1. Controller
Piotr Kaminski – Kamilunavo
Otto-Braun-Straße 14
40595 Düsseldorf
Germany
Email: contact@kamilunavo.com
2. Website delivery, server logs and language selection
When navopass.de is accessed, technically necessary connection data may be processed, including the IP address, date and time, requested URL, referrer, browser and operating-system information, HTTP status code and transferred data volume.
This processing is necessary to deliver the service, maintain stability and security, and detect or prevent misuse. The legal basis is Article 6(1)(f) GDPR.
To show German to visitors in Germany and English elsewhere, NavoPass first uses a country code supplied by the upstream network. If none is available, the IP address may be sent once to the IP-to-country service Country. Only the two-letter country code is used and stored for up to 24 hours in the navopass_country cookie. According to the provider, the service requires no key and does not log requests. If lookup fails, the browser language is used as a fallback. The legal basis is Article 6(1)(f) GDPR; the legitimate interest is providing an understandable, location-appropriate international service.
3. Hosting
NavoPass runs on infrastructure provided by Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany. Data required for operation, databases, file storage and technical logging is processed there. Where required, processing is governed by a data processing agreement.
4. Registration, email verification and user accounts
Registration processes your name, email address and password. Passwords are stored only as cryptographic hashes. This data is required to provide the account, enable sign-in and perform the NavoPass contract. The legal basis is Article 6(1)(b) GDPR.
Email verification uses a time-limited, single-use link; only a cryptographic hash of the token is stored. If the account email changes, the new address must be verified again. NavoPass also records the acceptance time and version of the Terms of use and the time the Privacy policy was acknowledged.
5. Sign-in, password recovery and necessary cookies
Signed-in users receive the necessary navopass_session cookie containing a random session token; only its hash is stored server-side. Sessions generally expire after 30 days and can be ended sooner by signing out.
Language selection uses navopass_country for the detected country code (up to 24 hours) and, after a manual selection, navopass_locale (up to one year). Neither cookie contains account or content data.
Password recovery processes the submitted email address. If an account exists, NavoPass creates a time-limited, single-use recovery link and stores only the token hash. Existing sessions end after a successful password change.
6. Asset passes, history and documents
NavoPass processes the asset and product information entered by users, such as name, category, manufacturer, model, serial number, location, purchase or installation date, warranty and maintenance data, notes, and service or repair histories.
Uploaded photos and documents are stored on NavoPass infrastructure and linked to the relevant pass. Users decide which content they upload. The legal basis is Article 6(1)(b) GDPR.
7. Sharing links and QR codes
Users may set a pass to private, accessible by link/QR, or public. Shared pass data and history entries or documents explicitly marked as shared may then be accessible to others. QR codes are generated within NavoPass without an external QR provider. Private passes cannot be accessed through the public pass link.
8. Household and team workspaces
Shared workspaces process the workspace name, memberships, roles and invited email addresses. Depending on their role, members can view or edit passes. The legal basis is Article 6(1)(b) GDPR. Invitations may include the inviter’s name, workspace, role and a time-limited invitation link. The invited account must verify its email before joining.
9. Maintenance, deadlines and calendar export
NavoPass processes stored maintenance and warranty dates to display them and generate calendar files. Calendar exports are created directly by NavoPass. Importing them into an external calendar may result in additional processing by that provider.
10. Email and contact form
When you contact us, we process the sender address, message and voluntarily supplied contact details to answer the enquiry. Article 6(1)(b) GDPR applies to contractual or pre-contractual matters; otherwise Article 6(1)(f) GDPR applies.
The contact form sends the name, email, topic and message to the NavoPass server for validation and then forwards it through the configured business email infrastructure.
11. Email and domain infrastructure
Services of One.com Group AB, Carlsgatan 3, 211 20 Malmö, Sweden may be used for domain management, DNS and business email. This includes support, verification, recovery, invitation, contract confirmation, cancellation and withdrawal emails.
12. Paid plans, contract records and Stripe
Stripe is used to purchase and manage paid subscriptions. Payment details are entered in Stripe Checkout or Stripe payment interfaces; NavoPass does not store complete card numbers. NavoPass stores identifiers and subscription data needed to associate and perform the contract, including Stripe customer, subscription and Price IDs, subscription status, billing period and cancellation status.
Before checkout, NavoPass records the chosen plan and billing period, accepted Terms version, acknowledgement of withdrawal information and any express request for early performance. After checkout, a contract confirmation is emailed and its dispatch recorded.
Stripe may process contact, transaction, payment, IP and device data for payment processing, fraud prevention, billing and legal obligations. The legal bases for processing initiated by Kamilunavo are Article 6(1)(b) and, where legally required, Article 6(1)(c) GDPR. Stripe provides further information in its Privacy policy and Privacy Center.
13. Electronic cancellation and withdrawal
Cancellation and withdrawal declarations can be submitted electronically without signing in. NavoPass processes the information required to identify and document the request, including contact and contract details, the requested ending, reasons where applicable, timestamps, processing and confirmation status. Random confirmation links are created and only their hashes are stored. The legal bases are Article 6(1)(b) and (c) GDPR.
14. Analytics, advertising and profiling
NavoPass currently uses no proprietary marketing or analytics cookies, Google Analytics, Meta Pixel or proprietary advertising profiling. If this changes, this policy will be updated and any required consent obtained beforehand.
15. Recipients and international transfers
Data is disclosed only where necessary for operation, contract performance, payment, user-directed sharing or legal obligations. Recipients may include hosting, email and payment providers, invited workspace members, or recipients of a sharing link.
Stripe-related processing may take place outside the EEA depending on the payment method and Stripe infrastructure. Stripe describes applicable transfer mechanisms and safeguards in its privacy information.
16. Retention
Account data and NavoPass content are generally retained for the life of the account or until the respective content is deleted. Sessions normally expire after 30 days; unused verification and recovery tokens are time-limited.
Billing, contract, consent, cancellation and withdrawal records may be retained beyond account deletion where required by statutory retention periods, tax duties, contract handling or legal claims. Stripe retains payment and billing data under its applicable legal and contractual rules.
17. Data subject rights
Subject to statutory requirements, you may have rights of access, rectification, erasure, restriction, portability and objection. Consent can be withdrawn for the future. Requests can be sent to contact@kamilunavo.com.
You may also complain to a supervisory authority. The competent authority for Kamilunavo’s location is the State Commissioner for Data Protection and Freedom of Information North Rhine-Westphalia.
18. Automated decisions
NavoPass currently performs no automated decision-making within Article 22 GDPR and no proprietary profiling. Stripe may use automated measures for payment and fraud prevention as described in its privacy information.
19. Changes to this policy
This policy is updated when features, providers or legal requirements change. The version published on navopass.de applies.