Privacy Policy

Privacy Policy

Preamble
With the following privacy policy, I would like to inform you about the types of your personal data (hereinafter also referred to as "data") that we process, for which purposes, and to what extent. This privacy policy applies to all processing of personal data carried out by us, both in the context of providing our services and, in particular, on our websites, in mobile applications, and within external online presences such as our social media profiles (collectively referred to as the "online offering").

The terms used are not gender-specific.

Date of last update: May 27, 2025

Table of Contents

• Preamble

• Controller

• Overview of Processing

• Legal Basis

• Security Measures

• Disclosure of Personal Data

• International Data Transfers

• General Information on Data Storage and Deletion

• Rights of Data Subjects

• Business Services

• Payment Procedures

• Provision of the Online Offer and Web Hosting

• Registration, Login and User Account

• Blogs and Publications

• Contact and Inquiry Management

• Communication via Messenger

• Newsletter and Electronic Notifications

• Promotional Communication via Email, Mail, Fax or Phone

• Customer Reviews and Rating Procedures

• Presence in Social Networks (Social Media)

• Changes and Updates

Controller
Kathrin Siewert
Blumenweg 14
53343 Wachtberg
Email: kathi21.sie@t-online.de

Overview of Processing
The following overview summarizes the types of processed data and the purposes of processing, as well as the affected persons.

Types of processed data:

• Master data

• Payment data

• Contact data

• Content data

• Contract data

• Usage data

• Meta, communication and procedural data

• Log data

Categories of affected persons:

• Service recipients and clients

• Interested parties

• Communication partners

• Users

• Business and contractual partners

Purposes of processing:

• Provision of contractual services and fulfillment of contractual obligations

• Communication

• Security measures

• Direct marketing

• Office and organizational procedures

• Organizational and administrative procedures

• Feedback

• Marketing

• Provision of our online offer and user-friendliness

• IT infrastructure

• Public relations

• Sales promotion

• Business processes and economic procedures

Legal Basis
The legal bases for data processing under the GDPR are:

• Consent (Art. 6(1)(a) GDPR) – The data subject has given consent to the processing of their personal data for one or more specific purposes.

• Performance of a contract and pre-contractual measures (Art. 6(1)(b) GDPR) – Processing is necessary for the performance of a contract to which the data subject is party or for pre-contractual measures.

• Legal obligation (Art. 6(1)(c) GDPR) – Processing is necessary for compliance with a legal obligation.

• Legitimate interests (Art. 6(1)(f) GDPR) – Processing is necessary for the purposes of legitimate interests pursued by the controller or a third party, provided that the interests or fundamental rights and freedoms of the data subject do not override those interests.

National data protection regulations in Germany also apply, including the Federal Data Protection Act (BDSG), which includes specific provisions on rights of access, deletion, objection, processing of special categories of data, among others. State data protection laws may also apply.

Note on applicability of GDPR and Swiss Data Protection Act (DSG):
These privacy notices also serve to inform according to the Swiss DSG and the GDPR. The terminology of the GDPR is used here for broader applicability and clarity. The legal interpretation of terms will be governed by the respective law applicable.

Security Measures
We take appropriate technical and organizational measures to ensure a level of security appropriate to the risk, including confidentiality, integrity, and availability of data. This includes controlling physical and electronic access to data and procedures for data deletion and breach response. We also implement data protection by design and by default in hardware, software, and procedures.

Securing online connections via TLS/SSL encryption (HTTPS):
To protect user data transmitted via our online services from unauthorized access, we use TLS/SSL encryption technology. SSL and TLS are the foundation of secure data transmission on the internet. These technologies encrypt data transmitted between the website or app and the user’s browser (or between servers), protecting it from unauthorized access. When a website is secured by an SSL/TLS certificate, this is indicated by HTTPS in the URL as a sign of secure and encrypted data transmission.

Disclosure of Personal Data
In the course of processing personal data, we may disclose data to other entities, such as IT service providers or providers of embedded content and services. We observe legal requirements and enter into contracts to protect your data with such recipients.

International Data Transfers
If we transfer data to third countries (outside the EU or EEA), for example when using third-party services, this is always done in accordance with legal requirements.

