Privacy policy

Who is responsible

The controller, that is, the party that decides why and how your personal data are processed on the website living-score.com, is the administration of the Living Score service (living-score.com). For any question about your data, write to info@living-score.com.

What we process and why

The address you type. It is the subject of the report you ask for. We send it to geocoding and map data services to find it and to see what is around it, and we keep the resulting report so that the same address is not computed twice.

Your e-mail address, when you sign in. We send a one-time code to it and keep it as the name of your account, so that the reports you saved stay yours.

Your choice about the newsletter. The sign-in form has an optional box, “Subscribe to the newsletter”, which is not ticked for you. If you tick it, we keep with your account the choice itself, its date, and the language and country of that moment. It is a separate decision, not a part of the consent to processing: signing in does not depend on it, and you can switch it off in your account at any time. No newsletter has been sent yet; when one is, it will go only to those who ticked the box.

Your IP address. Our server sees it with every request, as any web server does. Every time you open a page we record a line of visit statistics: the time, your IP address, the country, region and city it points to, the language and address of the page, the site you came from (its host name only), the family of your browser, your choice in the cookie notice and, when you are signed in, your account. The place is looked up in the DB-IP database (IP Geolocation by DB-IP, db-ip.com), a file kept on our own server: your IP address is not sent to anyone for that. The country decides the example address and the consent notice you see; the records tell us how the site is used and help to stop abuse. A visit record is kept for 90 days and then deleted.

To limit abuse of sign-in, every request for a login code is recorded with the IP address it came from (an IPv6 address is cut to its /64 network), and wrong codes are counted against a hash of the e-mail address they were entered for. Both records are kept for 24 hours.

A session cookie after you sign in, and the theme and language you choose. The cookie policy lists each of them.

We show no advertising, do not build profiles and do not sell data.

Analytics, only with your consent. If you accept the analytics category in the cookie notice, the page loads the Yandex Metrica counter of Yandex LLC (16 Lva Tolstogo Street, Moscow 119021, Russia). The counter counts page views and receives your IP address, the address of the page and of the page you came from, and data about your browser and device; it sets the cookies listed in the cookie policy. Until you accept, nothing is loaded from Yandex and nothing is sent to it.

Legal grounds

Signing in, keeping your account and sending the address you type to the map services: we do what you ask the service to do (Article 6(1)(b) of the General Data Protection Regulation). Where the sign-in form asks for a separate consent to processing, as it does for visitors in Russia, that consent is the ground (Article 6(1)(a)).

The visit statistics and the limits on sign-in: our legitimate interest in knowing how the site is used and in protecting it from abuse (Article 6(1)(f)). The records hold no name, are kept for 90 days and 24 hours, and you may object to them by writing to info@living-score.com.

Your newsletter choice and analytics with Yandex Metrica: your consent (Article 6(1)(a)), which you can withdraw at any time.

You are not obliged by law or contract to give your e-mail address. Without it you cannot sign in, but every report opens without an account. No decision about you is taken by automated means alone.

Who receives data

Our server, with the database that holds the data listed above, is rented from the hosting provider Contabo GmbH (Germany), which processes it only on our instructions under a data processing agreement.

The sign-in e-mail is sent through Resend, a service of Plus Five Five, Inc. (San Francisco, USA), acting as our processor. It receives your e-mail address and the letter with the code, nothing else. This is a transfer of your data to the United States: Resend is certified under the EU–U.S. Data Privacy Framework, and its data processing agreement includes the standard contractual clauses of the European Commission. For a visitor in Russia, storing the data on a server in Germany and sending the e-mail address to the United States is a cross-border transfer, which rests on the consent given in the sign-in form.

The address you type is sent from our server to the services that turn it into a point on the map and describe its surroundings: Nominatim and Photon for geocoding, the Overpass API for OpenStreetMap data, OSRM and Valhalla for walking routes, BRouter for the bicycle route and the OSRM car router of routing.openstreetmap.de for the drive to the city centre, Open-Meteo for air, relief and weather. They receive the address or its coordinates, not your name, e-mail or IP address. The points of the places you add to a report as "my places" are passed to the map-data service in the same way as the report address: the stops near them are looked up.

An address in Argentina is also looked up in georef, a service of the government of Argentina, and an address in Spain in CartoCiudad, a service of the government of Spain. They receive the address only, not your name, e-mail or IP address.

The map on a report is drawn in your browser from tiles of OpenFreeMap. Your browser asks that service for the tiles directly, so it sees your IP address and which area of the map you look at.

Except georef, which is hosted in Argentina, the map and weather services are hosted in Europe or run by organisations based there. If you visit from another country, your request leaves that country.

