Privacy Policy

Peak Season is a classroom simulation about shared resources: teams of students each run a hotel in a mountain valley over several seasons, and the educator debriefs the results with the group.

Controller

The controller within the meaning of Art. 4(7) GDPR is
Urs Müller, Gotenstr. 21, 10829 Berlin, Germany — info@peak-season.org.

Who is responsible for what. For educator and administrator accounts, for security and abuse prevention, and for the retained analysis data — anonymous counters in some tools, pseudonymous rows in others; each tool's retention section says which — we are the controller. Where an institution has contracted us to run this tool for its own programme, the institution is the controller for the identifiable data of that cohort, and we process it on the institution's behalf (Art. 28 GDPR). In practice: for a request concerning your cohort's identifiable data, please approach your educator or institution first; for anything concerning accounts, security or the retained analysis data, contact us. We assist the institution in answering requests in either case (Art. 28(3)(e) GDPR).

Data protection officer: no data protection officer is appointed. § 38 BDSG has three separate triggers and we have assessed all three: headcount (at least 20 persons constantly engaged in automated processing — this service is operated by one person), processing that requires a data protection impact assessment under Art. 35 GDPR, and commercial processing for the purpose of transfer, anonymised transfer, or market or opinion research. The last two apply regardless of headcount. Our assessment is recorded in DPIA-DETERMINATION.md and is revisited whenever the scope or purpose of processing changes — in particular if cross-session research use becomes a purpose in its own right rather than support for the individual course.

What data we process

From participants

• E-mail address: required to join a session.
• First name: required. Your teammates and your educator see it.
• Session code: links you to one educator's session.
• Your team: which hotel you belong to, and whether you are its general manager.
• Your team's decisions and results: prices, building, bids and the other entries of each season, and what they brought. They are stored for the hotel as a whole and are not recorded per person.
• A hotel name, if your team typed one in place of the default.
• Times: when you joined, when your browser was last seen in the session, and when the e-mails described below were sent to you.
• The version of this notice that applied when you joined.

From educators

• E-mail address and name, for signing in to the backoffice.
• Password: stored only as a bcrypt hash. Password-reset links are stored only as hashes.
• Two-factor sign-in, once it is set up: the authenticator secret and hashed recovery codes.
• Passkeys, only if you add one: the public key and identifier your device created, the name you gave it, and when it was added and last used. Your fingerprint, face or device PIN stay on your device.
• Failed sign-in attempts: a count, and a temporary lock after too many.
• The sessions you create: title, date, settings and code, with their valleys, hotels and participants.
• A record of backoffice actions: which account did what (signing in, changing an account, creating, closing or deleting a session, correcting or removing a participant, keeping a results link open for longer), when, and the IP address it came from. It is a security record, kept for 365 days and then deleted automatically.

Legal bases

• Running the simulation, the debrief and the results link: Art. 6(1)(f) GDPR, our legitimate interest in supporting the educational programme in which participants take part.
• Educator accounts: Art. 6(1)(b) GDPR.
• Security, rate limiting and abuse prevention: Art. 6(1)(f) GDPR.

Recipients and third-country transfers

We use no third parties for advertising, analytics or tracking, and we do not sell or share personal data for marketing purposes. The following providers process data on our behalf as processors under a data processing agreement pursuant to Art. 28 GDPR:

• IONOS SE (Germany) — hosting and outgoing e-mail.
• Microsoft Ireland Operations Ltd. (OneDrive) — storage of the daily off-site backup copies. Those backups are encrypted before they leave the server, and the private key exists only on the operator's own machine — never at the provider. So Microsoft holds ciphertext it cannot read.
• healthchecks.io — monitoring that the backup run and the platform's alert check happened. Only status pings are sent ("run succeeded / failed"); no content and no participant data.

Transfers outside the EU/EEA: processing takes place in the EU; the servers and databases are in Germany. Two things are worth stating in full. Microsoft (OneDrive) provides for transfers outside the EEA under Art. 46 GDPR safeguards (EU standard contractual clauses) — what reaches it is only the backup copies, encrypted before they leave the server, whose key we do not hand over. And healthchecks.io runs infrastructure in the EU and the US, but receives only status pings from the backup run and the alert check: no participant data and no content.

What this means for erasure: when a record is deleted, a copy may remain inside backups until those expire: up to 14 days in the backups held on the server, and normally up to 30 days in the encrypted off-site copies. Two things can keep an off-site copy longer. If new backups stop reaching it, for example during an outage, the existing copies are kept until new ones replace them, so that the service can still be restored. And when an off-site copy expires, Microsoft keeps the deleted file in its recycle bin for up to 93 days, and in its own backups for up to 14 days after that; it remains encrypted throughout. Backups are used only to restore the service after a failure, never for ordinary processing.