For transfers to the USA, we rely primarily on the Data Privacy Framework (DPF), recognized by the EU Commission as a safe legal framework as of July 10, 2023. Additionally, we have concluded Standard Contractual Clauses with providers, fulfilling EU Commission requirements to protect your data.

This dual protection ensures comprehensive data security: The DPF is the primary safeguard, while Standard Contractual Clauses provide fallback protection in case of legal or political changes.

Regarding individual service providers, we inform you whether they are certified under the Data Privacy Framework (DPF) and whether Standard Contractual Clauses (SCCs) are in place. Further information about the DPF and a list of certified companies can be found on the website of the U.S. Department of Commerce at https://www.dataprivacyframework.gov/ (in English).

For data transfers to other third countries, appropriate safeguards apply, especially Standard Contractual Clauses, explicit consents, or legally required transfers. Information on third-country transfers and applicable adequacy decisions can be found in the European Commission’s information portal: https://commission.europa.eu/law/law-topic/data-protection/international-dimension-data-protection_en?prefLang=de.

General Information on Data Storage and Deletion
We delete personal data that we process in accordance with legal requirements as soon as the underlying consents are revoked or no other legal basis for processing exists. This applies to cases where the original purpose for processing ceases to exist or the data is no longer needed. Exceptions apply when legal obligations or legitimate interests require longer retention or archiving of the data.

In particular, data that must be retained for commercial or tax law reasons, or whose storage is necessary for legal claims or to protect the rights of other natural or legal persons, will be archived accordingly.

Our privacy notices include additional information on data retention and deletion specifically for certain processing activities.

If multiple retention or deletion periods apply, the longest period shall always be decisive.

If a period does not explicitly start on a specific date and is at least one year, it automatically begins at the end of the calendar year in which the triggering event occurred. In the case of ongoing contractual relationships where data is stored, the triggering event is the effective date of termination or other end of the legal relationship.

Data retained not for the originally intended purpose but due to legal requirements or other reasons will only be processed for the reasons justifying their retention.

Additional Notes on Retention and Deletion Periods under German Law:

• 10 years: Retention period for books and records, annual financial statements, inventories, management reports, opening balance sheets, and related working instructions and organizational documents (§ 147(1)(1) in conjunction with (3) AO, § 14b(1) UStG, § 257(1)(1) in conjunction with (4) HGB).

• 8 years: Accounting documents such as invoices and receipts (§ 147(1)(4) and (4a) in conjunction with (3) AO, § 257(1)(4) in conjunction with (4) HGB).

• 6 years: Other business documents such as received and sent commercial or business letters, documents relevant for taxation (e.g., wage sheets, cost accounting records, pricing documents), payroll records not already accounting documents, and cash receipts (§ 147(1)(2,3,5) in conjunction with (3) AO, § 257(1)(2,3) in conjunction with (4) HGB).

• 3 years: Data required to consider potential warranty and compensation claims or similar contractual claims and rights as well as related inquiries, stored for the duration of the regular statutory limitation period of three years (§§ 195, 199 BGB).

Rights of Data Subjects
Under the GDPR, data subjects have various rights, especially from Articles 15 to 21 GDPR:

• Right to object: You have the right to object at any time to the processing of your personal data based on Art. 6(1)(e) or (f) GDPR for reasons arising from your particular situation; this also applies to profiling based on these provisions. If your data is processed for direct marketing purposes, you have the right to object at any time to such processing, including profiling related to direct marketing.

• Right to withdraw consent: You have the right to withdraw any consent you have given at any time.

• Right of access: You have the right to request confirmation whether your data is being processed and to obtain information about this data, further details, and a copy in accordance with legal provisions.

• Right to rectification: You may request correction or completion of inaccurate or incomplete data.

• Right to erasure and restriction of processing: Subject to legal conditions, you may request immediate deletion or alternatively restriction of processing of your data.

• Right to data portability: You may receive your data provided to us in a structured, commonly used, machine-readable format, or request its transfer to another controller.

• Right to lodge a complaint with a supervisory authority: Without prejudice to other administrative or judicial remedies, you have the right to complain to a supervisory authority, especially in your habitual residence, place of work, or alleged infringement location if you believe the processing violates the GDPR.

Business Services
We process data of our contractual and business partners (e.g., customers and prospects, collectively “contract partners”) in the context of contractual or similar legal relationships and associated measures, as well as communication with contract partners (including pre-contractual).

