Privacy Policy

In brief

We process only the data that is technically necessary for the service: the URL you enter, short-lived temporary files for the download, your IP address in the server log files and for limiting the number of requests. None of this is stored permanently, combined with other data or evaluated for advertising purposes.

The only thing stored on your device is your own choice of colour scheme (light, dark or automatic). It is kept in your browser's local storage under the key "theme", never leaves your device and is not transmitted to us. The legal basis is § 25 (2) no. 2 TDDDG (German Telecommunications Digital Services Data Protection Act); you can delete the entry at any time via your browser's site data settings.

Introduction

Thank you for your interest in Nabbly. Data protection is of particularly high importance to the management of Digitmedia e.K. Nabbly can be used without providing any personal data; there is no user account and no login. Where the processing of personal data is necessary and there is no statutory basis for such processing, we generally obtain the consent of the data subject.

The processing of personal data, such as the IP address or email address of a data subject, is always carried out in accordance with the General Data Protection Regulation (GDPR, German: DSGVO) and in compliance with the country-specific data protection regulations applicable to Digitmedia e.K. By means of this privacy policy, we wish to inform the public about the nature, scope and purpose of the personal data we collect, use and process. Furthermore, data subjects are informed of the rights to which they are entitled.

As the controller, Digitmedia e.K. has implemented technical and organisational measures to ensure the most complete protection possible of personal data processed through this website. However, internet-based data transmissions can in principle have security gaps, so absolute protection cannot be guaranteed. For this reason, every data subject is free to transmit personal data to us by alternative means, for example by telephone.

1. Definitions

This privacy policy is based on the terms used by the European legislator when adopting the General Data Protection Regulation (GDPR). It is intended to be easy to read and understand for the public as well as for our users. To ensure this, we would like to explain the terms used in advance.

In this privacy policy we use, among others, the following terms:

a) Personal data

Personal data means any information relating to an identified or identifiable natural person (hereinafter "data subject"). An identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person.

b) Data subject

Data subject is any identified or identifiable natural person whose personal data is processed by the controller responsible for the processing.

c) Processing

Processing is any operation or set of operations which is performed on personal data or on sets of personal data, whether or not by automated means, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction.

d) Restriction of processing

Restriction of processing is the marking of stored personal data with the aim of limiting their processing in the future.

e) Profiling

Profiling means any form of automated processing of personal data consisting of the use of personal data to evaluate certain personal aspects relating to a natural person, in particular to analyse or predict aspects concerning that natural person's performance at work, economic situation, health, personal preferences, interests, reliability, behaviour, location or movements.

f) Pseudonymisation

Pseudonymisation is the processing of personal data in such a manner that the personal data can no longer be attributed to a specific data subject without the use of additional information, provided that such additional information is kept separately and is subject to technical and organisational measures to ensure that the personal data are not attributed to an identified or identifiable natural person.

g) Controller

Controller or controller responsible for the processing is the natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of the processing of personal data. Where the purposes and means of such processing are determined by Union or Member State law, the controller or the specific criteria for its nomination may be provided for by Union or Member State law.

h) Processor

Processor is a natural or legal person, public authority, agency or other body which processes personal data on behalf of the controller.

i) Recipient

Recipient is a natural or legal person, public authority, agency or another body, to which the personal data are disclosed, whether a third party or not. However, public authorities which may receive personal data in the framework of a particular inquiry in accordance with Union or Member State law shall not be regarded as recipients.

j) Third party

Third party is a natural or legal person, public authority, agency or body other than the data subject, controller, processor and persons who, under the direct authority of the controller or processor, are authorised to process personal data.

k) Consent

Consent of the data subject is any freely given, specific, informed and unambiguous indication of the data subject's wishes by which he or she, by a statement or by a clear affirmative action, signifies agreement to the processing of personal data relating to him or her.

2. Name and address of the controller

The controller within the meaning of the General Data Protection Regulation, other data protection laws applicable in the Member States of the European Union and other provisions of a data protection nature is:

We have not appointed a data protection officer, as we are not legally required to do so (Art. 37 GDPR, § 38 BDSG). Please send data protection enquiries to support@digitmedia.de.

3. Server log files

When you access Nabbly, the server automatically stores access data in log files: the address requested, date and time of access, the amount of data transferred, the HTTP status code, the previously visited page (referrer), browser type and version, the operating system and the IP address of the accessing system. The IP address is personal data.