How long we keep data

• Students' e-mail addresses and first names are deleted automatically 90 days after the educator closes the game. The educator can move that day by 90 days, up to three times; the addresses and first names are then kept until the new day. If a game is never closed, they are deleted 90 days after the last time anybody in the session was active. At the same moment a hotel name that a team typed in is replaced by the hotel's default name, and links to come back into the session are deleted. The routine runs every hour.
• What stays: the decisions and results of every hotel and valley, and which hotel each participant belonged to, without any address or name. They are kept so that valleys can be compared across sessions.
• The results link: after the game, every student who joined with an e-mail address gets an e-mail with a link to the team's results page. The link is open until the day the addresses and first names are deleted: for 90 days after the game was closed, or longer when the educator moved that day.
• Warnings: the educator gets an e-mail 14 days before that day. Students who joined with an e-mail address get an e-mail 7 days before it.
• Unused sessions: a session nobody joins is deleted 90 days after it was created.
• The backoffice record of who did what is kept for 365 days. It records the educator's account and the session's code; a student appears in it as a row number only.
• Educator accounts are kept until they are deleted.

Who can see your data

• Your teammates see your first name on the team's screen, whether you are its general manager, and whether your browser is in the session at the moment. They do not see your e-mail address.
• Other teams see hotel names and how many houses each hotel has. They do not see names or addresses of people.
• Educators see the participants of their own sessions: first name, e-mail address, hotel, whether the person is the general manager, and whether the e-mail with the results link went out. They can correct a name or an address and remove a participant. The debrief they show in the room carries hotel names and no names of people.
• Whoever holds a team's results link sees that team's results page. The page carries hotel names and no names or addresses of people.
• The administrator has technical access for maintenance and security.

Data security

• The server is located in Germany.
• All transmission is encrypted using HTTPS/TLS.
• Passwords are stored only as bcrypt hashes, never in plain text.
• Session cookies are signed and HTTP-only.
• Web fonts are served from our own server — no third-party CDNs, so no data flows to third parties when fonts load.
• IP addresses processed for rate-limiting are held in memory only and never written to the database.

Server log files

Our web server records standard access log entries: IP address, date and time, the resource requested, HTTP status, referrer and browser identifier. These logs are used solely to operate and secure the service, are not combined with other data, are not used to identify individuals or build profiles, and are rotated and deleted after 14 days. IP addresses processed for rate-limiting are held in memory only and never written to the database.

Administrative audit trail. If you use an educator account, we record security-relevant actions — successful and failed sign-ins, password changes and resets, creating, changing and deleting accounts, and deleting or anonymising session data — each with the time, the account's e-mail address and the IP address. The basis is our legitimate interest (Art. 6(1)(f) GDPR) in being able to reconstruct unauthorised access to an account. These entries are deleted after 12 months. Participants are not affected.

Your rights

You have the following rights:

• Access (Art. 15 GDPR) — what data we hold about you.
• Rectification (Art. 16 GDPR) — correction of inaccurate data.
• Erasure (Art. 17 GDPR) — deletion of your personal data.
• Restriction of processing (Art. 18 GDPR).
• Data portability (Art. 20 GDPR) — your data in a structured, machine-readable format.
• Withdrawal of consent (Art. 7(3) GDPR) — at any time, with effect for the future, as easily as it was given.

Response time. We aim to respond to enquiries promptly. Requests concerning your personal data are answered within the period required by Art. 12(3) GDPR (one month at the latest).

Erasure and withdrawal on this tool

You can delete what is yours. Your e-mail address, your first name and your place in your team can be deleted at any time. Ask for a deletion link at /withdrawal-link with the session's code and the e-mail address you joined with. We send the link to that address and nowhere else, and the page answers the same way whether or not we hold the address, so it cannot be used to find out who took part. Opening the link shows what would be removed and asks you to type a word to confirm; nothing happens until you do.

What is not deleted: your team's decisions and results. They belong to the team, and nothing in them names you.

The link itself: a new link replaces any earlier one, which stops working at that moment. We keep only a one-way fingerprint of a link, so a copy of our database gives nobody the power to delete your data. The e-mail you get 7 days before your address is deleted carries a fresh deletion link.

After your address and first name have been deleted at the end of the storage period, nothing of yours is left: what remains says only that somebody was in a hotel. A deletion link then finds nothing.

Your educator can also remove you from a session, and you can write to us.

Whether you must provide data

Providing data is neither a statutory nor a contractual requirement, but an e-mail address and a first name are technically required to join a session; without them you cannot take part. The address does the following and nothing else: it keeps one seat per person in a session; it lets you come back from another device, by a one-time link we mail you when you ask to; it is where we send the link to your team's results after the game, the warning 7 days before your address is deleted, and a deletion link when you ask for one. We do not use it to contact you for anything else.

Supervisory authority

You also have the right to lodge a complaint with a data protection supervisory authority. The authority competent for our location is:

Berliner Beauftragte für Datenschutz und Informationsfreiheit
Alt-Moabit 59–61
10555 Berlin
Germany
www.datenschutz-berlin.de

Automated decision-making

No automated decision-making, including profiling, within the meaning of Art. 22 GDPR takes place.