We use this data to fulfill our contractual obligations, including providing agreed services, updating obligations, remedying defects, and protecting rights. We also process data for administration, organization, and security measures to protect contract partners and business operations from abuse and data breaches (e.g., involvement of telecom, transport, auxiliary services, subcontractors, banks, tax and legal advisors, payment service providers, or tax authorities). Data is disclosed to third parties only to the extent necessary for these purposes or legal obligations.

The necessary data is communicated to contract partners prior to or during collection, e.g., in online forms or personally.

Data is deleted after expiry of statutory warranty and comparable obligations (usually after four years), except where data must be retained for legal archiving purposes (e.g., tax reasons, usually ten years). Data disclosed during a contract is deleted after completion of the order according to the instructions.

Processed data types: Master data (full name, address, contact info, customer number, etc.); payment data (bank info, invoices, payment history); contact data (email, phone); contract data (subject, duration, customer category); usage data (page views, clicks, device type, OS); meta, communication, procedural data (IP address, timestamps, IDs, involved persons).

Data subjects: Service recipients, clients, prospects, business and contract partners.

Purposes: Contractual service delivery and fulfillment; security; communication; office and organizational processes; business procedures.

Retention and deletion: See "General Information on Data Storage and Deletion."

Legal bases: Contract fulfillment and pre-contractual requests (Art. 6(1)(b) GDPR); legal obligations (Art. 6(1)(c)); legitimate interests (Art. 6(1)(f)).

Additional Notes on Processing:

• Online shop, order forms, e-commerce, delivery: We process customer data to enable selection, purchase, payment, and delivery of products and services. For delivery, we engage service providers such as postal, freight, and shipping companies. For payments, we use banks and payment service providers. Required data is clearly marked in order forms and includes contact info for queries. Legal basis: Contract fulfillment (Art. 6(1)(b) GDPR).

• Event management: We process participant data to enable event participation and associated services. If special categories of data (health, religion, politics) are processed, this is done with transparency, for health/safety reasons, or with consent. Required data is marked in contracts or orders. If we access end customer or employee info, processing complies with legal and contractual obligations. Legal basis: Contract fulfillment (Art. 6(1)(b) GDPR).

Payment Methods
Within the scope of contractual and other legal relationships, due to legal obligations, or otherwise based on our legitimate interests, we offer the affected individuals efficient and secure payment options and use, in addition to banks and credit institutions, other service providers (collectively referred to as "payment service providers").

Data processed by the payment service providers include master data such as name and address, bank data such as account numbers or credit card numbers, passwords, TANs, and checksums, as well as contract-, amount-, and recipient-related information. These details are necessary to carry out the transactions. However, the entered data are processed and stored only by the payment service providers. That means we do not receive any account- or credit card-related information but only information confirming or denying the payment. Under certain circumstances, the payment service providers may transmit the data to credit agencies. This transmission serves the purpose of identity and creditworthiness verification. We refer to the terms and conditions and privacy notices of the payment service providers for more details.

The terms and conditions and privacy notices of the respective payment service providers apply to payment transactions and can be accessed on their respective websites or transaction applications. We also refer to these for further information and to assert revocation, information, and other data subject rights.

Types of data processed: Master data (e.g., full name, residential address, contact information, customer number, etc.); payment data (e.g., bank details, invoices, payment history); contract data (e.g., contract subject, duration, customer category); usage data (e.g., page views and dwell time, click paths, usage intensity and frequency, device types and operating systems used, interactions with content and functions); meta-, communication- and procedural data (e.g., IP addresses, timestamps, identification numbers, involved persons).

Data subjects: Service recipients and clients; business and contractual partners; interested parties.

Purposes of processing: Provision of contractual services and fulfillment of contractual obligations; business processes and economic procedures.

Storage and deletion: Deletion in accordance with the section "General Information on Data Storage and Deletion."

Legal basis: Contract performance and pre-contractual inquiries (Art. 6 para. 1 sentence 1 lit. b) GDPR); legitimate interests (Art. 6 para. 1 sentence 1 lit. f) GDPR).

