Privacy policy

This is a translation for your information. In the event of any discrepancy, the German version prevails. The German version is published at locogps.de.

Last updated: October 2026

1. Data protection at a glance

The following information gives an overview of what happens to your personal data when you visit our website locogps.de, use our shop or use the LocoGPS tracking service via the app or the web portal live.locogps.de. Personal data is any data that can be used to identify you personally.

2. Controller

Christian Niehoff – LocoGPS
Marienhook 28
48691 Vreden, Germany
Phone: +49 170 1130259
Email: info@locogps.de

The controller is the natural or legal person who, alone or jointly with others, determines the purposes and means of the processing of personal data.

3. Hosting

Our website, our shop and the LocoGPS tracking service (web portal, app backend and tracking server) are hosted by IONOS SE, Elgendorfer Str. 57, 56410 Montabaur, Germany. All data collected on our website or in the tracking service, including the location data of your GPS trackers, is processed and stored on IONOS servers in German data centres.

We use IONOS on the basis of Art. 6(1)(f) of the General Data Protection Regulation (GDPR). We have a legitimate interest in presenting and providing our services as reliably as possible. We have concluded a data processing agreement (DPA) with IONOS. IONOS processes your data only insofar as this is necessary to fulfil its service obligations, and follows our instructions.

Backups: To ensure that no data is lost in the event of a technical failure, we back up the data on our servers regularly. The backups are stored exclusively in Germany, including with a service provider specialising in this, with whom we have concluded a data processing agreement. The legal basis is Art. 6(1)(f) GDPR in conjunction with Art. 32 GDPR (legitimate interest in the availability and recoverability of our services). Deleted data may remain in the backups for up to twelve months and is then removed automatically.

4. General information and mandatory information

We treat your personal data confidentially and in accordance with the statutory data protection regulations and this privacy policy. Data transmission on our website and in the tracking portal is encrypted with SSL or TLS.

You have the following rights: access to your stored data (Art. 15 GDPR), rectification (Art. 16 GDPR), erasure (Art. 17 GDPR), restriction of processing (Art. 18 GDPR), data portability (Art. 20 GDPR) and objection to processing (Art. 21 GDPR). You can withdraw any consent you have given at any time with effect for the future. You also have the right to lodge a complaint with a data protection supervisory authority; the authority responsible for us is the State Commissioner for Data Protection and Freedom of Information of North Rhine-Westphalia.

5. GPS tracking and location data of your trackers

The core of our service is locating your GPS trackers (e.g. on your dog’s collar). In doing so, we process the position data of the tracker (GPS coordinates with timestamp), the device status (including battery level, signal quality, energy saving mode) and the device identifier (IMEI). This data is stored on our servers at IONOS in Germany (for backups, see section 3) and can only be viewed via your user account and via shares that you create yourself with the share function.

The processing is carried out for the performance of the contract (Art. 6(1)(b) GDPR). Position data and events (e.g. entering or leaving a geofence) are stored for 365 days and then deleted automatically. We delete technical logs of the tracking service after 90 days at the latest. When your account or your devices are deleted, the associated position data is deleted unless statutory retention obligations apply.

Mobile connection of the trackers: The trackers transmit their data via a built-in SIM card of a mobile communications service provider based in Germany. This provider processes the technical connection data of the SIM card in order to provide the connection. The legal basis is Art. 6(1)(b) GDPR.

The trackers are intended for locating animals and one’s own property. Tracking persons without their express consent is prohibited; the customer is personally responsible for this.

6. WiFi-based positioning (Google Geolocation API)

If the tracker does not have a sufficient GPS signal (e.g. inside buildings), its position can be determined approximately using nearby WiFi networks and mobile network cells. For this purpose, our server transmits the technical identifiers of nearby WiFi access points (MAC addresses, signal strengths) and mobile network cells captured by the tracker to the Google Geolocation API of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. No names, account data or device data of our customers are transmitted to Google. A transfer to Google LLC in the USA cannot be ruled out; it is safeguarded by the EU-US adequacy decision (EU-US Data Privacy Framework) and standard contractual clauses.

