As of: 30 September 2026
Anyone searching on Nautikarta doesn’t have to sign up and leaves nothing with us that could identify a person. What is stored here is information about businesses — and part of it does not come from the businesses themselves. Anyone who doesn’t want to be in this directory comes off with no reason given and no discussion; section 4 explains how.
gx-systems
Owner: Danny Schmiedel
Pfaffenweg 16, 04319 Leipzig, Germany
Email: admin@nautikarta.app
Phone: +49 162 3062031
Full provider details in the legal notice. We are not required to appoint a data protection officer; the contact person is the owner himself.
For each business we store: name, town and harbour, address, approximate coordinates, phone number, email address, website, the kind of work, a short text about it — and always where the listing comes from and when it was created.
For a company this is not personal data. A limited company is not a person, and the General Data Protection Regulation (GDPR) does not apply to it.
For a sole trader it is different. A sole trader is a person. Their business name, address and phone number are then personal data, even though they are business-related. Everything that follows in this policy applies to these cases — in particular the right to object in section 4.
The legal basis is Art. 6(1)(f) GDPR, our legitimate interest and that of people searching: boat owners today find businesses almost only through acquaintances, and many businesses are not found at all. A directory showing who works where helps both sides. We store only details that a business makes public anyway in order to win customers — no turnover, no private address, no details about employees, no reviews, no ratings. Where a business has created or taken over its listing itself, Art. 6(1)(b) or (a) GDPR also applies.
What we explicitly do not do: we don’t rate, we don’t sort by quality, we don’t sell data and we don’t pass the list on to third parties. Sorting is by distance only. We don’t check the details either — a listing is passing on information, not a promise from us.
This happens, and we say so openly: a listing may come from someone who has nothing to do with the business — from a boat owner, or from us after reading the business’s website. At first the business knows nothing about it.
That is why every listing shows visibly how it came about and whether the business has confirmed it.
We inform the business as soon as we can. If an email address is available, we write to tell it what is stored about it, where it comes from, and how it can change or remove the listing. This is the obligation under Art. 14 GDPR. If there is no address, we cannot reach it — then only the way via the site itself remains (section 4).
We only show an email address publicly once it has been confirmed — that is, once someone has clicked a link sent to exactly that address. Until then it is stored in the listing but not visible on the site. This way nobody can be entered in this directory with someone else’s address.
Because the basis is our legitimate interest, every sole trader concerned has a right to object under Art. 21 GDPR. We do not make this subject to any review or balancing of interests:
Anyone who doesn’t want to be in this directory is not in it. No reason, no questions, no deadline.
Deleted means deleted. The listing is removed from the data, not just hidden. A note remains that it was deleted — without the data itself. It disappears from the nightly backups within 30 days.
In addition, the other rights under the GDPR apply: access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction (Art. 18) and data portability (Art. 20).
The search needs a reference point to order results by distance. There are three ways to set one, and all three are voluntary:
With the second and third way, the coordinates are rounded to two decimal places — roughly one to two kilometres of blur, enough for sorting and too vague for an address. They are sent in the body of the request, not in the address bar, so that they don’t end up in history lists and server logs. We don’t store them: the server calculates the distances, sends back the list and forgets them. There is no table of locations.
If you don’t press the button or refuse permission, you can use the site fully — just with a typed place or a tap on the map. Nothing is hidden as a result.
The location you set is remembered in your browser. So that you don’t have to set it again on every page, the site stores the two rounded numbers in your browser’s storage (localStorage, key nk_standort). That is the only value we store there. It stays on your device — it is not sent to us to be kept, and it links you to nothing: it contains no identifier by which you could be recognised. You can delete it yourself at any time with the “Delete location” button next to the search — or by clearing the site data in your browser.
The language of the site follows your browser’s language setting. If you choose another one at the top, it appears as lang=… in the address of the following pages. No cookie is set and nothing is stored for this.
Your browser draws the map imagery itself — from map data (so-called vector tiles), glyphs and symbols that it fetches directly from OpenFreeMap (tiles.openfreemap.org):
Hyperknot Software Kft., Hungary — OpenFreeMap privacy policy
As with any file fetched on the web, this server learns your IP address, date and time, your browser’s details, and — through the name of the tile — the map section you are looking at. This roughly shows which area interests you. According to its own policy, OpenFreeMap stores no IP addresses in its access logs; error logs may contain them and are deleted after seven days; in case of attacks or abuse, OpenFreeMap reserves the right to log IP addresses for up to 30 days. The map data is delivered through the network of Cloudflare (Cloudflare, Inc., USA), so your request reaches its servers first. For transfers to the USA, Cloudflare relies on the EU-US Data Privacy Framework. What happens to the data there is governed by these providers’ policies; we have no influence on it.
The program that draws the image from this data (MapLibre GL) is delivered from our own server. It fetches nothing other than the map data named above.
What we do about it. We send no search terms, no identifier and no location there — only the map data is fetched. The points on the map come from our own data. The legal basis is Art. 6(1)(f) GDPR; without map imagery a map would hardly be usable. If you don’t want this, you can use the site without JavaScript: the map then stays empty, and search and results list work unchanged.
Through the report and listing forms we receive a name (optional), a way to contact you (needed so we can reply) and the text of the message. We store this to deal with the matter and to be able to show later who initiated a change — for a removal, that is exactly what protects the business from a stranger demanding it. The basis is Art. 6(1)(f) GDPR, and for an objection additionally Art. 6(1)(c) GDPR. These messages never appear on the site.
Anyone adding a business gives their name. With “I know a business” this name appears in the listing’s source note — the form says so, which makes it consent under Art. 6(1)(a) GDPR, which can be withdrawn at any time. Addresses and phone numbers of those reporting never appear.
We also keep a short record of whom we wrote to and when — recipient, subject, time. Without it we could not prove that we informed a business about its listing.
No one except the web host the site runs on. It acts for us as a processor; the required contract is in place and the servers are located in Germany. There is no payment provider, no analytics tool and no advertising partner. Nothing is sold or passed on.
You have the right to lodge a complaint with a data protection supervisory authority. Responsible for us — because the business is based in Saxony — is the Saxon Data Protection and Transparency Commissioner (Sächsische Datenschutz- und Transparenzbeauftragte), Devrientstraße 5, 01067 Dresden, Germany. You can also contact the supervisory authority of your own country.