Further information on processing procedures, processes, and services:

PayPal: Payment services (technical integration of online payment methods) (e.g., PayPal, PayPal Plus, Braintree); service provider: PayPal (Europe) S.à r.l. et Cie, S.C.A., 22-24 Boulevard Royal, L-2449 Luxembourg; legal basis: contract performance and pre-contractual inquiries (Art. 6 para. 1 sentence 1 lit. b) GDPR); website: https://www.paypal.com/de; privacy policy: https://www.paypal.com/de/webapps/mpp/ua/privacy-full.

Provision of the Online Offer and Web Hosting
We process users' data to provide them with our online services. For this purpose, we process the user's IP address, which is necessary to transmit the content and functions of our online services to the user's browser or device.

Types of data processed: Usage data (e.g., page views and dwell time, click paths, usage intensity and frequency, device types and operating systems used, interactions with content and functions); meta-, communication- and procedural data (e.g., IP addresses, timestamps, identification numbers, involved persons); log data (e.g., log files regarding logins or data retrieval or access times); content data (e.g., textual or pictorial messages and posts as well as information related to them, such as authorship or creation time).

Data subjects: Users (e.g., website visitors, online service users).

Purposes of processing: Provision of our online offer and user-friendliness; IT infrastructure (operation and provision of information systems and technical equipment (computers, servers, etc.)); security measures.

Storage and deletion: Deletion in accordance with the section "General Information on Data Storage and Deletion."

Legal basis: Legitimate interests (Art. 6 para. 1 sentence 1 lit. f) GDPR).

Further information on processing procedures, processes, and services:

Collection of access data and log files: Access to our online offer is logged in the form of so-called "server log files." These may include the address and name of the accessed websites and files, date and time of access, transmitted data volume, notification of successful access, browser type including version, user's operating system, referrer URL (previously visited page), and usually IP addresses and the requesting provider. Server log files can be used for security purposes, e.g., to prevent server overload (especially in case of abusive attacks such as DDoS attacks), and to ensure server capacity and stability; legal basis: legitimate interests (Art. 6 para. 1 sentence 1 lit. f) GDPR). Data deletion: Log file information is stored for a maximum of 30 days and then deleted or anonymized. Data that need to be retained for evidential purposes are exempted from deletion until the final resolution of the respective case.

Wix: Hosting and software for creation, provision, and operation of websites, blogs, and other online offers; service provider: Wix.com Ltd., Nemal St. 40, 6350671 Tel Aviv, Israel; legal basis: legitimate interests (Art. 6 para. 1 sentence 1 lit. f) GDPR); website: https://de.wix.com/; privacy policy: https://de.wix.com/about/privacy; data processing agreement: https://www.wix.com/about/privacy-dpa-users. Basis for third-country transfers: Data Privacy Framework (DPF).

Registration, Login, and User Account
Users can create a user account. During registration, users are informed of the mandatory required data and these are processed for the purpose of providing the user account based on contractual obligation. The processed data mainly include login information (username, password, and an email address).

In connection with the use of our registration and login functions and the use of the user account, we store the IP address and the time of the respective user action. Storage is based on our legitimate interests and those of users to protect against abuse and other unauthorized use. Disclosure of this data to third parties generally does not take place unless required to assert claims or by legal obligation.

Users can be informed about actions relevant to their user account, e.g., technical changes, by email.

Types of data processed: Master data (e.g., full name, residential address, contact information, customer number, etc.); contact data (e.g., postal and email addresses or phone numbers); content data (e.g., textual or pictorial messages and posts as well as related information such as authorship or creation time); usage data (e.g., page views and dwell time, click paths, usage intensity and frequency, device types and operating systems used, interactions with content and functions); log data (e.g., log files regarding logins or data retrieval or access times).

Data subjects: Users (e.g., website visitors, users of online services).

Purposes of processing: Provision of contractual services and fulfillment of contractual obligations; security measures; organizational and administrative procedures; provision of our online offer and user-friendliness.

Storage and deletion: Deletion in accordance with the section "General Information on Data Storage and Deletion." Deletion after termination.

Legal basis: Contract performance and pre-contractual inquiries (Art. 6 para. 1 sentence 1 lit. b) GDPR). Legitimate interests (Art. 6 para. 1 sentence 1 lit. f) GDPR).

