Privacy policy
In short: this website processes no personal data on a server, because there is no server that could process anything. Everything you type into the questionnaire stays in your browser. There are no cookies, no analytics, no advertising and no third-party embeds.
1. Controller
Controller within the meaning of Art. 4(7) GDPR:
Thomas Boyle
Mühlenbecker Straße 29, 16552 Schildow, Germany
Email: thomas.david.boyle@googlemail.com
No data protection officer has been appointed. There is no legal requirement to do so for this non-commercial service run by a single individual (Art. 37 GDPR, § 38 German Federal Data Protection Act).
2. What you enter in the questionnaire
Your answers about past donations, tattoos, vaccinations, procedures, travel and health are health data and therefore a special category of personal data under Art. 9(1) GDPR. That is precisely why this application is built so that such data never leaves your browser and is never stored anywhere – not even optionally:
- The evaluation runs entirely as JavaScript inside your browser.
- Nothing is transmitted to a server. There is no interface it could be transmitted to.
- Your answers exist only in the memory of the open page – never in
localStorage, never in a cookie. Close the tab, or reload the page, and they are gone for good.
The one exception is your language choice (German/English): the key
blutspendecheck.lang is kept in your browser's localStorage so the site
opens in that language next time. It contains nothing but de or en – no
health or other personal data. No legal basis under Art. 6 GDPR is required for this, since no
processing by us takes place; it is stored at your initiative within the meaning of § 25(1) TDDDG.
You can delete this key at any time via your browser settings.
3. No cookies, no tracking
No cookies are set, no usage profiles are built, no identifiers are assigned and no audience measurement takes place. No fonts, scripts, maps or icons are loaded from third parties; every file is served from the same origin as the page. A strict Content Security Policy forbids the browser from connecting to any other host.
4. Postcode
On the result screen you may optionally enter a postcode to complete the link to the DRK
appointment search. The postcode is not stored and not transmitted anywhere. Only when you click the
link does your browser call up the DRK's website, where the DRK's own privacy notice applies. We set
Referrer-Policy: no-referrer, so the site you land on does not learn where you came from.
5. Hosting log files
The site is served as a static website via the network of Cloudflare, Inc. (101 Townsend St, San Francisco, CA 94107, USA), using Cloudflare Pages. When the page is requested, Cloudflare processes technically necessary connection data (including IP address, browser type, operating system, date and time of the request, URL accessed). This is technically necessary to deliver the website to your browser. The legal basis is Art. 6(1)(f) GDPR; the legitimate interest is the secure and stable operation of the website.
We have a data processing agreement with Cloudflare under Art. 28 GDPR. Because Cloudflare, Inc. is based in the United States, this can involve a transfer of data to a third country; that transfer relies on the European Commission's Standard Contractual Clauses. Cloudflare's privacy policy is available at cloudflare.com/privacypolicy. Cloudflare typically retains this log data for up to 30 days.
6. Links to donation services
The site links to services operated by the DRK (German Red Cross), Haema AG, Octapharma Plasma and CSL Plasma. Those providers alone are responsible for their content and their data processing. Nothing is requested from them until you click a link.
7. Your rights
You have the rights set out in Art. 15 to 21 GDPR: access, rectification, erasure, restriction of processing, data portability and objection. Since we never receive or store what you type in, we cannot provide information about it – it exists only with you. For the connection data arising from hosting, please contact the controller named above.
You also have the right to lodge a complaint with a supervisory authority (Art. 77 GDPR), either where you live or with the authority responsible for the controller:
Landesbeauftragte für den Datenschutz und für das Recht auf Akteneinsicht Brandenburg
(the data protection authority for the state of Brandenburg, Germany)
Stahnsdorfer Damm 77, 14532 Kleinmachnow, Germany
lda.brandenburg.de
8. Last updated
26 August 2026