Yandex Metrica is run in Russia. For a visitor in Russia the data stays in the country. For a visitor in Spain, Georgia, Argentina or any other country, accepting analytics means that the data named above goes to Russia, which the European Commission has not recognised as a country with adequate protection; the transfer rests on your consent, and you can withdraw it at any time with the “Cookie settings” link at the bottom of every page. After a withdrawal the counter is no longer loaded and its cookies on this site are deleted; the cookies on Yandex's own domain can only be deleted in your browser.

No payment is taken and no payment data is collected.

How long we keep it

A sign-in code lives for 10 minutes. A session lasts 30 days or until you log out. A line of visit statistics, with the IP address in it, is kept for 90 days. Your account, with the list of your reports and your newsletter choice, is kept until you ask us to delete it. A report without an account attached is an address and numbers about a place, and is kept so that it can be opened again by its link.

A record of your consent choices is kept with your account for as long as the account exists, so that we can show what you agreed to.

Your rights

You can ask what data we hold about you, have it corrected or deleted, restrict or object to its processing, receive it in a portable form and withdraw a consent at any time; withdrawing does not affect what was done before. Write to info@living-score.com; we answer within one month, and within 10 working days where your law sets a shorter term.

If you think your data is handled wrongly, you can complain to the data protection authority of your country: in Spain the Agencia Española de Protección de Datos, in Russia Roskomnadzor, in Georgia the authority supervising personal data protection, in Argentina the Agencia de Acceso a la Información Pública.

Visitors from the European Union and Spain

If you are in the EU, your data are processed under Regulation (EU) 2016/679 (the General Data Protection Regulation, GDPR) and, in Spain, also under Organic Law 3/2018 on the Protection of Personal Data and the Guarantee of Digital Rights (LOPDGDD). Cookies and other records in the browser are governed by Directive 2002/58/EC and, in Spain, by Article 22.2 of Law 34/2002 on information society services and e-commerce (LSSI-CE); the information about the site owner required by Article 10 LSSI-CE is given at the start of this policy and in the terms of use.

Your rights under Articles 15 to 22 GDPR: to learn whether your data are processed and get a copy; to have them corrected; to have them erased; to restrict the processing; to receive them in a machine-readable form and pass them to someone else; to object to processing based on our legitimate interest; not to be subject to a decision based solely on automated processing; and to withdraw consent at any time without affecting the lawfulness of the processing before the withdrawal.

To exercise a right, write to info@living-score.com, if possible from the address linked to your account, and say which right you mean. We answer without undue delay and at the latest within one month of receiving the request; if the request is complex or there are many, this may be extended by two further months, and we will tell you so within the first month. We charge nothing for answering. If we cannot be sure the request comes from you, we will ask you to confirm it.

You have the right to lodge a complaint with the Spanish Data Protection Agency (Agencia Española de Protección de Datos, www.aepd.es, C/ Jorge Juan 6, 28001 Madrid) or with the supervisory authority of the EU member state where you live, work or where you believe the infringement took place. We would appreciate it if you wrote to us first: many issues can be solved faster that way.

Our server is in the EU (Germany). The transfer of your e-mail address to Resend in the USA rests on the European Commission's adequacy decision for the EU–U.S. Data Privacy Framework and on the European Commission's standard contractual clauses. Yandex Metrica data go to Russia only with your explicit consent to analytics (Article 49(1)(a) GDPR); without it the counter is not loaded.

In Spain a person may consent to the processing of their own data from the age of 14 (Article 7 LOPDGDD); for younger children consent is given by their parents or legal guardians, and we do not open accounts for them. In other EU member states this age is set by national law between 13 and 16 (Article 8 GDPR).

Visitors from Russia

For visitors from Russia, data are processed under Federal Law No. 152-FZ of 27 July 2006 "On Personal Data". Consent to the processing is given separately in the sign-in form; its text is published on the page "Consent to personal data processing". An account may be opened by a person aged 18 or over.

You have the right to obtain information about the processing of your personal data, to require that they be clarified, blocked or destroyed if they are incomplete, outdated, inaccurate, unlawfully obtained or not needed for the stated purpose, and to withdraw consent at any time (Articles 9 and 14 of Law No. 152-FZ). Send your request to info@living-score.com; we answer within 10 working days of receiving it. This term may be extended by no more than 5 working days, with a reasoned notice to you.

Storing data on a server in Germany and passing your e-mail address to Resend in the USA is a cross-border transfer of personal data; it rests on the consent given in the sign-in form. Yandex Metrica data are processed in Russia.

If you believe your rights have been violated, you can appeal against the actions or inaction of the controller to the Federal Service for Supervision of Communications, Information Technology and Mass Media (Roskomnadzor, rkn.gov.ru) or to a court.

Children

The service is not meant for children. An account may be opened by a person old enough to consent on their own under the law of their country: 14 years where this text is shown to you; 14 in Spain, 18 in Russia. If you learn that a child below that age has opened an account, write to info@living-score.com and we will delete it.

Changes

When the purposes or the recipients change, this text changes with them and the consent notice asks again.