Imprint and privacy policy

Owner and respon­sible for the content:

Ralf Schlu­ricke
Agnes-Bernauer-Straße 76a
80687 München
E‑Mail: ralf@villarosafriuli.com

Codici Iden­ti­fi­ca­tivo Nazio­nale (CIN):

App. Meduna IT093049C2VMAUNQPE
App. Arzino IT093049C2ULQOZBU3
App. Taglia­mento IT093049C26TGPNW3O

Photo credits:
Simon Koy, Ray Scial­doni, Martha Piulunga

Preamble to the privacy policy
With the follo­wing privacy policy, we would like to inform you about the types of your personal data (herein­after also referred to as “data”) that we process, for what purposes and to what extent. The privacy policy applies to all proces­sing of personal data carried out by us, both in the context of the provi­sion of our services and in parti­cular on our websites, in mobile appli­ca­tions and within external online presences, such as our social media profiles (herein­after coll­ec­tively referred to as “online offer”).
The terms used are not gender-specific.
Status: February 18, 2024

Table of contents
- Preamble
- Controller
- Over­view of the proces­sing opera­tions
- Rele­vant legal bases
- Secu­rity measures
- Trans­mis­sion of personal data
- Rights of the data subjects
- Use of cookies
- Busi­ness services
- Provi­ders and services used in the course of busi­ness acti­vi­ties
- Payment proce­dures
- Provi­sion of the online offe­ring and web hosting
- Blogs and publi­ca­tion media
- Contact and inquiry manage­ment
- Web analysis, moni­to­ring and opti­miza­tion
- Plugins and embedded func­tions and content
- Defi­ni­tions of terms

Respon­sible person
Ralf Schlu­ricke
Agnes-Bernauer-Straße 76a
80687 Munich
Munich, Germany
E‑mail address: ralf@villarosafriuli.com Imprint: www.villarosfriuli.com/impressum

Over­view of the proces­sing opera­tions
The follo­wing over­view summa­rizes the types of data processed and the purposes of their proces­sing and refers to the data subjects.

Types of data processed
- Inven­tory data.
- Payment data.
- Loca­tion data.
- Contact data.
- Content data.
- Contract data.
- Usage data.
- Meta, commu­ni­ca­tion and process data.

Cate­go­ries of data subjects
- Custo­mers.
- Inte­rested parties.
- Commu­ni­ca­tion part­ners.
- Users.
- Busi­ness and contrac­tual part­ners.

Purposes of the proces­sing

- Provi­sion of contrac­tual services and fulfill­ment of contrac­tual obli­ga­tions.
- Contact requests and commu­ni­ca­tion.
- Secu­rity measures.
- Range measu­re­ment.
- Office and orga­niza­tional proce­dures.
- Mana­ging and respon­ding to inqui­ries.
- Feed­back.
- Marke­ting.
- Profiles with user-related infor­ma­tion.
- Provi­sion of our online services and user-friend­li­ness.
- Infor­ma­tion tech­no­logy infra­struc­ture.

Rele­vant legal bases

Rele­vant legal bases accor­ding to the GDPR: Below you will find an over­view of the legal bases of the GDPR on the basis of which we process personal data. Please note that in addi­tion to the provi­sions of the GDPR, national data protec­tion regu­la­tions may apply in your or our country of resi­dence or domicile. Should more specific legal bases also apply in indi­vi­dual cases, we will inform you of these in the privacy policy.

- Consent (Art. 6 para. 1 sentence 1 lit. a) GDPR) — The data subject has given their consent to the proces­sing of their personal data for a specific purpose or several specific purposes.

- Perfor­mance of a contract and pre-contrac­tual inqui­ries (Art. 6 para. 1 sentence 1 lit. b) GDPR) - Proces­sing is neces­sary for the perfor­mance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to ente­ring into a contract.

- Legal obli­ga­tion (Art. 6 para. 1 sentence 1 lit. c) GDPR) — Proces­sing is neces­sary for compli­ance with a legal obli­ga­tion to which the controller is subject.

- Legi­ti­mate inte­rests (Art. 6 para. 1 sentence 1 lit. f) GDPR) - Proces­sing is neces­sary for the purposes of the legi­ti­mate inte­rests pursued by the controller or by a third party, except where such inte­rests are over­ridden by the inte­rests or funda­mental rights and free­doms of the data subject which require protec­tion of personal data.

National data protec­tion regu­la­tions in Germany: In addi­tion to the data protec­tion regu­la­tions of the GDPR, national data protec­tion regu­la­tions apply in Germany. These include, in parti­cular, the Act on the Protec­tion against Misuse of Personal Data in Data Proces­sing (Federal Data Protec­tion Act — BDSG). In parti­cular, the BDSG contains special regu­la­tions on the right to infor­ma­tion, the right to erasure, the right to object, the proces­sing of special cate­go­ries of personal data, proces­sing for other purposes and trans­mis­sion as well as auto­mated decision-making in indi­vi­dual cases, inclu­ding profiling. Further­more, state data protec­tion laws of the indi­vi­dual federal states may apply.