The legal basis is Art. 6 (1) (f) GDPR. Our legitimate interest is the technically error-free delivery of the website, its stability and the defence against attacks. This data is not combined with other data sources, evaluated for advertising purposes or used to draw conclusions about individual persons.

The log files are automatically deleted after 14 days. In the event of a documented attack, we retain the affected entries until the incident has been resolved.

4. Processing of the URLs you enter

The core of Nabbly is the processing of the address (URL) you paste into the input field. The URL is transmitted to our server in encrypted form. The server checks whether it belongs to YouTube or Instagram, retrieves the publicly available metadata of the post (title, author, thumbnail, duration, available formats) and, at your request, downloads the media file from the respective platform.

The retrieval from YouTube or Instagram is carried out by our server on our own behalf. Your IP address, your browser and other details about your device are not transmitted to the platforms; the platforms only see the request from our server. Thumbnails are also delivered via our server, so your browser does not establish a direct connection to YouTube or Instagram. Conversely, we do not receive any data about you from the platforms.

A URL may contain personal data, for example a username in the path. We process the URL and the retrieved metadata exclusively in memory in order to provide you with the preview and the download. The metadata is cached for a maximum of 10 minutes so that repeated requests for the same URL do not have to be fetched from the platform again. Submitted URLs are not stored permanently, linked to your IP address or evaluated to determine which content individual persons retrieve.

The legal basis is Art. 6 (1) (b) GDPR (provision of the service you requested) and, insofar as your IP address is processed for the transmission, Art. 6 (1) (f) GDPR.

5. Temporary files

For a download, our server creates a temporary file, for example when video and audio tracks are merged, an audio track is converted to MP3 or several images are bundled into a ZIP archive. The file is stored in a temporary directory on the server and can only be accessed via a randomly generated job identifier known solely to your browser.

The file is automatically deleted no later than 15 minutes after completion. Cancelled or failed jobs are cleaned up as well; a single job runs for a maximum of 10 minutes. No backup copies are made, we do not inspect the files and we do not link them to you as a person. Once deleted, the content cannot be recovered.

The legal basis is Art. 6 (1) (b) GDPR (provision of the download you requested).

6. Request limiting (rate limiting) and IP address

To prevent abuse and overload, our server limits the number of requests per IP address and minute (currently 20 analyses and 10 downloads). For this purpose, your IP address is held together with a counter in the server's memory. The counter expires at the end of the respective minute; the IP address is not stored in a database or file for this purpose.

The legal basis is Art. 6 (1) (f) GDPR. Our legitimate interest is the stable operation of the service for all users and the defence against automated mass requests.

7. No ads, no cookies

Nabbly is built so that visiting the website sends no data to third parties. In detail:

• No advertising: no ads are shown and no ad networks are embedded.
• No cookies: Nabbly sets neither its own nor third-party cookies. That is why there is no cookie or consent banner. The audience measurement described in the next section also works without cookies.
• No third-party services: no third-party tracking pixels, no fingerprinting techniques and no social media plugins are used. Audience measurement runs solely on our own Matomo installation, see the next section.
• No external resources: fonts, scripts, stylesheets and icons are served from our own server; there is no connection to content delivery networks or third-party font services.

The only exception is a technically necessary entry in your browser's local storage (localStorage) under the key "theme". It only remembers your choice of colour scheme (light, dark or automatic), contains no personal data, is not transmitted to us and can be deleted at any time via your browser's site data settings. The legal basis is § 25 (2) no. 2 TDDDG (strictly necessary to provide the display you have explicitly requested).

8. Audience measurement with Matomo (cookie-free)

We use Matomo, an open source web analytics software, to understand how Nabbly is used. We host Matomo ourselves on our own infrastructure at analytics.digitmedia.de. The data collected never leaves our systems: it is not shared with third parties, not sold and not transferred to countries outside the European Union.

What is recorded

• Pages visited, time of the visit and time spent on the page
• Shortened IP address (see below)
• The page you came from, if your browser sends it (referrer), and the search terms if you arrived via a search engine
• Details about your device: browser and version, operating system, device type, screen resolution and language setting
• Approximate location at country and region level, derived from the shortened IP address
• Clicks on links to other websites and downloads you start

No cookies, no access to your device

Our Matomo installation runs with the “disableCookies” setting. No cookies are set, and no information is read from or stored on your device. Section 25 of the German TDDDG therefore does not apply, no consent is required, and Nabbly still works without a cookie banner. Repeat visits are grouped only by a short-lived identifier that Matomo derives from technical details and that changes every day.

