Privacy policy

Last updated: October 2026

1. Controller

CA Brachtendorf GmbH & Co. KG
Weiherstr. 10, 40219 Düsseldorf, Germany
Phone: +49 211 5580527 · Email: info@railpedia.eu

Railpedia is a database of devices for electrical and KNX installations. Device data (manufacturers, order numbers, technical data, terminals) is not personal data. We only process personal data for user accounts, sign-in and secure operation.

2. Hosting in Germany

Railpedia runs on a dedicated server of Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany, in a data centre in Germany. A data processing agreement pursuant to Art. 28 GDPR is in place with Hetzner. We do not use services from third countries.

3. Visiting the website (server logs)

Each time a page is requested, the web server automatically stores: IP address, date and time, requested address, status code, amount of data transferred, referrer and browser identification. This serves secure operation and defence against attacks (Art. 6(1)(f) GDPR). The logs are deleted automatically after 14 days.

4. Cookies

We only use technically necessary cookies (Section 25(2) no. 2 TDDDG). We therefore do not ask for consent:

• __Host-rp – session cookie for sign-in; deleted when you close the browser or sign out.
• __Host-rp_dev – only if you choose “My private device”: remembers the device so that the second sign-in step is not required every time; valid for at most 90 days.
• __Host-rp_lang – only if you switch the language: remembers the selected language (e.g. “en”); valid for 12 months.

There are no analytics, advertising or tracking cookies, no tracking pixels and no social media plug-ins. Fonts and scripts are served from our own server; external services (e.g. Google Fonts, CDNs) are not loaded.

5. User account and sign-in

For your account we process: salutation, title, first and last name, email address, where applicable company and mobile number, your password (only as a secure Argon2id hash), the secret for the authenticator app (encrypted), recovery codes and one-time codes (only as hashes). The legal basis is the performance of the user relationship (Art. 6(1)(b) GDPR).

To protect accounts we log security-relevant events (e.g. sign-ins, failed attempts, changes to data) with time, IP address and browser identification (Art. 6(1)(f) GDPR). These entries are deleted automatically 12 months after they were created.

6. Contributions to the database

When you create or change device data, we store who made each change and when. This keeps the database traceable (Art. 6(1)(f) GDPR). For uploaded drawings and documents we additionally store the source and licence.

6a. Company accounts of manufacturers

Manufacturers can receive a company account in order to provide their own logos and images. For this we process the account data of the designated employees as described in section 5. Uploaded files are published only after review; source, licence, uploader and time are stored.

6b. Contact persons at manufacturers

For manufacturers we store business contact details of contact persons (name, position, department, business email address and phone number, area of responsibility). The data comes from direct business contact, business cards or public information provided by the manufacturers. The purpose is maintaining device data and business communication with the manufacturer (Art. 6(1)(f) GDPR). This data is not public: only employees of CA Brachtendorf GmbH & Co. KG and individually authorised administrators can see it; it is not provided via the API. We delete it when the responsibility ends or the person objects.

7. Confirmation codes by text message and email

If you choose two-factor sign-in by text message, we transmit your mobile number and the one-time code to seven communications GmbH & Co. KG (seven.io), Willestr. 4–6, 24103 Kiel, Germany, which delivers the message. For codes and notifications by email we use the email service Brevo (Sendinblue GmbH, Berlin). Data processing agreements are in place with both providers.

8. Application programming interface (API)

Applications access device data via an API. No personal data of users is transferred. Access is logged with time and application.

9. Recipients

Data is only passed on to the processors named above or where we are legally obliged to do so. We do not sell data.

10. Storage period

We store account data for as long as the account exists. After the account is deleted, the data is deleted unless statutory retention obligations apply. Your contributions to the device database remain; the personal reference in the change history is removed.

11. Your rights

You have the right of access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and to object to processing based on legitimate interests (Art. 21 GDPR). Please contact info@railpedia.eu.

You may also lodge a complaint with a data protection supervisory authority, e.g. the State Commissioner for Data Protection and Freedom of Information of North Rhine-Westphalia (LDI NRW), Kavalleriestr. 2–4, 40213 Düsseldorf, Germany.

12. Security

All connections are encrypted with TLS (HTTPS with HSTS). Access is protected by mandatory two-factor sign-in. We apply strict security policies (Content Security Policy) and do not load third-party scripts.