Privacy Policy

At a glance

• There is no account and no sign-in. What you mark on the maps is stored by your browser on your device. The marked countries are transmitted only when you share your map as a link and that link is opened.
• The website is delivered through Cloudflare’s network. This involves technically necessary connection data such as your IP address.
• Google Analytics runs only if you consent.
• The website is funded by advertising from Google. You see personalised ads only with your consent; without it, Google shows only ads for which it uses no cookies.
• You can change or withdraw your consent at any time through “Privacy settings” at the bottom of every page.

Controller

The controller responsible for processing personal data on this website within the meaning of the General Data Protection Regulation (GDPR) is:

Cornelius Müller
Ziegenhainer Str. 133
60433 Frankfurt am Main
Germany

Email: info@countries-visited.com
Phone: +49 174 9734763

Hosting with Cloudflare

The website is delivered through the network of Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107, USA (“Cloudflare”). On my behalf, Cloudflare processes the data your browser sends with every request for technical reasons – above all your IP address, the address requested and information about your browser and device – in order to deliver the website and protect it from attacks. The legal basis is Art. 6(1)(f) GDPR; my legitimate interest is secure, working operation. Access logs I can view are deleted after seven days at the latest.

A data processing agreement under Art. 28 GDPR is in place with Cloudflare. Cloudflare also processes data in the USA; this is based on the EU-US Data Privacy Framework, under which Cloudflare is certified (Art. 45 GDPR), and additionally on the EU Standard Contractual Clauses. More in Cloudflare’s privacy policy.

The website serves its fonts, images and map data itself and embeds content from other providers only in the form of the Google services described below.

Your map: storage in your browser

What you mark on the maps – visited, lived or on your bucket list – is stored by the website in your browser’s local storage. The same goes for settings you choose yourself: light or dark design, the map’s colours, and whether only UN or EU member states are counted. This information stays on your device and is not transmitted to me.

The legal basis for storing it is Section 25(2) no. 2 of the German Telecommunications Digital Services Data Protection Act (TDDDG): it is strictly necessary to provide the function you are expressly using when you mark places – a map that remembers your selection. No consent is needed for this. The information stays stored until you delete it: your marks through “Reset all marks” in the country list’s menu, everything at once through your browser’s site data.

Shared maps and preview images

When you share your map as a link, the marked countries appear as codes in its address (such as “?visited=DEU,ESP”). Anyone who receives the link sees this selection. The link contains neither your name nor any other information about you.

When such a link is opened – including by a messenger or social network that shows a preview – the website draws a preview image of the map from the codes and keeps it cached at Cloudflare for up to one day. The legal basis is Art. 6(1)(f) GDPR; my legitimate interest is to provide the sharing function you use.

When you open a shared link, the website only displays the other person’s selection; it is stored on your device only if you expressly adopt it. The picture you can create in the share menu is made entirely in your browser.

Share buttons and links to social networks

The buttons for sharing on X, Facebook, WhatsApp, Pinterest and Reddit are plain links, as are the links to my profiles on Facebook, X and Instagram. As long as you do not click one, the website transmits no data to these services. If you click one, the service’s page opens; it receives the link, the prepared text and whatever data it collects about you itself – for which it is responsible. If you use your device’s share function, the link goes to the app you choose there.

My profiles on Facebook, X and Instagram

When you visit the Countries Visited profiles on Facebook, X or Instagram, the operators of these networks process your data under their own privacy policies. I see only what is public there or what you write to me.

For the Facebook page and the Instagram profile, I am jointly responsible with Meta Platforms Ireland Limited, Dublin, Ireland, insofar as Meta collects data during your visit for statistics about the page and the profile (“Insights”). The details are set out in an agreement under Art. 26 GDPR, under which Meta is the first point of contact if you want to exercise your rights. The legal basis is Art. 6(1)(f) GDPR; my legitimate interest is to make the website known there as well and to get in touch with visitors. Meta may transfer data to the USA. More in Meta’s privacy policy.

On X, X Internet Unlimited Company, Dublin, Ireland, processes the data under its own responsibility; more in X’s privacy policy.

Contact by email

If you email me, I process your email address, your name if you give it, and the content of your message in order to answer your enquiry. The messages are held by my email provider, IONOS SE, Elgendorfer Str. 57, 56410 Montabaur, Germany, which processes them on my behalf (Art. 28 GDPR). The legal basis is Art. 6(1)(f) GDPR; my legitimate interest is to answer enquiries. If your enquiry is aimed at a contract, the legal basis is Art. 6(1)(b) GDPR. I delete the message once your enquiry has been dealt with, unless statutory retention obligations prevent this.

Managing consent

Before Google Analytics is loaded and before Google shows you personalised advertising, I ask for your consent.

