1. Controller
[COMPLETE: hamfolio controller's full legal name, postal address, privacy e-mail; DPO contact if appointed]. This draft GDPR notice must be completed and approved before opening registration. Station owners also determine their own purposes for keeping logs. [ESTABLISH: legal roles of the platform and station owners, and required processing agreements].
2. Data, purposes and legal bases
We use your e-mail, password hash, callsign, station details, content, files, log and device tokens to provide your account and pages under the contract (GDPR Article 6(1)(b)). E-mail, a password or passkey, acceptance of the terms and callsign verification are needed for the relevant features; other content is optional. You cannot publish a station without verification.
Verification uses a callsign claim, TQSL signature and certificate, a code in a public QRZ biography or a private licence scan. Identity documents are accessible only to authorised staff. We do not store TQSL private keys. Second factors use an encrypted TOTP secret, recovery codes or a public passkey; staff access requires 2FA.
Security, impersonation prevention, attempt limits, acceptance evidence, moderation and handling reports rely on the legitimate interest of protecting the service and people's rights (Article 6(1)(f)). This includes IP addresses in infrastructure logs, operation times and results, staff audit records and report e-mails. Rate counters use an IP hash. There is no advertising, marketing profiling or solely automated decision-making with legal effects; staff review disputes and scans.
3. Other stations and sources
Sources are owners' uploaded logs and public RBN, DX Cluster, POTA and PSKReporter spots. We store technical contact and spot data; imports discard other operators' names, e-mails, addresses and comments. Public output shows callsigns, countries, locators of at most four characters and contact details, never their personal fields. Minimal records document radio activity (legitimate interest, Article 6(1)(f)); you may object. Content you publish is accessible to all visitors, including search engines.
4. Recipients and transfers
Authorised staff, hosting provider OVH and mail provider Brevo access data as needed to deliver the service. QRZ verification sends a callsign to QRZ in a read request. External links open services governed by their own policies; we embed no advertising, external maps or fonts.
[COMPLETE: contracting entities, hosting, mail and backup locations; subprocessors, any transfers outside the EEA, their legal basis and how to obtain safeguards; Sentry only if enabled]. We do not sell data. Authorities may receive data where required by law.
5. Retention
Account data, content and logs remain until account or content deletion. Accounts with a previously public station have a seven-day cancellation period; never-published stations are deleted immediately. Acceptance records are deleted with the account. Private import files are deleted after processing. Verification evidence is deleted within 30 days after a decision; cancelled claims schedule file deletion. Spots remain for 30 days and the recent buffer for up to 30 minutes. Sked and historical hiding requests, including e-mails, are deleted after 90 days. Retention tasks need the worker and scheduler to be running.
QSL requests: unconfirmed requests are deleted after 7 days; the return e-mail is removed 30 days after dispatch or decline. Open confirmed requests remain until closure or station/account deletion. Contact details are visible only to the station owner; e-mail confirmation and QSO knowledge do not verify callsign ownership.
A blocked callsign remains as long as needed to prevent republication; you may request a review. [COMPLETE AND IMPLEMENT: retention of infrastructure logs, verification and queue metadata, staff audits and any legal claim records]. Database backups are planned to rotate over 14 days; [CONFIRM: file backup retention and reapplying deletions after restoration].
6. Rights and contact
You may request access and a copy, correction, erasure, restriction and portability where applicable, and object to processing based on legitimate interests. Where consent applies, you may withdraw it without affecting earlier processing. Accepting terms is neither marketing consent nor general data-processing consent. Account export and deletion are in the account panel. Contact the controller also for erasure requests that go beyond callsign hiding. We normally respond within one month; a statutory extension requires notice and reasons.
Send requests to hide or erase a callsign by e-mail to the contact address in section 1; staff verify the link to the callsign proportionately (for example an e-mail from the QRZ address or a TQSL signature), without collecting licence scans on spec. Hiding filters public output on other current and future stations without blocking registration or verification of your own station, and does not automatically erase owners' private QSOs or external search-engine copies. Erasure requests and objections are assessed separately against any grounds for continued retention. You may complain to the Polish UODO (uodo.gov.pl) or your competent supervisory authority. These principles follow the GDPR, particularly Articles 6 and 12–22.
7. Necessary cookies only
We use cookies for sessions, CSRF protection, authentication and remembering your language and appearance choices. There are no analytics or advertising cookies, so no consent banner is shown. Sessions expire at browser close or after up to 14 days depending on the remember-login option; CSRF expires after one year, the theme choice after one year and the language choice at browser-session end. Logout or deleting cookies may shorten these periods; station domains have separate cookies. You can remove or block cookies in your browser; blocking prevents login and form submission.
Signing in with an external account
If you choose this method, the recipient of the data needed to sign in is your selected provider: Google, Apple, Microsoft or Meta (Facebook). The provider receives the sign-in request, IP address, browser information and Hamfolio callback URL, and processes them under its own privacy policy. Hamfolio stores the provider account ID and email, without names, photos, friends, access or refresh tokens. Technical OAuth data is processed temporarily during sign-in. Disconnecting in account settings removes the provider ID. Hamfolio account data, including email, remains until account deletion. Any consent withdrawal at the provider is a separate action. This method does not verify a callsign. Email and password sign-in remains available.