Privacy

1. Controller and contact

2. Website delivery and hosting

When you access the website, connection and access data are transmitted to the web server delivering it. These include your IP address, the time and target of the request, and browser and device information transmitted technically. Depending on server configuration, access logs may also contain the referrer, response status and volume of data transferred.

Processing serves to deliver the requested content, maintain stable operation and detect and prevent technical faults and abusive access. The legal basis is Article 6(1)(f) GDPR. The legitimate interests are the secure and functional provision of this website.

Hosting provider

STRATO GmbH
Otto-Ostrowski-Straße 7, 10249 Berlin, Deutschland

Processing locations

STRATO describes processing of hosting data in its data centres in Germany.

Access log retention

According to STRATO, IP addresses are retained for a maximum of seven days to detect and prevent attacks. The web server logs available in the customer area are separate: STRATO describes these as containing anonymised IP or hostname information and makes them available for the previous six weeks.

Hosting provider privacy notice

STRATO: privacy and IP retention
STRATO: web server logs and statistics

3. Email enquiries and email preparation

When you contact us by email, we process the information you send, in particular your name, email address, message content and, where applicable, information about your business or project. This is done to handle your enquiry and communicate with you.

Where processing is necessary to perform a contract with you or take steps at your request before entering into a contract, it is based on Article 6(1)(b) GDPR. Other enquiries are handled under Article 6(1)(f) GDPR; our legitimate interest is to respond appropriately to incoming requests.

The “Prepare email” feature initially processes your entries only in your browser. When you use it, the entered information is placed in an email draft and passed to your chosen email application. The website does not send the form to a form server or send the message itself. We receive its content only when you send the prepared email. Your email provider’s privacy notice also applies to its transmission and processing.

For receiving and handling email we use: Microsoft / Exchange Online; Microsoft Ireland Operations Limited, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, D18 P521, Irland. Email provider privacy notice

For email communication, message content, sender and recipient details, attachments and technical communication data are processed by the Microsoft email service. The service supports mailbox delivery and security, including spam and malware detection. Processing of business customer data is also governed by the Microsoft contractual terms applicable to the service used and the Microsoft Data Protection Addendum (DPA).

Microsoft Products and Services Data Protection Addendum (DPA)

4. Local content, cookies and external links

Font files, images, stylesheets and scripts are delivered with this website. The website does not integrate external font services, advertising or analytics tools, or embedded maps or videos. Loading this content therefore does not establish an additional connection to such a third-party provider.

The provided website does not itself set cookies or store usage or form data in local storage or session storage. The selected language follows the page address you open. This website does not request consent for optional analytics or marketing technologies because none are integrated. Normal browser functions, such as caching or autofill configured by you, are unaffected.

External websites, for example a linked project website, are only accessed when you click the relevant link. Processing by the external operator then follows that operator’s own privacy notice.

The WhatsApp button is an external link. Simply loading this website does not connect to WhatsApp; no WhatsApp widget is embedded. WhatsApp opens in your browser or app only when you click the button. WhatsApp’s privacy notice applies to processing there. If you send us a message using that service, we process the contact details and messages you provide to handle your enquiry on the legal bases described above. You can alternatively contact us by email or telephone.

5. Recipients and international transfers

Access to personal data is limited to persons and service providers who need it for the stated purposes, in particular the hosting and email providers actually used. Disclosure may also be required to comply with a legal obligation or establish, exercise or defend legal claims. The legal basis follows the respective purpose, in particular Article 6(1)(c) or (f) GDPR.

For service providers processing personal data on our behalf, the requirements of Article 28 GDPR apply. The services and contracts actually agreed are relevant.

When the Microsoft email service is used, affiliated companies and subprocessors outside the European Economic Area, particularly in the USA, may be involved in processing, for example for operations, security or support. The contractual terms applicable to the service and safeguards under Articles 44 et seq. GDPR are relevant, in particular the standard contractual clauses provided in Microsoft’s Data Protection Addendum. An adequacy decision may apply where its conditions are met. The Microsoft EU Data Boundary includes commitments for processing data in Europe for covered services and customer configurations, but provides for limited exceptions. Processing of all Microsoft data exclusively within Germany or the EU is therefore not promised.

6. Retention periods

Enquiry data are retained only as long as necessary to handle the request and, where applicable, continue the correspondence. If an enquiry results in a contractual relationship, further processing follows the related purposes and statutory requirements.

Data are deleted when the respective purpose no longer applies and no statutory retention obligation or legitimate reason for further storage exists. Records subject to commercial or tax retention requirements are retained for the applicable statutory periods. Retention necessary to comply with a legal obligation is based on Article 6(1)(c) GDPR.

Information about the different STRATO access logs and their retention periods is provided in the website delivery and hosting section.

7. Your data protection rights

Subject to the applicable legal conditions, your rights include:

• Access to personal data processed about you (Article 15 GDPR).
• Rectification of inaccurate data and completion of incomplete data (Article 16 GDPR).
• Erasure of personal data where no exception applies (Article 17 GDPR).
• Restriction of processing (Article 18 GDPR).
• Data portability for automated processing based on consent or a contract (Article 20 GDPR).

Where processing is based on your consent, you may withdraw it at any time with future effect under Article 7(3) GDPR. The lawfulness of processing before withdrawal is unaffected. To exercise your rights, use the privacy contact address above.

8. Right to object

Where processing is based on legitimate interests under Article 6(1)(f) GDPR, you may object under Article 21(1) GDPR on grounds relating to your particular situation. Processing will then cease unless compelling legitimate grounds or grounds relating to legal claims justify its continuation.

You may object at any time to processing for direct marketing under Article 21(2) GDPR. You can exercise your right by writing to the privacy contact address.

9. Right to lodge a complaint

Under Article 77 GDPR, you may lodge a complaint with a data protection supervisory authority, in particular in the member state of your habitual residence, workplace or the place of an alleged infringement. For the location in Idstein, the following supervisory authority is particularly relevant:

10. AI images, security and changes

The AI-generated images are delivered locally with the website as finished image files. Viewing them does not send visitor data to an AI service. This website does not provide a chatbot, an AI input function or automated decisions about visitors.

The website is intended to be accessed through a transport-encrypted HTTPS connection. This notice is updated when the services or processing activities change. Other services provided in a specific client project are outside the scope of this website notice.