For this I use the consent management tool “Privacy & messaging” of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (“Google”). It works under IAB Europe’s Transparency and Consent Framework (TCF), names every purpose and every partner involved, and lets you give or refuse each consent separately. When the consent tool loads, Google technically receives your IP address.

Your decision is stored in a cookie on your device (such as “FCCDCF”, up to 13 months) so that the request does not appear on every visit and your consent can be proven. The legal basis for running the request and for the proof is Art. 6(1)(c) in conjunction with Art. 7(1) GDPR, and for storing the cookie Section 25(2) no. 2 TDDDG.

Withdrawal: Through the “Privacy settings” link at the bottom of every page you can change your choices or withdraw a consent at any time. Withdrawal takes effect for the future; processing up to that point remains lawful.

Audience measurement with Google Analytics

With your consent I use Google Analytics 4 from Google to understand how the website is used and to improve it. Without consent, Google Analytics is not loaded. It records in particular:

• pages viewed, time spent and interactions such as clicks or scrolling,
• the page you came from,
• information about your device, browser, screen size and language,
• your approximate location (country, region, city).

Google derives the location from your IP address. According to Google, for users in the EU this happens on servers in the EU, and the IP address is discarded before any data is stored. To recognise you on later visits, Google Analytics sets cookies with a random identifier (“_ga” and “_ga_…”, up to two years). Google signals and any link to your Google account are switched off; the event data collected is deleted automatically after 14 months.

The legal basis is your consent (Art. 6(1)(a) GDPR, Section 25(1) TDDDG), which you can withdraw at any time through “Privacy settings”. Google processes the data as my processor; an agreement under Art. 28 GDPR is in place. Data may be transferred to Google LLC in the USA. This is based on the adequacy decision for the EU-US Data Privacy Framework, under which Google is certified, and additionally on the EU Standard Contractual Clauses.

More: Google’s privacy policy and How Google uses information from sites that use its services.

Advertising with Google AdSense

The website is free and funded by ads that Google places through its AdSense service.

With your consent, third-party vendors, including Google, use cookies and similar technologies to show you ads based on your prior visits to this and other websites: Google’s use of advertising cookies enables it and its partners to serve ads based on those visits. They also use them to measure how ads perform and to prevent fraud. Depending on which purposes you agree to, the ads are personalised or not. Google’s advertising cookies (such as “IDE” or “__gads”) are kept for up to 13 months. Which partners are involved, what they process data for and where to find their privacy policies is shown in “Privacy settings”. The legal basis is your consent (Art. 6(1)(a) GDPR, Section 25(1) TDDDG).

Without your consent, Google shows only ads for which, according to Google, no cookies or other storage on your device are used. To deliver an ad and prevent fraud, Google still processes technical data such as your IP address, browser information and the page you are on. The legal basis for this is Art. 6(1)(f) GDPR; my legitimate interest is to fund the free service through advertising.

I am responsible for embedding the ads and for the transmission to Google and its partners that this triggers; what happens to the data afterwards is decided by Google and by each partner as independent controllers. Google may transfer data to Google LLC in the USA, which is certified under the EU-US Data Privacy Framework. Some partners are also based outside the EU. Where there is no adequacy decision for their country, the transfer is based on your consent (Art. 49(1)(a) GDPR). There is a risk that authorities there access the data and that you have less legal protection than in the EU.

You can also turn off personalised advertising here:

• for Google, in your Google ad settings,
• for other providers, at youronlinechoices.eu or aboutads.info.

More: How Google uses cookies in advertising and Google’s privacy policy.

Your rights

You have the right

• to access the data I process about you (Art. 15 GDPR),
• to have inaccurate data rectified (Art. 16 GDPR),
• to erasure (Art. 17 GDPR) and to restriction of processing (Art. 18 GDPR),
• to receive your data in a common, machine-readable format, insofar as I process it on the basis of your consent or a contract (Art. 20 GDPR),
• to withdraw a consent at any time with effect for the future (Art. 7(3) GDPR).

An email to info@countries-visited.com is enough. I cannot attribute most of the data generated by your visit to any person. In that case I can only give you information if you provide additional details that allow me to identify you (Art. 11(2) GDPR). I cannot see what is stored only in your browser; you delete that there yourself.

You can also lodge a complaint with a data protection supervisory authority, in particular in the EU member state where you habitually live or work or where the alleged infringement took place (Art. 77 GDPR).

Further information

You are under no legal or contractual obligation to provide me with personal data. Without the connection data, however, the website cannot be delivered.

Every feature of the map remains available to you even if you give no consent.

No automated individual decision-making within the meaning of Art. 22 GDPR takes place.

I update this privacy policy when the website or the law changes. The version published here applies.