For procurement
Where a processor relationship applies, a DPA and Farleda-specific annexes are agreed before processing. Provider and data-flow questions: office@stoicera.com.
Data protection
Providers and data flows.
The services needed for the website and those relevant to future application features. Planned infrastructure does not establish that data transfers are already active.
Editorial review
- Document revision
- 2.2 · 13.10.2026
- Scope
- Website and application separated
- Operator
- Stoicera Group · Raphael Lugmayr & Sebastian Kern GesbR
Scope
Purpose and the configuration actually released determine each service’s scope.
Website
Information website with personal email contact. No active online forms, website database or automated newsletter delivery.
Application
Journey planning and optional features have separate data flows. Open beta is planned from 31 October 2026; the application and API need their own release approval.
Data-protection role
The GesbR operates its own service. Whether a pilot involves processing on behalf of a partner depends on the agreed purpose and actual processing. A provider’s name alone does not determine its role.
Infrastructure and other services
Website services appear first. Application services describe prepared features; actual endpoints and contractual roles are reviewed before activation.
More columns: scroll horizontally or use the arrow keys.
| Service / scope | Purpose | Region / evidence status | Data categories | Use |
|---|---|---|---|---|
| ContaboWebsite | Static website delivery on web-01 | Contabo network in Germany; contract and location details held by the operator | Technical connection data; no form database | Selected |
| ResendPlanned · not active on this website | Automated email delivery | Primary processing in the US per Resend DPA; review contracts and transfer safeguards | Recipient address, message content and delivery metadata; confirmation or login link where required | Not activated |
| Hetzner MailWebsite / App | Personal mailboxes and inbound correspondence | Confirm plan, storage location and retention in the account | Sender, recipient, content, attachments and delivery metadata | Email contact |
| Transitous / MOTISApp · pre-release | Timetable-based journeys | Confirm endpoint, operator and region before activation | Origin and destination coordinates, query time, routing preferences and technical request metadata | Feature-dependent |
| OSRMApp · pre-release | Road geometry; car profile, only an approximation for walking and cycling | Confirm endpoint, operator and region before activation | Coordinates, profile and technical request metadata | Feature-dependent |
| Nominatim / OpenStreetMapApp · pre-release | Place lookup | Confirm endpoint, operator and region before activation | Search terms, language and technical request metadata; no account identifier in the search parameter | Feature-dependent |
| Overpass / OpenStreetMapApp · pre-release | Places, activities and accommodation candidates | Confirm endpoint, operator and region before activation | Areas, coordinates, search categories and technical request metadata | Feature-dependent |
| Open-MeteoApp · pre-release | Weather and air quality | Confirm endpoint, operator and region before activation | Coordinates, requested period and technical request metadata | Commercial use review pending |
| electricityMapsApp · pre-release | Current or historical grid intensity | Confirm endpoint, operator and region before activation | Country or zone code, provider credentials and technical request metadata | Optional |
| Groq / PollinationsApp · pre-release | Optional journey text; no emissions calculation | Provider- and model-dependent; no EU-only claim | Places, dates and planning preferences; no account identifier in the prompt, but indirect identification may be possible | Optional |
| OpenStreetMap / CARTOApp · pre-release | Map tiles in the browser | Confirm endpoint, operator and region before activation | Browser IP address, technical headers and requested map areas | Map view |
| Wikimedia projectsApp · pre-release | Destination information and, where used, external images | Confirm endpoint, operator and region before activation | Search terms or image path; direct image requests also include browser IP and technical headers | Feature-dependent |
Technical metadata can include the requesting server’s IP address. Direct browser requests disclose the browser IP instead. This inventory is not an executed DPA annex.
Hosting and storage
Infrastructure decisions and editorial review; not live measurements.
The information website is hosted on web-01 at Contabo. Personal correspondence uses Hetzner Mail. The website currently requires neither a database nor Resend delivery.
The application, online forms and other integrations require a separate operational release and a review of actual providers, contracts and data flows before activation.
How changes are announced
Public documentation and contractual notices serve different purposes.
Contractual procedure
Processor changes follow agreed notification, authorisation and objection procedures. Material changes are versioned and dated. A public list alone does not replace contractual notice.
Website processing: Privacy notice · technical controls: Security. Provider sources: Resend DPA, Open-Meteo terms, Nominatim usage policy. Questions: office@stoicera.com.