The processing is carried out for the performance of the contract (Art. 6(1)(b) GDPR), as reliable tracking, including inside buildings, is a core part of the service.

7. User account, app and tracking portal

User account: An account is required to use the tracking service. For this, we process your name, email address and password (stored in encrypted form); the email address is verified during registration using a verification code. The legal basis is Art. 6(1)(b) GDPR.

App permissions: Depending on the function, the LocoGPS app requests the following permissions: location (showing your own location on the map and the distance to the animal; your own location is only processed locally on your device and is not stored on our servers), Bluetooth (searching for the tracker near you), camera (scanning QR codes) and Face ID or biometric unlocking (local protection of your login on the device). All permissions are optional and can be revoked in the system settings.

Push notifications: For notifications (e.g. leaving a safe zone, low battery), the app uses the Firebase Cloud Messaging service of Google Ireland Limited. A pseudonymous device token is processed for this purpose; a transfer to the USA is safeguarded by the EU-US Data Privacy Framework and standard contractual clauses. The legal basis is Art. 6(1)(b) GDPR; push notifications can be deactivated in the system settings.

Map display: The maps in the tracking portal and in the app are loaded via the providers LocationIQ (Unwired Labs (India) Private Limited) and OpenFreeMap. If you select a Google map in the map selection, the map tiles are loaded from Google (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland). When the map tiles are loaded, your IP address is transmitted to the respective map provider; no other personal data is transmitted. The legal basis is Art. 6(1)(b) GDPR (map display is a core part of the service).

Address display: If you have the address of a position displayed, our server transmits the coordinates of that position to the LocationIQ service of Unwired Labs (India) Private Limited, which determines the address from them. The request is handled by LocationIQ servers in the EU. No name, account data or device data is transmitted in this process. The legal basis is Art. 6(1)(b) GDPR.

Dog map and poison bait reports: The places on the dog map, for example poop bag dispensers, dog parks and vets, come from OpenStreetMap and are loaded from our own servers. No data is transmitted to third parties in this process. If you report poison bait, we store the location of the find, the type of find, your voluntary description, the time and the link to your account. Other users see the report without your name; we use the link to your account only to prevent misuse. We also store your feedback on other users’ reports (“Still there”, “Gone”) with your account. To warn users nearby, we compare the location of the find with the last location of their trackers and send them a push notification, which can be switched off in the map. Reports are visible until they expire, usually after 14 days, and are deleted together with all feedback 90 days after expiry. The legal basis is Art. 6(1)(b) GDPR (provision of the function) and, for the link to your account, Art. 6(1)(f) GDPR (legitimate interest in preventing misuse).

Crash reports: If the app crashes or an error occurs, it sends an error report to the Sentry service of Functional Software, Inc., stored in a data centre in Frankfurt am Main. The report contains technical information about the error (error message and location in the program code), device type, operating system and app version; in addition, the app counts its sessions anonymously so that we can see the crash rate per version. Name, email address, IP address and location are not transmitted, and the app removes login data contained in web addresses before sending. This is how we detect and fix errors. The legal basis is Art. 6(1)(f) GDPR, our legitimate interest in a functioning app. A data processing agreement is in place with Sentry; insofar as the provider can access the data from the USA, this is safeguarded by standard contractual clauses. Older versions of the app (up to 6.2) send crash reports via Firebase Crashlytics of Google Ireland Limited instead (technical information about the error, device type, operating system, app version and a pseudonymous installation identifier); a transfer to the USA is safeguarded by the EU-US Data Privacy Framework.

8. Payment processing and invoices

Payments for subscriptions and shop orders are processed by the payment service provider Stripe Payments Europe, Ltd., 1 Grand Canal Street Lower, Grand Canal Dock, Dublin, Ireland. When you take out a subscription or place an order, the payment details you enter (depending on the payment method, credit/debit card details, PayPal account, Apple Pay or Google Pay) are collected and processed directly by Stripe; we ourselves do not receive or store complete payment details. Your name, email address, billing address and the invoice amount are also transmitted to Stripe. A transfer to Stripe, Inc. in the USA is safeguarded by standard contractual clauses. For details, see stripe.com/en-de/privacy.

