Collection of access data and log files: Access to my online offer is logged in the form of so-called “server log files”. The server log files may include the address and name of the web pages and files accessed, the date and time of access, the volume of data transferred, notification of successful access, browser type and version, the user’s operating system, referrer URL (the previously visited page) and, as a rule, IP addresses and the requesting provider. The server log files may be used on the one hand for security purposes, e.g. to avoid overloading the servers (especially in the case of abusive attacks, so-called DDoS attacks) and on the other hand to ensure the utilisation of the servers and their stability; Legal basis: Legitimate interests (Art. 6 para. 1 p. 1 lit. f) GDPR); Deletion of data: Log file information is stored for a maximum of 30 days and then deleted or anonymised. Data whose further storage is necessary for evidentiary purposes is exempt from deletion until the final clarification of the respective incident.

6. Contact and Enquiry Management

When contacting me via contact form as well as in the context of existing user and business relationships, the information of the inquiring persons is processed as far as this is necessary to answer the contact enquiries and any requested measures.

– Types of data processed: contact data (e.g. e-mail, telephone numbers); content data (e.g. entries in online forms); usage data (e.g. websites visited, interest in content, access times); meta, communication and procedural data (e.g. IP addresses, time data, identification numbers, consent status).

– Data subjects: Communication partners.

– Purposes of processing: contact requests and communication; managing and responding to requests; feedback (e.g. collecting feedback via online form); providing my online offer and user experience.

– Legal basis: Legitimate interests (Art. 6 para. 1 p. 1 lit. f) GDPR).

7. Web Analysis, Monitoring and Optimisation

Web analysis (also referred to as “reach measurement”) is used to evaluate the flow of visitors to my online offering and may include behaviour, interests or demographic information about visitors, such as age or gender, as pseudonymous values. With the help of the reach analysis, I can, for example, recognise at what time my online offer or its functions or content are most frequently used or invite re-use. Likewise, I can understand which areas need optimisation.

In addition to web analysis, I may also use test procedures, e.g. to test and optimise different versions of my online offer or its components.

Unless otherwise stated below, profiles, i.e. data summarised for a usage process, may be created for these purposes and information may be stored in a browser or in a terminal device and read from it. The information collected includes, in particular, websites visited and elements used there as well as technical information such as the browser used, the computer system used and information on usage times. If users have agreed to the collection of their location data from us or from the providers of the services I use, location data may also be processed.

The IP addresses of the users are also stored. However, I use an IP masking procedure (i.e. pseudonymisation by shortening the IP address) to protect users. In general, no clear user data (e.g. e-mail addresses or names) is stored in the context of web analysis, A/B testing and optimisation, but pseudonyms. This means that I as well as the providers of the software used do not know the actual identity of the users, but only the information stored in their profiles for the purposes of the respective procedures.

– Types of data processed: Usage data (e.g. websites visited, interest in content, access times); meta, communication and procedural data (e.g. IP addresses, times, identification numbers, consent status).

– Data subjects: Users (e.g. website visitors, users of online services).

– Purposes of processing: reach measurement (e.g. access statistics, recognition of returning visitors); profiles with user-related information (creation of user profiles).

– Security measures: IP masking (pseudonymisation of the IP address).

8. Plugins and Embedded Functions and Content

I integrate functional and content elements into my online offer that are obtained from the servers of their respective providers (in the following referred to as “third-party providers”). These can be, for example, graphics, videos or city maps (in the following uniformly referred to as “content”).

The integration always requires that the third-party providers of this content process the IP address of the user, as without the IP address they would not be able to send the content to their browser. The IP address is thus required for the presentation of these contents or functions. I endeavour to only use content whose respective providers only use the IP address to deliver the content. Third-party providers may also use so-called pixel tags (invisible graphics, also known as “web beacons”) for statistical or marketing purposes. The “pixel tags” can be used to analyse information such as visitor traffic on the pages of this website. The pseudonymous information may also be stored in cookies on the user’s device and may contain, among other things, technical information about the browser and operating system, referring websites, time of visit and other information about the use of my online offer, as well as being linked to such information from other sources.

– Types of data processed: Usage data (e.g. web pages visited, interest in content, access times); meta, communication and procedural data (e.g. IP addresses, time data, identification numbers, consent status).

– Data subjects: Users (e.g. website visitors, users of online services).

– Purposes of processing: Provision of my online offer and user-friendliness.

– Legal grounds: Legitimate interests (Art. 6 para. 1 p. 1 lit. f) GDPR).

Further information on processing processes, procedures and services:

– Integration of third-party software, scripts or frameworks (e.g. jQuery): I integrate software into my online offer that I retrieve from servers of other providers (e.g. function libraries that I use for the purpose of presentation or user-friendliness of my online offer). In doing so, the respective providers collect the IP address of the user and may process this for the purpose of transmitting the software to the user’s browser and for security purposes, as well as for the evaluation and optimisation of their offer.  I integrate software into my online offer that I retrieve from servers of other providers (e.g. function libraries that I use for the purpose of presentation or user-friendliness of my online offer). In doing so, the respective providers collect the IP address of the user and may process this for the purpose of transmitting the software to the user’s browser and for security purposes, as well as for the evaluation and optimisation of their offer; legal basis: legitimate interests (Art. 6 para. 1 p. 1 lit. f) GDPR).

9. Amendment and Updating of the Data Protection Declaration

I ask you to regularly inform yourself about the content of my data protection declaration. I adapt the data protection declaration as soon as the changes in the data processing carried out by me make this necessary. I will inform you as soon as the changes require an act of cooperation on your part (e.g. consent) or other individual notification.

Where I provide addresses and contact details of companies and organisations in this privacy statement, please note that the addresses may change over time and please check the details before contacting me.

10. Rights of the Data Subjects

As a data subject, you have various rights under the GDPR, which arise in particular from Art. 15 to 21 GDPR:

– Right to object: you have the right to object at any time, on grounds relating to your particular situation, to the processing of personal data concerning you which is carried out on the basis of Art. 6(1)(e) or (f) GDPR; this also applies to profiling based on these provisions. If the personal data concerning you is processed for the purpose of direct marketing, you have the right to object at any time to the processing of personal data concerning you for the purpose of such marketing; this also applies to profiling insofar as it is related to such direct marketing.

– Right to withdraw consent: You have the right to revoke any consent given at any time.

– Right to information: You have the right to request confirmation as to whether data in question is being processed and to information about this data as well as further information and a copy of the data in accordance with the legal requirements.

– Right to rectification: You have the right, in accordance with the law, to request that data concerning you be completed or that inaccurate data concerning you be rectified.

– Right to erasure and restriction of processing: You have the right, in accordance with the law, to request that data concerning you be erased immediately or, alternatively, to request restriction of the processing of the data in accordance with the law.

– Right to data portability: You have the right to receive data relating to you that you have provided to me in a structured, common and machine-readable format, or to request that it be transferred to another controller, in accordance with the law.

– Complaint to supervisory authority: In accordance with the law and without prejudice to any other administrative or judicial remedy, you also have the right to lodge a complaint with a data protection supervisory authority, in particular a supervisory authority in the Member State where you usually reside, the supervisory authority of your place of work or the place of the alleged infringement, if you consider that the processing of personal data concerning you infringes the GDPR.

Last update: 29.01.2023