IP address

Your IP address is shortened before it is stored (IP anonymisation). This means we cannot link the statistics to you personally.

Legal basis and legitimate interest

The legal basis is Article 6(1)(f) GDPR. Our legitimate interest is to understand how Nabbly is used, to spot technical faults and to improve the service. Because the measurement works without cookies, the IP address is shortened and the data stays on our own servers, the impact on your rights is low.

“Do Not Track”

We honour your browser's “Do Not Track” setting. If it is switched on, nothing is recorded – you do not need to do anything else.

Retention period

The results are kept as aggregated statistics. The underlying individual records are deleted after 24 months at the latest.

Objection

You can object to the audience measurement at any time with effect for the future (Article 21 GDPR). The button below switches the measurement off for this browser. So that your objection is remembered, Matomo stores an entry in your browser; that entry serves no other purpose. If you clear your browser's site data, you will need to object again.

9. Contact by email and phone

If you write to us or call us, we process the details you provide – name, email address or phone number and the content of your enquiry – in order to handle the enquiry. The legal basis is Art. 6 (1) (b) GDPR insofar as your enquiry is aimed at concluding or performing a contract, and otherwise Art. 6 (1) (f) GDPR (legitimate interest in responding to enquiries).

We delete enquiries once they have been dealt with and no statutory retention obligations apply, usually no later than six months after the last correspondence. If the enquiry leads to an order, the commercial and tax law retention periods of six and ten years respectively apply (§ 257 HGB, § 147 AO). Data is not passed on to third parties.

Email is not confidential without additional measures. For confidential messages, we provide a PGP key at https://www.digitmedia.de/keys/.

10. Hosting and encrypted transmission

Nabbly is operated on a server of Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany, in a data centre located in Germany. Hetzner processes the data generated when the site is accessed – see section 3 – exclusively on our behalf and in accordance with our instructions; the basis is a data processing agreement pursuant to Art. 28 GDPR. The temporary files described in section 5 are also stored exclusively on this server.

The website is delivered exclusively via HTTPS. The connection between your browser and the server is encrypted according to the state of the art (TLS).

11. Routine erasure and blocking of personal data

The controller processes and stores the personal data of the data subject only for the period necessary to achieve the purpose of storage, or where this is provided for by the European legislator or another legislator in laws or regulations to which the controller is subject.

If the purpose of storage no longer applies or if a storage period prescribed by the European legislator or another competent legislator expires, the personal data is routinely blocked or erased in accordance with statutory provisions. Specifically for Nabbly: server log files 14 days, metadata cache 10 minutes, temporary files 15 minutes, rate limiting counters one minute.

12. Rights of the data subject

a) Right to confirmation

Every data subject has the right granted by the European legislator to obtain from the controller confirmation as to whether or not personal data concerning him or her is being processed. If a data subject wishes to exercise this right of confirmation, he or she may contact us at any time.

b) Right of access

Every data subject affected by the processing of personal data has the right to obtain from the controller, free of charge and at any time, information about the personal data stored about him or her and a copy of this information. Furthermore, the data subject is entitled to access the following information:

• the purposes of the processing
• the categories of personal data concerned
• the recipients or categories of recipients to whom the personal data have been or will be disclosed, in particular recipients in third countries or international organisations
• where possible, the envisaged period for which the personal data will be stored, or, if not possible, the criteria used to determine that period
• the existence of the right to request from the controller rectification or erasure of personal data, or restriction of processing of personal data concerning the data subject, or to object to such processing
• the existence of the right to lodge a complaint with a supervisory authority
• where the personal data are not collected from the data subject: any available information as to their source
• the existence of automated decision-making, including profiling, referred to in Art. 22 (1) and (4) GDPR and, at least in those cases, meaningful information about the logic involved, as well as the significance and envisaged consequences of such processing for the data subject

Furthermore, the data subject has the right to obtain information as to whether personal data are transferred to a third country or to an international organisation. Where this is the case, the data subject has the right to be informed of the appropriate safeguards relating to the transfer. If a data subject wishes to exercise this right of access, he or she may contact us at any time.