Subscriptions that you took out with PayPal in our former shop have been managed at Stripe like all subscriptions since October 2026. We continue to collect the amounts through PayPal (Europe) S.à r.l. et Cie, S.C.A., 22–24 Boulevard Royal, 2449 Luxembourg, using the PayPal payment method stored in the former shop. For this we transmit the invoice amount and the invoice number to PayPal. The legal basis is Art. 6(1)(b) GDPR.

The legal basis is Art. 6(1)(b) GDPR. Invoices are provided electronically by email and, due to obligations under commercial and tax law (Art. 6(1)(c) GDPR, § 147 AO (German Fiscal Code), § 14b UStG (German VAT Act), § 257 HGB (German Commercial Code)), are retained for eight years, books and records for ten years, in each case from the end of the calendar year. For invoicing, we use self-hosted accounting software on our own servers; invoices are created and stored there.

Payments by bank transfer: For our accounting we match incoming payments on our business account with our invoices. For this purpose, an account information service based in the EU retrieves the transactions on our account from our bank; for transfers to us, these include the payer’s name, IBAN and payment reference. The legal basis is Art. 6(1)(c) GDPR (commercial and tax law bookkeeping obligations). We keep the transactions with our other accounting records for the statutory periods.

Incoming invoices: For our accounting, we use an AI service to help us extract the details (for example issuer, date, amounts and tax rates) from invoices and receipts that we receive from suppliers and service providers. Such documents contain details of the issuer and its contact persons, and shipping invoices also contain names and addresses of recipients. The provider of the AI service is Anthropic Ireland, Limited, Dublin, Ireland. The content is not used to train AI models. Where processing is carried out by Anthropic, PBC in the USA, it is safeguarded by standard contractual clauses. At present we also store the documents in the cloud storage of Dropbox International Unlimited Company, Dublin, Ireland. Where Dropbox transfers data to the USA, this is based on standard contractual clauses or the EU-US Data Privacy Framework. The legal basis is Art. 6(1)(c) GDPR (commercial and tax law bookkeeping obligations) and Art. 6(1)(f) GDPR (legitimate interest in efficient bookkeeping). We keep the documents with our other accounting records for the statutory periods.

9. Data collection on the website locogps.de

Server log files: When you access our pages, information is automatically stored in server log files (browser type and version, operating system, referrer URL, host name, time, IP address). This data is not combined with other data sources. The legal basis is Art. 6(1)(f) GDPR (technically error-free provision of the website).

Help Center: In the Help Center and in the help section of the app, we record anonymously how often articles are viewed and rated and which search terms return no results, without cookies and without reference to a person or an account. IP addresses are not stored in this process. The legal basis is Art. 6(1)(f) GDPR (legitimate interest in improving our help articles).

Cookies and storage in the browser: Apart from the pages of the former customer account (see below), our website does not include any analytics or advertising services and does not set cookies for such purposes. In the browser we only store what is needed for a function you have requested, such as the current order in the checkout or a chat you have started. Both are kept in the browser’s session storage and are deleted when you close the window. In the checkout, the page loads Stripe’s payment function (see section 8), which sets cookies to prevent fraud. The legal basis is § 25(2) no. 2 TDDDG (German Telecommunications Digital Services Data Protection Act) in conjunction with Art. 6(1)(b) GDPR.

Enquiries by email, contact form, chat and app: We store your enquiries with your name, your email address, your message and any attachments in our own ticket system on our servers in Germany. If you are a customer, we link the enquiry to your account and see the status of your devices (such as subscription, battery, messages from the device and settings) so that we can help you faster. The legal basis is Art. 6(1)(b) GDPR where your enquiry concerns a contract or an order, otherwise Art. 6(1)(f) GDPR (legitimate interest in answering it). The data remains with us until the purpose no longer applies or you ask us to delete it, unless statutory retention obligations apply.

