← Back to homepage

Legal

Privacy Policy

Last updated: August 2026

1. Data controller

Data controller within the meaning of the General Data Protection Regulation (GDPR):

Jochen Fehmer
Camino Pista De Fatima 25L
38789 Puntagorda
Santa Cruz de Tenerife, Spain
Email: buchung@starshare-lapalma.astrocube.de

2. General information on data processing

We process our users' personal data only to the extent necessary to provide a functioning website and to process bookings. Legal bases are Art. 6(1)(b) GDPR (performance of a contract), Art. 6(1)(f) GDPR (legitimate interest) and, where required, Art. 6(1)(a) GDPR (consent).

3. Hosting & server log files

This website is hosted on servers operated by Strato AG, Otto-Ostrowski-Straße 7, 10249 Berlin, Germany. We have a data processing agreement with Strato (Art. 28 GDPR). When you access the website, information is automatically stored in server log files: IP address, date and time of access, page accessed, browser type and operating system. This data is used to ensure operation and to defend against attacks (Art. 6(1)(f) GDPR) and is deleted after 14 days at the latest.

4. Booking and customer data

For a booking we process: email address, booked hours or subscription plan, requested targets, payment amount and booking history (ticket number). The legal basis is Art. 6(1)(b) GDPR (performance of a contract). Operational booking data is deleted after completion (see section 11); statutory retention obligations for invoice data under commercial and tax law (6 or 10 years) remain unaffected.

5. Payment processing

After completing a booking, you will receive an invoice with a payment link by email. The payment provider for this link is named at the time of invoicing; your payment data is only transmitted to that provider once you use it. The legal basis is Art. 6(1)(b) GDPR (performance of a contract).

6. Storage and delivery of your images

Image files generated during your session are stored on Cloudflare R2 (Cloudflare, Inc., 101 Townsend St, San Francisco, CA 94107, USA). We have a data processing agreement with Cloudflare including EU Standard Contractual Clauses. Download links are valid for 72 hours; image files are automatically deleted after 30 days. The legal basis is Art. 6(1)(b) GDPR.

7. Email communication

Booking confirmations, access details and download links are sent by email via a transactional email service (e.g. Resend or Postmark) based on Art. 6(1)(b) GDPR. We have a data processing agreement with the respective provider.

8. Weather data (Windy, Open-Meteo)

The weather forecasts shown on the website (cloud cover, wind, jet stream) are retrieved server-side via the Windy API (Windyty SE, Prague, Czech Republic), cached and updated every 30 minutes; no personal data of our visitors is transmitted to Windy in this process. The Calima index (Saharan dust, PM10) is likewise retrieved server-side via the Open-Meteo air-quality API, without transmitting personal data.

In addition, we embed an interactive weather map by Windy on the homepage as an iframe. This loads client-side, and not automatically — only after you explicitly click "Load weather map" (two-click solution, see section 9); your IP address is then transmitted directly to Windy.

9. External content (maps, weather map, libraries)

The fonts used on this website (Cormorant Garamond, Inter, JetBrains Mono) are served exclusively from our own server. No data is exchanged with Google or third parties in this process.

This website embeds the following further external resources, during the retrieval of which your IP address is transmitted to the respective provider (Art. 6(1)(f) GDPR, interest in a consistent, functional presentation):

10. Cookies & local storage

This website does not use tracking or marketing cookies and no analytics services. Only technically necessary data is processed (e.g. session token after login, Art. 6(1)(b) GDPR); no consent is required for this under § 25 TDDDG (German Telecommunications-Digital-Services-Data-Protection Act).

This does not apply to the embedded Windy weather map (sections 8 and 9): since your IP address is transmitted to a third-party provider when it loads, we obtain your explicit click-consent before loading it (two-click solution, Art. 6(1)(a) GDPR in conjunction with § 25(1) TDDDG). This consent is stored only for the current browser session (sessionStorage), not as a persistent cookie, and must be given again on every new visit.

11. Retention periods

Note on the distinction between these periods: the 14-day period applies to operational booking records in the system (ticket status, requested targets). Invoice-relevant data (payment receipt, amount) is subject to statutory retention periods under commercial and tax law and is archived separately. Both data categories are stored in separate database fields and retained for different lengths of time.

12. Your rights

You have the following rights regarding your personal data: access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20), and objection to processing (Art. 21 GDPR). You may withdraw any consent given at any time with effect for the future (Art. 7(3) GDPR). Please contact us informally at the email address given above.

You also have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR), e.g. with the Spanish data protection authority responsible for our place of business (Agencia Española de Protección de Datos, AEPD).

13. Data security

All data transmission is encrypted via TLS (HTTPS). The connection between the web server and the telescope site runs over an encrypted VPN (WireGuard).