Free lockers at a glance

1. Data controller

The controller within the meaning of the General Data Protection Regulation (GDPR) is:
FabStack GmbH
Schötmarsche Straße 51
32791 Lage
Email: info@fabstack.de

2. General information

Locker Visual Control is a web-based application used by operators of pools, spas, and leisure facilities to display the occupancy of their locker systems live. Use requires a user account and login. We use a technically necessary session cookie to maintain your login status (see section 3) as well as, with your consent, Google Analytics for reach measurement (see section 4). Beyond that, no third-party analytics, tracking, or marketing services are used. Fonts are loaded locally from our server; no connection is made to font provider servers.

3. Cookies

After logging in, we set a technically necessary session cookie that keeps your session active while you use the application. It is deleted when the session ends or you log out, and is not used for analytics or marketing purposes. The legal basis is Art. 6(1)(b) GDPR (performance of the usage agreement) or Art. 6(1)(f) GDPR (legitimate interest in a secure, functional login).

On your first visit to our website, we show you a cookie banner where you can choose between "Necessary only", "Accept all", and individual settings for the statistics and marketing categories. The statistics category activates Google Analytics for general reach measurement; the marketing category additionally activates campaign-related evaluation of registrations for individual advertisements (see section 4). Both categories are only set after your explicit consent (Art. 6(1)(a) GDPR, § 25(1) TTDSG). Your choice is stored locally in your browser and can be changed at any time via the "Cookie settings" link in the footer.

4. Google Analytics

We embed Google Analytics' loading script, a web analytics service provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland ("Google"), on all pages for technical reasons. For visitors from the EU, the rest of the European Economic Area, the United Kingdom, and Switzerland, however, it is configured by default (Google Consent Mode) so that no cookies are set and no data attributable to you is processed without your consent. Only once you consent to the "Statistics" category via the cookie banner does Google Analytics set cookies and similar technologies that allow an analysis of your use of our website, such as pages visited, time spent, and the origin of visits. The information generated in this way is transmitted to and processed on Google's servers, including in the USA. The legal basis is your consent (Art. 6(1)(a) GDPR, § 25(1) TTDSG). You can withdraw your consent at any time with effect for the future via the "Cookie settings" link in the footer. For more information on how Google Analytics handles user data, please see Google's privacy policy.

In addition, we use Google Analytics to record when a user successfully registers with us (a "sign_up" event), as well as which advertisement or campaign (e.g. Google Ads or LinkedIn) originally led to the visit. To do this, we evaluate the campaign parameters contained in the respective ad URL (including UTM parameters, and for Google Ads also the click ID "gclid"). This evaluation is used to assess the effectiveness of our campaigns separately for each provider. We do not use LinkedIn's own tracking pixel ("LinkedIn Insight Tag"); no data is transmitted to LinkedIn. This evaluation requires that you have consented to the "Marketing" category in the cookie banner in addition to the "Statistics" category; without this consent, no campaign-related evaluation takes place in the regions listed in section 3. The legal basis here is also your consent (Art. 6(1)(a) GDPR, § 25(1) TTDSG). If you share the result of the campaign evaluation with a linked Google Ads account, Google Ireland Limited also processes this data under Google's own privacy policy.

5. Server log files

When you access this website or application, our hosting provider automatically collects information in what are known as server log files, which your browser automatically transmits: IP address, date and time of the request, page accessed, browser and operating system used, and the referrer URL. This data is used to ensure trouble-free operation, error analysis, and defense against attacks. The legal basis is Art. 6(1)(f) GDPR (legitimate interest in secure and stable operation). The log files are deleted after 14 days at the latest, unless they are needed to investigate a specific security incident. We have a data processing agreement with our hosting provider (Art. 28 GDPR).

6. Registration and user account

When you register, we process the data you provide (facility name, name, email address, password in hashed form) solely to set up and provide your access and to manage your contractual relationship with us. The legal basis is Art. 6(1)(b) GDPR (performance of a contract).

7. Payment processing

For paid subscriptions, payment is processed via the payment service provider PayPal (PayPal (Europe) S.à r.l. et Cie, S.C.A., 22-24 Boulevard Royal, L-2449 Luxembourg). The data required for payment processing (including amount, transaction ID) is transmitted to PayPal. The legal basis is Art. 6(1)(b) GDPR (performance of a contract). For more information on data processing by PayPal, please see PayPal's privacy policy.

8. Locker occupancy data

For the live display of locker occupancy, the application retrieves locker numbers and their occupancy status via the cloud interface of the respective Ojmar locking system (OTS 40 / Pulse). No personal data of the facility's guests is processed or displayed in doing so.

9. Contacting us

If you contact us by email, we process the data you provide (name, email address, phone number if applicable, content of the message) to handle your inquiry. The legal basis is Art. 6(1)(b) GDPR if your inquiry relates to entering into or performing a contract, otherwise Art. 6(1)(f) GDPR (legitimate interest in responding to inquiries).

10. Retention period

The data is stored for the duration of the contractual relationship and deleted after its end in accordance with the statutory retention periods, unless a statutory retention obligation applies.

11. Your rights

You have the following rights with respect to us regarding the personal data concerning you:

Right of access (Art. 15 GDPR)
Right to rectification (Art. 16 GDPR)
Right to erasure (Art. 17 GDPR)
Right to restriction of processing (Art. 18 GDPR)
Right to data portability (Art. 20 GDPR)
Right to object to processing (Art. 21 GDPR)

You also have the right to lodge a complaint with a data protection supervisory authority. The authority responsible for us is the North Rhine-Westphalia State Commissioner for Data Protection and Freedom of Information (LDI NRW), Kavalleriestr. 2-4, 40213 Düsseldorf, Germany.

12. No automated decision-making

No automated decision-making, including profiling, takes place.

Last updated: August 2026

Privacy Policy