Reply drafts with AI: To answer enquiries faster, we have an AI service prepare a draft reply. For this we transmit the history of your enquiry without internal notes, your first name and, if the enquiry concerns your device, the status and history of your devices over the last few days (such as subscription, battery, messages from the device, events and settings), but no locations, no postal address and no order or payment data. We check and send the draft ourselves. The provider is Anthropic Ireland, Limited, Dublin, Ireland. The content is not used to train AI models. Where processing is carried out by Anthropic, PBC in the USA, it is safeguarded by standard contractual clauses. The legal basis is Art. 6(1)(f) GDPR (legitimate interest in answering your enquiry quickly and accurately).

Waiting list for sold-out items: If an item in our shop is sold out, you can add your email address to a waiting list. We first send you an email with a confirmation link and, after confirmation, notify you once as soon as the item is available again. We store your email address, the item and the times of registration and confirmation. The legal basis is your consent (Art. 6(1)(a) GDPR), which you can withdraw at any time via the unsubscribe link in the confirmation email or by sending us a message. We delete unconfirmed entries after 7 days and confirmed entries when the notification is sent.

Shop orders: To handle orders, we process your name, address, email address, the items ordered and the payment method you choose (Art. 6(1)(b) GDPR). We manage orders and invoices in self-hosted software on our own servers. We only pass on data to the extent necessary to handle the order. We process payments in the shop via Stripe (see section 8), and you enter your payment details directly with Stripe. If you pay with PayPal, PayPal (Europe) S.à r.l. et Cie, S.C.A., 22–24 Boulevard Royal, 2449 Luxembourg is also involved. If you pay with Klarna, your name, address, email address and the order details are transmitted to Klarna Bank AB (publ), Sveavägen 46, 111 34 Stockholm, Sweden. Depending on the payment option you choose, Klarna checks your identity and creditworthiness and is itself the controller for this; details are in Klarna’s privacy notice (klarna.com/de/datenschutz). For shipping, we transmit your name and delivery address and, if you agree, your email address for the shipment notification to DHL Paket GmbH, Sträßchensweg 10, 53113 Bonn, Germany. We retain order and invoice data for the statutory periods (see section 8).

Website security: To protect against attacks, we process access data such as IP addresses and compare them with known sources of attacks. For this, we use a security service that may transmit IP addresses to a service provider in the USA; the transfer is safeguarded by standard contractual clauses. The legal basis is Art. 6(1)(f) GDPR (legitimate interest in the security of the website).

Customer account of the former shop: For subscriptions from our former shop, the pages of the previous customer account (locogps.de/mein-konto/ and the payment pages of these orders) remain available until all of these subscriptions have been migrated. Only on these pages, and with your consent given via the cookie banner shown there, are the following additionally loaded: Google Tag Manager, Google Ads conversion tracking and Google Analytics 4 of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, the live chat Tidio (Tidio Poland Sp. z o.o., Wojska Polskiego 81, 70-481 Szczecin, Poland) and review content of Trustpilot A/S, Pilestraede 58, 1112 Copenhagen, Denmark, as well as profile images via Gravatar of Automattic Inc., San Francisco, USA. In doing so, your IP address and usage data are transmitted to these providers, in some cases also to the USA. The transfer is safeguarded by the EU-US Data Privacy Framework and standard contractual clauses. The legal basis is your consent (Art. 6(1)(a) GDPR, § 25(1) TDDDG), which you can withdraw at any time with effect for the future via the cookie banner on these pages.

10. Sending emails

We send transactional emails (e.g. registration confirmation, invoices, subscription and payment notifications, reminders before the end of a term) via our infrastructure hosted by IONOS. This involves processing your email address, your name and the contract data required for the content (Art. 6(1)(b) GDPR).

11. Changes to this privacy policy

We adapt this privacy policy when our services or the legal situation change. The current version published here applies.

12. Questions about data protection

If you have any questions about the processing of your personal data or about exercising your rights, please contact info@locogps.de.