Further information on processing procedures, processes, and services:

Registration with real names: Due to the nature of our community, we ask users to use only their real names for our offer. The use of pseudonyms is not permitted; legal basis: contract performance and pre-contractual inquiries (Art. 6 para. 1 sentence 1 lit. b) GDPR).

Further Information on Processing Procedures, Methods, and Services:

Measurement of Open and Click Rates:
The newsletters contain so-called "web beacons," i.e., pixel-sized files that are retrieved from our or, if we use a mailing service provider, their server when the newsletter is opened. During this retrieval, technical information such as details about the browser and your system, as well as your IP address and the time of retrieval, are collected. This information is used to technically improve our newsletter based on technical data or target groups and their reading behavior according to their retrieval locations (which can be determined via the IP address) or access times. This analysis also includes determining whether and when newsletters were opened and which links were clicked. The information is assigned to individual newsletter recipients and stored in their profiles until deletion. The evaluations serve to recognize the reading habits of our users and to tailor our content to them or send different content according to their interests. The measurement of open and click rates and the storage of the measurement results in users' profiles — This section requires a premium license to be unlocked.
Legal basis: Consent (Art. 6 para. 1 sentence 1 lit. a) GDPR).

Advertising Communication via Email, Post, Fax, or Telephone
We process personal data for advertising communication purposes, which may be conducted through various channels such as email, telephone, post, or fax, in accordance with legal requirements.

Recipients have the right to revoke given consents at any time or object to advertising communication at any time.

After revocation or objection, we store the data required to prove prior authorization for contact or sending for up to three years after the end of the year in which the revocation or objection was made, based on our legitimate interests. The processing of these data is limited to the purpose of possible defense against claims. On the basis of legitimate interest in permanently respecting users' revocation or objection, we also store data necessary to avoid further contact (e.g., depending on communication channel, email address, phone number, name).

Types of data processed: Master data (e.g., full name, residential address, contact information, customer number, etc.); contact data (e.g., postal and email addresses or telephone numbers); content data (e.g., textual or pictorial messages and posts as well as related information, such as authorship or creation time).

Data subjects: Communication partners.

Purposes of processing: Direct marketing (e.g., via email or postal mail); marketing; sales promotion.

Storage and deletion: Deletion according to the section "General Information on Data Storage and Deletion."

Legal basis: Consent (Art. 6 para. 1 sentence 1 lit. a) GDPR); Legitimate interests (Art. 6 para. 1 sentence 1 lit. f) GDPR).

Customer Reviews and Rating Procedures
We participate in review and rating procedures to evaluate, optimize, and promote our services. When users rate us via the involved rating platforms or procedures or provide feedback otherwise, the respective providers' general terms and conditions and privacy policies also apply. Generally, submitting a review requires registration with the respective providers.

To ensure that reviewers have actually used our services, we transmit the necessary data regarding the customer and the service used to the respective rating platform (including name, email address, and order number or article number) with the customer's consent. These data are used solely to verify the authenticity of the user.

Types of data processed: Contract data (e.g., contract subject, duration, customer category); usage data (e.g., page views and dwell time, click paths, usage intensity and frequency, device types and operating systems used, interactions with content and functions); meta-, communication-, and procedural data (e.g., IP addresses, timestamps, identification numbers, involved persons).

Data subjects: Service recipients and clients; users (e.g., website visitors, users of online services).

Purposes of processing: Feedback (e.g., collecting feedback via online form); marketing.

Legal basis: Legitimate interests (Art. 6 para. 1 sentence 1 lit. f) GDPR).

Further Information on Processing Procedures, Methods, and Services:

Rating Widget:
We embed so-called "rating widgets" in our online offer. A widget is a functional and content element embedded in our online offer that displays variable information. It can, for example, appear as a seal or similar element, sometimes called a "badge." The content of the widget is displayed within our online offer but is retrieved at that moment from the servers of the respective widget provider. Only this way can the current content be shown, especially the current rating. For this, a data connection must be established from the webpage called within our online offer to the server of the widget provider, and the widget provider receives certain technical data (access data, including IP address) necessary for delivering the widget content to the user's browser. Furthermore, the widget provider receives information that users have visited our online offer. This information can be stored in a cookie and used by the widget provider to recognize which online offers participating in the rating procedure have been visited by the user. The information can be stored in a user profile and used for advertising or market research purposes.
Legal basis: Legitimate interests (Art. 6 para. 1 sentence 1 lit. f) GDPR).