c) Right to rectification

Every data subject affected by the processing of personal data has the right to obtain without undue delay the rectification of inaccurate personal data concerning him or her. Taking into account the purposes of the processing, the data subject also has the right to have incomplete personal data completed, including by means of providing a supplementary statement. If a data subject wishes to exercise this right to rectification, he or she may contact us at any time.

d) Right to erasure (right to be forgotten)

Every data subject affected by the processing of personal data has the right to obtain from the controller the erasure of personal data concerning him or her without undue delay where one of the following grounds applies and insofar as the processing is not necessary:

• The personal data are no longer necessary in relation to the purposes for which they were collected or otherwise processed.
• The data subject withdraws the consent on which the processing is based according to Art. 6 (1) (a) GDPR or Art. 9 (2) (a) GDPR, and there is no other legal ground for the processing.
• The data subject objects to the processing pursuant to Art. 21 (1) GDPR and there are no overriding legitimate grounds for the processing, or the data subject objects to the processing pursuant to Art. 21 (2) GDPR.
• The personal data have been unlawfully processed.
• The personal data must be erased for compliance with a legal obligation in Union or Member State law to which the controller is subject.
• The personal data have been collected in relation to the offer of information society services referred to in Art. 8 (1) GDPR.

If one of the aforementioned grounds applies and a data subject wishes to request the erasure of personal data stored by Digitmedia e.K., he or she may contact us at any time. We will ensure that the erasure request is complied with without undue delay.

Where Digitmedia e.K. has made personal data public and is obliged pursuant to Art. 17 (1) GDPR to erase the personal data, Digitmedia e.K., taking account of available technology and the cost of implementation, shall take reasonable steps, including technical measures, to inform other controllers processing the published personal data that the data subject has requested the erasure by such controllers of any links to, or copies or replications of, those personal data, insofar as processing is not required. We will arrange the necessary measures in individual cases.

e) Right to restriction of processing

Every data subject affected by the processing of personal data has the right to obtain from the controller restriction of processing where one of the following applies:

• The accuracy of the personal data is contested by the data subject, for a period enabling the controller to verify the accuracy of the personal data.
• The processing is unlawful and the data subject opposes the erasure of the personal data and requests the restriction of their use instead.
• The controller no longer needs the personal data for the purposes of the processing, but they are required by the data subject for the establishment, exercise or defence of legal claims.
• The data subject has objected to processing pursuant to Art. 21 (1) GDPR pending the verification whether the legitimate grounds of the controller override those of the data subject.

If one of the aforementioned conditions is met and a data subject wishes to request the restriction of personal data stored by Digitmedia e.K., he or she may contact us at any time. We will arrange the restriction of processing.

f) Right to data portability

Every data subject affected by the processing of personal data has the right to receive the personal data concerning him or her, which he or she has provided to a controller, in a structured, commonly used and machine-readable format. He or she also has the right to transmit those data to another controller without hindrance from the controller to which the personal data have been provided, where the processing is based on consent pursuant to Art. 6 (1) (a) GDPR or Art. 9 (2) (a) GDPR or on a contract pursuant to Art. 6 (1) (b) GDPR, and the processing is carried out by automated means, provided that the processing is not necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller. Furthermore, in exercising his or her right to data portability pursuant to Art. 20 (1) GDPR, the data subject has the right to have the personal data transmitted directly from one controller to another, where technically feasible and provided this does not adversely affect the rights and freedoms of others. To assert the right to data portability, the data subject may contact us at any time.

g) Right to object under Art. 21 GDPR

h) Automated individual decision-making, including profiling

Every data subject affected by the processing of personal data has the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning him or her, or similarly significantly affects him or her, as long as the decision (1) is not necessary for entering into, or the performance of, a contract between the data subject and the controller, or (2) is not authorised by Union or Member State law to which the controller is subject and which also lays down suitable measures to safeguard the data subject's rights and freedoms and legitimate interests, or (3) is not based on the data subject's explicit consent. If the decision (1) is necessary for entering into, or the performance of, a contract between the data subject and the controller, or (2) it is based on the data subject's explicit consent, Digitmedia e.K. shall implement suitable measures to safeguard the data subject's rights and freedoms and legitimate interests, at least the right to obtain human intervention on the part of the controller, to express his or her point of view and to contest the decision. If the data subject wishes to exercise rights concerning automated decisions, he or she may contact us at any time.

i) Right to withdraw consent under data protection law

Every data subject affected by the processing of personal data has the right to withdraw his or her consent to the processing of personal data at any time. If the data subject wishes to exercise the right to withdraw consent, he or she may contact us at any time.

j) Right to lodge a complaint with a supervisory authority

Without prejudice to any other remedy, you have the right under Art. 77 GDPR to lodge a complaint with a data protection supervisory authority. The authority responsible for us is the State Commissioner for Data Protection and Freedom of Information of North Rhine-Westphalia (Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen), Kavalleriestr. 2–4, 40213 Düsseldorf, Germany, phone +49 211 38424-0, poststelle@ldi.nrw.de, www.ldi.nrw.de.

