Schulenatlas NRW

1General

Schulenatlas NRW is a free, independent information service for searching, presenting and comparing schools in North Rhine-Westphalia.

The service is designed so that ordinary use generates as little personal data as possible. No registration is required.

Processing serves the technical provision of the service, its security and stability, the operation of individual features and the handling of enquiries.

The legal bases are Art. 6(1)(f) GDPR (legitimate interest in a secure, functioning service) and Art. 6(1)(b) GDPR where processing is necessary to deal with an enquiry.

2Controller

The controller within the meaning of Art. 4(7) GDPR is the operator named in the legal notice, where contact details can be found.

3Hosting and technical infrastructure

The website and the server components required to operate it are provided via Render. The source code is managed via GitHub.

Data storage uses Supabase in the Frankfurt (Germany) hosting region within the European Union.

These providers may access data as far as this is necessary for their services. This is governed by data processing agreements under Art. 28 GDPR.

4External code libraries

Fonts are served entirely from this server. No connection to Google Fonts takes place.

For the map and database access, code libraries from jsDelivr, unpkg and Cloudflare are used. These files are loaded from the respective providers' servers when the page opens; the IP address is transmitted to them in the process.

The legal basis is the legitimate interest in a functional presentation under Article 6(1)(f) GDPR. The files carry an integrity checksum; the browser executes them only if they are unaltered.

5Server and access data

Every access generates technical data: time of access, content requested, technical details about browser and device, the IP address, and error and security information.

For internal statistics the IP address is stored in shortened form: with IPv4 the final block is set to zero. A full IP address is therefore not retained for this purpose.

The shortened address is used solely for a rough regional attribution and to detect misuse. It does not allow any conclusion about an individual connection.

Internal usage logs are retained for no more than 30 days; in addition, the number of stored log entries is limited.

6Random device identifier

Schulenatlas uses a randomly generated technical device identifier. It is stored in the browser and, together with certain access data, on the server.

The identifier distinguishes repeated technical access from the same browser within individual features — for example for usage limits and reminder functions.

It is not linked to a name, an email address or a user account. On its own it does not identify a person.

It is stored in the browser's local storage and in a cookie. Both can be deleted at any time in the browser settings; a new identifier is then created on the next visit.

Information is stored on and accessed from the terminal equipment under section 25(2)(2) TDDDG, the German act on data protection in telecommunications and digital services, because it is strictly necessary for the functions expressly requested. No consent is required for this.

7Usage statistics

Schulenatlas keeps its own internal statistics, recording in aggregate how often features are used, links are followed or processes are triggered.

The statistics serve technical and editorial development as well as misuse and function monitoring.

No user profile with a name, email address or other directly identifying information is created.

No third-party advertising or analytics services are embedded.

8AI features

Individual features use Anthropic's Claude API — for example the school-choice guidance, evaluations within school profiles and the structured gathering of school-related information.

The provider is Anthropic PBC, based in the United States. The transfer relies on standard contractual clauses under Article 46 GDPR. The legal basis for the processing is Article 6(1)(f) GDPR.

Only the input required for the respective feature is transmitted. Names, email addresses and other directly identifying information are not transmitted.

Inputs and results are not stored as a personal usage history.

Processing is automated. Results may be incomplete or incorrect and do not constitute binding information.

Anthropic's terms apply in addition to services provided through the interface.

9Contacting us

If you contact us by email, the information you provide voluntarily is processed: your email address, your name where given, and the content of your message.

Processing serves to handle and answer the enquiry; the legal basis is Art. 6(1)(f) or (b) GDPR.

Correspondence may remain stored with the email provider according to its retention policy. No general user register is kept.

10Error and correction reports

Reported errors or outdated information are used solely to check and, where appropriate, correct the information concerned.

Where a report contains personal data, it is processed only to the extent necessary to handle the report.

Please do not send sensitive data about other people if it is not needed for the correction.

11Reminder function

After preparing a freedom-of-information request, you can choose to be reminded later of the option to share a quality report you have received.

The random device identifier and a technical status are stored for this purpose.

Whether a request was actually sent, or a report actually issued, cannot be determined technically.

If an email address is provided, that address and the selected display language are stored. The language determines only which version of the reminder is sent.

Dispatch is handled by an email service provider on the basis of a data processing agreement under Article 28 GDPR. The legal basis for storage and dispatch is consent under Article 6(1)(a) GDPR; it can be withdrawn at any time.

The address is used solely for this one reminder and deleted afterwards. In addition, a technical marker is set in the browser for the duration of the session to detect the return from the mail program; it contains the school number and a timestamp and is discarded when the tab closes.

12Voluntarily provided documents

Quality reports are not obtained automatically from authorities. What is provided are guidance and prepared texts with which users can submit requests themselves.

If a received report is submitted voluntarily, the document undergoes a formal check and is only added after release. This check is limited to file format, legibility and obvious misuse; there is no full review of the content or of data protection compliance.

Anyone providing a document warrants that they comply with the requirements of the General Data Protection Regulation towards affected third parties and that they have fully redacted all personal data before submitting. This warranty is expressly confirmed at upload.

13Reporting published content

A reporting function is available for every published document. The reason given, the random device identifier and the IP address shortened by its last block are stored.

This information serves to review the report and to counter abusive reports. The legal basis is Article 6(1)(f) GDPR and the obligation to handle notices under Article 16 of the Digital Services Act.

Reported content is hidden immediately and without prior review. The report data is deleted once the review is complete.

14Voluntary support and payment services

The service can be supported voluntarily through external platforms.

Payments are handled exclusively by the respective provider. No payment or credit card data is received.

The privacy policies of those platforms apply to processing there.

15External links

The service contains links to external websites, for example to authority and school pages and to information and support services.

An external site is only called up when you actively click the link. The respective operator alone is responsible for data processing there.

16Maps

Map features use the open-source library Leaflet. Leaflet is a program library, not a map service in its own right.

When a map is displayed, map tiles are loaded from an external tile service, and your IP address is transmitted to its servers. The map is only loaded once it is opened.

17No profiling

The service is not designed to build personal user profiles. Ordinary use requires no user account.

The technical device identifier is not used to identify people permanently.

18Minors

The service also addresses pupils and may be used by minors. No registration is required for the publicly accessible search and information features.

Free-text fields should not be used to enter unnecessary personal details about yourself or others.

19Retention

Data is processed only for as long as necessary for the respective purpose or as required by statutory retention obligations.

Technical usage logs are limited to a maximum of 30 days and to a limited number of stored entries.

Emails may remain stored with the email provider according to its deletion policy.

20Rights of data subjects

You have the rights of access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and objection (Art. 21 GDPR).

As ordinary use stores no real names, accounts or email addresses, there is normally no directly attributable personal data. Attributing technical data such as the device identifier requires that identifier.

Requests can be made informally using the contact option given in the legal notice.

You also have the right to lodge a complaint with a data protection supervisory authority, in particular at your habitual residence.

21Data security

Technical and organisational measures are used to protect data against loss, misuse, unauthorised access and unauthorised alteration.

These include transmission over an encrypted connection, limiting the data stored, logging limited in time and volume, and securing the technical infrastructure.

22Changes to this policy

This policy is updated when the technical infrastructure, the features, the services used or the legal requirements change. The version published here at the time applies.