Privacy policy

1. Controller

The controller for data processing on this website within the meaning of the General Data Protection Regulation (GDPR) is:

[[LEGAL_OPERATOR_TYPE]]: [[LEGAL_NAME]], [[LEGAL_STREET_ADDRESS]], [[LEGAL_POSTAL_CODE_CITY]], Germany

Email: info@regaplatform.com · Phone: +49 178 4228269

2. Overview

REGA Platform is a free directory for the Kurdish community in Germany and Europe. We process personal data only as far as necessary to run the website, your user account, to communicate with you and to protect the service. We do not sell data and do not run advertising or tracking networks.

3. Hosting and server log files

The website is operated by Cloudflare, Inc. (Cloudflare Workers, R2). When you open it, the hosting provider processes technically necessary data, in particular IP address, date and time, page requested, browser type and operating system, to deliver the site, keep it stable and fend off attacks.

Legal basis: Art. 6(1)(f) GDPR (legitimate interest in secure and stable operation). Data may be transferred to third countries on the basis of appropriate safeguards (EU standard contractual clauses or the EU-US Data Privacy Framework). A data processing agreement is in place.

4. Cookies and local storage

We use only technically necessary storage that is required for the service you request (§ 25(2) no. 2 TDDDG). For that reason we show no cookie banner.

• Session cookie (Auth.js): only after sign-in, keeps your session (up to 14 days).
• Language cookie (REGA_LOCALE / NEXT_LOCALE): remembers your language (1 year).
• Browser storage “rega-theme” (localStorage): remembers light/dark mode.
• Browser session storage: a random identifier for the running REGA Assistant chat; it is deleted when you close the tab.

5. Reach measurement and analytics

We use no analytics or tracking tools and show no advertising.

6. User account and registration

You can create an account to list businesses and use signed-in features. We process your name, email address, a securely stored password (hash, never plain text), account type (user or business), language, the time you accepted the Terms and this Privacy policy, and the time of email confirmation and last sign-in.

To send confirmation and password-reset emails we use an email service provider as processor.

Legal basis: Art. 6(1)(b) GDPR (contract of use) and (f) (security, abuse prevention). We keep the data until you have your account deleted.

7. Contact form and email

If you use the contact form we store your name, optionally your email address, subject, message and the language of your page, and forward the message to our team by email. The data is used only to handle your request (Art. 6(1)(b) or (f) GDPR) and deleted once it is no longer needed, at the latest after statutory retention periods. To protect against spam, the number of submissions per connection is limited.

8. Reporting content (Digital Services Act)

With the report form we collect the reported address, the reason, your explanation and your name and email address in order to assess the notice and tell you the outcome (Art. 6(1)(c) GDPR in conjunction with Art. 16 DSA). The data is kept as long as needed to handle the notice and document the decision.

9. Business listings

Business listings (name, description, address, phone, email, website, opening hours, images, map position) are shown publicly. They are submitted by the owners themselves or at their request; they are responsible for being allowed to publish this information. Images are stored in an object storage. Legal basis: Art. 6(1)(b) and (f) GDPR.

Reviews: if you write a review, we publish the name stored in your account, your rating, your comment and the date once a moderator has approved it. Each user can write one review per business; you can edit it or have it deleted by writing to us. Legal basis: Art. 6(1)(b) and (f) GDPR.

Jobs, events and guides: these entries are published by businesses or by our team. Contact details a business gives for applications (email address or link) are shown publicly with the entry. Legal basis: Art. 6(1)(b) and (f) GDPR.

10. REGA Assistant (AI)

When you use the REGA Assistant, your question, the conversation so far and matching public listings from our directory are sent to our AI provider: [[LEGAL_AI_PROVIDER]]. The provider processes the data as processor and may be located in third countries (safeguards: standard contractual clauses).

Please do not enter sensitive personal data into the chat. Answers are generated by AI and may be wrong.

We store the chat under a random session identifier (without name or email; for signed-in users linked to the account) for at most 30 days and then delete it automatically. Legal basis: Art. 6(1)(b) and (f) GDPR.

11. Location (“Nearby”) and maps

The nearby search uses your location only if you agree to your browser’s prompt (Art. 6(1)(a) GDPR). The coordinates are sent to our server for the search and are not stored. You can choose a city instead.

Map tiles are loaded directly from a map service (default: OpenFreeMap, tiles.openfreemap.org, based on OpenStreetMap data). Your IP address is transmitted to the map service (Art. 6(1)(f) GDPR, interest in displaying a map).

12. Recipients

Recipients are our processors (hosting, email delivery, AI service, object storage) and, where legally required, authorities. Data is not passed on for advertising.

13. Your rights

You have the right to access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and to object to processing based on legitimate interests (Art. 21 GDPR). You can withdraw consent at any time with effect for the future. Contact us at info@regaplatform.com.

14. Right to lodge a complaint

You have the right to lodge a complaint with a data protection supervisory authority, in particular in the Member State of your residence or of the alleged infringement. A list of the German authorities is available at https://www.bfdi.bund.de/DE/Service/Anschriften/Laender/Laender-node.html.

15. Provision of data and automated decisions

The public pages can be used without giving personal data. An account requires name, email address and password. No exclusively automated decision-making, including profiling, takes place.

16. Changes

We update this policy when features or the legal situation change. The version published here applies.