Ansbach, Germany. In addition, you have the right to lodge a complaint with any other data protection authority, in particular in the EU member state of your habitual residence, place of work, or place of the alleged infringement.

13. Last update of this Policy

This Privacy Policy was last updated in October 2026.