Social Media Presences
We maintain online presences within social networks and process user data in this context to communicate with users active there or provide information about us.

Please note that user data may be processed outside the European Union. This can pose risks to users, such as difficulties enforcing user rights.

User data within social networks are usually processed for market research and advertising purposes. For example, usage profiles may be created based on users' behavior and interests, which may be used to display advertisements inside and outside the networks tailored to users' interests. Cookies are generally stored on users' devices to record behavior and interests. Usage profiles may also contain data independent of the devices used, especially if users are members of the respective platforms and logged in.

For detailed descriptions of processing and opt-out options, please refer to the privacy policies and information from the operators of the respective networks.

For requests for information and assertion of rights, we note these are most effectively asserted directly with the providers, as only they have access to the user data and can take measures and provide information. Should you still require assistance, you can contact us.

Types of data processed: Contact data (e.g., postal and email addresses or phone numbers); content data (e.g., textual or pictorial messages and posts as well as related information, such as authorship or creation time); usage data (e.g., page views and dwell time, click paths, usage intensity and frequency, device types and operating systems, interactions with content and functions).

Data subjects: Users (e.g., website visitors, users of online services).

Purposes of processing: Communication; feedback (e.g., collecting feedback via online forms); public relations.

Storage and deletion: Deletion according to the section "General Information on Data Storage and Deletion."

Legal basis: Legitimate interests (Art. 6 para. 1 sentence 1 lit. f) GDPR).

Further Information on Processing Procedures, Methods, and Services:

Instagram: Social network enabling photo and video sharing, commenting, liking posts, messaging, subscribing to profiles and pages; service provider: Meta Platforms Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland; legal basis: Legitimate interests (Art. 6 para. 1 sentence 1 lit. f) GDPR); website: https://www.instagram.com; privacy policy: https://privacycenter.instagram.com/policy/. Basis for third-country transfers: Data Privacy Framework (DPF).

Facebook Pages:
Profiles within the social network Facebook – We are jointly responsible with Meta Platforms Ireland Limited for the collection (but not further processing) of data from visitors to our Facebook page (so-called "fan page"). These data include information about types of content users view or interact with, or actions they take (see "Things You and Others Do and Provide" in Facebook's Data Policy: https://www.facebook.com/privacy/policy/), as well as information about devices used by users (e.g., IP addresses, operating system, browser type, language settings, cookie data; see "Device Information" in Facebook's Data Policy: https://www.facebook.com/privacy/policy/). As explained in Facebook's Data Policy under "How We Use This Information," Facebook collects and uses information to provide analytical services ("Page Insights") to page operators, helping them understand how people interact with their pages and related content. We have a special agreement with Facebook ("Information about Page Insights," https://www.facebook.com/legal/terms/page_controller_addendum), which regulates Facebook's security measures and compliance with data subject rights (e.g., users can directly request information or deletion from Facebook). Users' rights (especially to information, deletion, objection, and complaint to supervisory authorities) are not limited by agreements with Facebook. More information is found in the "Information about Page Insights" (https://www.facebook.com/legal/terms/information_about_page_insights_data). Joint responsibility is limited to data collection and transmission to Meta Platforms Ireland Limited, an EU-based company. Further processing is solely the responsibility of Meta Platforms Ireland Limited, including transmission to the parent company Meta Platforms, Inc. in the USA.
Service provider: Meta Platforms Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland; legal basis: Legitimate interests (Art. 6 para. 1 sentence 1 lit. f) GDPR); website: https://www.facebook.com; privacy policy: https://www.facebook.com/privacy/policy/. Basis for third-country transfers: Data Privacy Framework (DPF), Standard Contractual Clauses (https://www.facebook.com/legal/EU_data_transfer_addendum).

Changes and Updates
We ask you to regularly inform yourself about the contents of our privacy policy. We adapt the privacy policy as soon as changes in our data processing make this necessary. We will inform you as soon as changes require your involvement (e.g., consent) or other individual notification.

If we provide addresses and contact information of companies and organizations in this privacy policy, please note that addresses may change over time and we ask you to verify details before contacting.

Created with the free privacy policy generator by Dr. Thomas Schwenke.