Exercising your rights

To exercise any of the rights listed above, an informal message to support@digitmedia.de or to Digitmedia e.K., Gertrudstr. 17, 44388 Dortmund, Germany is sufficient. We respond free of charge and within one month (Art. 12 (3) GDPR). Please note: since Nabbly does not permanently store submitted URLs or temporary files and does not link them to individuals, we are generally unable to provide information about individual downloads because we no longer hold this data.

13. Legal basis for the processing

Art. 6 (1) (a) GDPR serves as the legal basis for processing operations for which we obtain consent for a specific processing purpose. If the processing of personal data is necessary for the performance of a contract to which the data subject is party – at Nabbly, the provision of the preview and of the download you requested – the processing is based on Art. 6 (1) (b) GDPR. The same applies to processing operations that are necessary for carrying out pre-contractual measures, for example in the case of enquiries about our services.

If our company is subject to a legal obligation that requires the processing of personal data, such as for the fulfilment of tax obligations, the processing is based on Art. 6 (1) (c) GDPR. In rare cases, the processing of personal data may be necessary to protect the vital interests of the data subject or of another natural person; in that case the processing would be based on Art. 6 (1) (d) GDPR.

Finally, processing operations may be based on Art. 6 (1) (f) GDPR. This legal basis applies to processing operations not covered by any of the aforementioned legal grounds if the processing is necessary for the purposes of the legitimate interests pursued by our company or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject. At Nabbly this concerns the server log files, the technical transmission of your IP address and rate limiting (recitals 47 and 49 GDPR).

14. Legitimate interests in the processing

Where the processing of personal data is based on Art. 6 (1) (f) GDPR, our legitimate interest is the secure, stable and abuse-free operation of Nabbly and the conduct of our business.

15. Period for which the personal data will be stored

The criterion for the duration of storage of personal data is the respective purpose or the respective statutory retention period. After expiry of that period, the corresponding data is routinely deleted, provided it is no longer required for the performance or initiation of a contract.

• Server log files: 14 days (longer only in the event of a documented attack, until it is resolved)
• Submitted URLs and metadata: in memory only, cached for a maximum of 10 minutes
• Temporary download files: a maximum of 15 minutes after completion
• Rate limiting counters: one minute
• Email and phone enquiries: until they are dealt with, usually no more than six months; for orders, the statutory periods of six and ten years respectively

16. Provisions on the provision of personal data

You do not have to provide any personal data to use Nabbly. The transmission of your IP address is technically unavoidable so that our server can deliver the page and the requested files to you; without it, use of the service is not possible.

Beyond that, we would like to inform you that the provision of personal data is in some cases required by law (e.g. tax regulations) or may result from contractual provisions (e.g. information on the contractual partner). Sometimes it may be necessary for a data subject to provide us with personal data in order to conclude a contract, which must subsequently be processed by us. Failure to provide the personal data would mean that the contract could not be concluded. We will be happy to clarify on a case-by-case basis in advance whether the provision of personal data is required by law or contract or is necessary for the conclusion of a contract, whether there is an obligation to provide the data and what the consequences of not providing it would be.

17. Existence of automated decision-making

As a responsible company, we do not use automated decision-making or profiling. Rate limiting (section 6) merely limits the number of requests per minute and does not make any decision with legal effect concerning individual persons.

18. Changes to this privacy policy

We adapt this privacy policy when the service or the legal situation changes. The version published on this page at any given time applies; you will find the date of the last change at the top under "Last updated".

The general sections of this policy are based on the privacy policy generator of DGD Deutsche Gesellschaft für Datenschutz GmbH in cooperation with data protection lawyer Christian Solmecke and have been adapted and supplemented for Nabbly. In case of doubt, the German version prevails.