Privacy Policy

When you use our website, certain technical data is processed automatically. This includes data that your browser transmits to our server (so-called “server log files”), in particular:

• IP address of the requesting device,
• Date and time of the request,
• Time zone difference to Greenwich Mean Time (GMT),
• Content of the request (specific page),
• Access status / HTTP status code,
• Amount of data transmitted in each case,
• Website from which the request originates (referrer URL),
• Browser used,
• Operating system and its interface,
• Language and version of the browser software.

This data is technically necessary to display our website to you and to ensure stability and security (legal basis: Art. 6(1)(f) GDPR). This data is not merged with other data sources.

Additional technical security signals may be processed when Cloudflare Turnstile is used to protect our contact form. Further information can be found in section “Data Processing when contacting us”.

If there are specific indications of unlawful use of our website, we reserve the right to subsequently analyze the server log files in order to investigate potential misuse.

Our website is hosted by a service provider based in the European Union (EU hosting). The data automatically collected when visiting our website (see section “Data Collection”) is stored and processed on the servers of this hosting provider.

This data processing is necessary to provide a stable, secure, and high-performance website. The legal basis for this processing is Art. 6(1)(f) GDPR. We have entered into a data processing agreement (DPA) with the hosting provider in accordance with Art. 28 GDPR to ensure that your data is processed exclusively on our instructions.

For security reasons, our website uses SSL encryption. You can recognize an encrypted connection by the address bar in your browser ("https://") and the lock icon. This encryption ensures that any data you transmit to us cannot be read by third parties.

To further secure our website and increase the speed of content delivery, we use a content delivery network (CDN) provided by Cloudflare Inc., 101 Townsend St, San Francisco, CA 94107, USA. A CDN is a network of regionally distributed servers that helps deliver our website content reliably, securely, and quickly, even during periods of high traffic. For this purpose, your IP address may be transmitted to Cloudflare to route the data traffic through the nearest data center.

The use of Cloudflare is based on our legitimate interest in the secure and efficient delivery of our website in accordance with Art. 6(1)(f) GDPR. Cloudflare processes data within the EU and in third countries, including the United States. To ensure an adequate level of data protection, data transfers to the U.S. rely not only on the conclusion of standard contractual clauses but also on Cloudflare's certification under the EU-U.S. Data Privacy Framework. This framework was recognized as adequate by the European Commission on July 10, 2023, and ensures that certified U.S. companies provide a level of data protection comparable to that of the EU.

For more information about Cloudflare’s data protection practices, please visit:
https://www.cloudflare.com/privacypolicy

3.1 Contact requests

If you contact us via email or contact form, the personal data you provide – such as your email address, name, and the content of your message – will be processed solely for the purpose of handling your inquiry. This processing is based on Article 6(1)(b) GDPR if your request relates to the performance of a contract or pre-contractual measures, or on Article 6(1)(f) GDPR based on our legitimate interest in responding to your inquiry.

The content of your inquiry is processed only for this purpose. Cloudflare Turnstile does not access, store, or transmit the contents of the form fields; the technical security processing performed by Turnstile is described separately below.

3.2 Cloudflare Turnstile

We use Cloudflare Turnstile to protect our contact form from automated submissions, spam, and other forms of misuse. Turnstile helps distinguish human visitors from automated traffic by evaluating technical security signals. For this purpose, Cloudflare may process signals such as the visitor’s IP address, TLS fingerprint, user-agent header, the Turnstile sitekey and associated origin, as well as related browser and environment signals.

The processing carried out on our behalf for the protection of the contact form is based on our legitimate interest in maintaining the security and availability of our website and communication systems pursuant to Article 6(1)(f) GDPR. The provider is Cloudflare, Inc., 101 Townsend Street, San Francisco, CA 94107, USA. Cloudflare acts as a processor when it processes these signals to provide Turnstile and protect our website. Cloudflare also processes certain Turnstile signals under its own responsibility to improve its bot-detection capabilities.

Processing by Cloudflare may involve transfers of personal data to the United States or other third countries. For transfers from the European Economic Area to the United States, Cloudflare states that it relies on its certification under the EU-U.S. Data Privacy Framework and, where applicable, on the European Commission’s Standard Contractual Clauses together with supplementary safeguards. Further information about international data transfers and Cloudflare is also provided in section “Hosting & Security”.

Further information about Turnstile and Cloudflare’s data protection practices is available in the Turnstile Privacy Addendum, the Cloudflare Privacy Policy, and the Cloudflare Data Processing Addendum.

The duration of storage of personal data depends on the specific purpose of processing, the applicable legal basis, and—if relevant—statutory retention requirements.

If the processing is based on your explicit consent (Art. 6(1)(a) GDPR), we will retain the corresponding data until you withdraw your consent.

Data that we process for the performance of a contract or to take steps prior to entering into a contract (Art. 6(1)(b) GDPR) is stored for as long as necessary to fulfill contractual obligations. In addition, certain data is subject to mandatory commercial and tax retention periods—typically six or ten years under Sections 257 of the German Commercial Code (HGB) and 147 of the German Fiscal Code (AO).

If data is processed on the basis of our legitimate interests (Art. 6(1)(f) GDPR), it will be stored until you object to the processing—unless we can demonstrate compelling legitimate grounds for the processing that override your interests, rights, and freedoms, or if the processing is required for the establishment, exercise, or defense of legal claims.

If your personal data is processed for the purpose of direct marketing, we will retain it until you exercise your right to object in accordance with Art. 21(2) GDPR.

Unless otherwise specified in this privacy policy, we will delete or anonymize your personal data once it is no longer necessary for the purposes for which it was collected or otherwise processed.

5.1 Overview of your data protection rights

As a data subject under the General Data Protection Regulation (GDPR), you have various rights regarding the processing of your personal data. These rights provide transparency, control, and oversight over how we handle your information.

You are entitled in particular to the following rights:

• Access to the personal data we store about you (Art. 15 GDPR)
• Correction of inaccurate or incomplete information (Art. 16 GDPR)
• Deletion of your personal data, provided no legal retention obligations apply (Art. 17 GDPR)
• Restriction of processing under certain conditions (Art. 18 GDPR)
• Notification of correction or deletion to third parties (Art. 19 GDPR)
• Portability of your data to yourself or another controller (Art. 20 GDPR)
• Withdrawal of previously given consent (Art. 7(3) GDPR)
• Lodging a complaint with a competent supervisory authority (Art. 77 GDPR)

To exercise your rights, please send an email to the address provided in our legal notice (Impressum). We will process your request in accordance with legal requirements and inform you within the legally required timeframe.

5.2 Right to object

If we process your personal data based on legitimate interests pursuant to Art. 6(1)(f) GDPR, you have the right to object to such processing at any time for reasons arising from your particular situation. This also applies to any profiling based on that legal basis.

If you exercise your right to object, we will cease processing your personal data unless we can demonstrate compelling legitimate grounds for the processing that override your interests, rights, and freedoms, or if the processing serves to establish, exercise, or defend legal claims.

You can exercise your right to object at any time by sending an informal message to the email address provided in our legal notice. Upon receiving your objection, we will promptly assess whether the legal requirements are met and, unless there are overriding legitimate interests or legal obligations, we will discontinue the related data processing.