Refe­rence to the vali­dity of the GDPR and Swiss FADP: This data protec­tion notice serves to provide infor­ma­tion in accordance with both the Swiss Federal Act on Data Protec­tion (FADP) and the General Data Protec­tion Regu­la­tion (GDPR). For this reason, please note that the terms of the GDPR are used due to the broader geogra­phical appli­ca­tion and compre­hen­si­bi­lity. In parti­cular, instead of the terms “proces­sing” of “personal data”, “over­ri­ding inte­rest” and “sensi­tive personal data” used in the Swiss DPA, the terms “proces­sing” of “personal data”, “legi­ti­mate inte­rest” and “special cate­go­ries of data” used in the GDPR are used. However, the legal meaning of the terms will continue to be deter­mined in accordance with the Swiss DPA within the scope of appli­ca­tion of the Swiss DPA.

Secu­rity measures

We take appro­priate tech­nical and orga­niza­tional measures in accordance with the legal requi­re­ments, taking into account the state of the art, the imple­men­ta­tion costs and the nature, scope, circum­s­tances and purposes of the proces­sing as well as the diffe­rent proba­bi­li­ties of occur­rence and the extent of the threat to the rights and free­doms of natural persons, in order to ensure a level of protec­tion appro­priate to the risk.

The measures include, in parti­cular, safe­guar­ding the confi­den­tia­lity, inte­grity and avai­la­bi­lity of data by control­ling physical and elec­tronic access to the data as well as access, input, disclo­sure, safe­guar­ding avai­la­bi­lity and sepa­ra­tion of the data. Further­more, we have estab­lished proce­dures that ensure the exer­cise of data subject rights, the dele­tion of data and responses to data threats. Further­more, we already take the protec­tion of personal data into account during the deve­lo­p­ment and selec­tion of hard­ware, soft­ware and processes in accordance with the prin­ciple of data protec­tion, through tech­no­logy design and data protec­tion-friendly default settings.

TLS/SSL encryp­tion (https): To protect user data trans­mitted via our online services, we use TLS/SSL encryp­tion. Secure Sockets Layer (SSL) is the stan­dard tech­no­logy for secu­ring internet connec­tions by encryp­ting the data trans­mitted between a website or app and a browser (or between two servers). Trans­port Layer Secu­rity (TLS) is an updated and more secure version of SSL. Hyper Text Transfer Protocol Secure (HTTPS) is displayed in the URL if a website is secured by an SSL/TLS certi­fi­cate.

Trans­mis­sion of personal data

As part of our proces­sing of personal data, the data may be trans­mitted to other bodies, compa­nies, legally inde­pen­dent orga­niza­tional units or persons or disc­losed to them. The reci­pi­ents of this data may include, for example, service provi­ders commis­sioned with IT tasks or provi­ders of services and content that are inte­grated into a website. In such cases, we observe the legal requi­re­ments and, in parti­cular, conclude corre­spon­ding contracts or agree­ments with the reci­pi­ents of your data that serve to protect your data.

Rights of the data subjects

Rights of data subjects under the GDPR: As a data subject, you are entitled to various rights under the GDPR, which arise in parti­cular from Art. 15 to 21 GDPR:

- Right to object: you have the right to object, on grounds rela­ting to your parti­cular situa­tion, at any time to proces­sing of personal data concer­ning you which is based on point (e) or (f) of Article 6(1) GDPR, inclu­ding profiling based on those provi­sions. If the personal data concer­ning you are processed for direct marke­ting purposes, you have the right to object at any time to the proces­sing of personal data concer­ning you for such marke­ting, which includes profiling to the extent that it is related to such direct marke­ting.

- Right to with­draw consent: You have the right to with­draw any consent you have given at any time.

- Right to infor­ma­tion: You have the right to request confir­ma­tion as to whether the data in ques­tion is being processed and to infor­ma­tion about this data as well as further infor­ma­tion and a copy of the data in accordance with the legal requi­re­ments.

- Right to recti­fi­ca­tion: You have the right to request the comple­tion of data concer­ning you or the recti­fi­ca­tion of inac­cu­rate data concer­ning you in accordance with the legal requi­re­ments.

- Right to erasure and rest­ric­tion of proces­sing: In accordance with the legal requi­re­ments, you have the right to demand that data concer­ning you be erased imme­dia­tely or, alter­na­tively, to demand that the proces­sing of the data be rest­ricted in accordance with the legal requi­re­ments.

- Right to data porta­bi­lity: You have the right to receive the data concer­ning you, which you have provided to us, in a struc­tured, commonly used and machine-readable format in accordance with the legal requi­re­ments or to request its trans­mis­sion to another controller.

- Complaint to the super­vi­sory autho­rity: Without preju­dice to any other admi­nis­tra­tive or judi­cial remedy, you have the right to lodge a complaint with a super­vi­sory autho­rity, in parti­cular in the Member State of your habi­tual resi­dence, place of work or place of the alleged infrin­ge­ment if you consider that the proces­sing of personal data rela­ting to you infringes the provi­sions of the GDPR.

Use of cookies

Cookies are small text files or other storage notes that store infor­ma­tion on end devices and read infor­ma­tion from the end devices. For example, to store the login status in a user account, the contents of a shop­ping cart in an e‑shop, the content accessed or the func­tions used in an online offe­ring. Cookies can also be used for various purposes, e.g. to ensure the func­tion­a­lity, secu­rity and conve­ni­ence of online services and to analyze visitor flows.

Notes on consent: We use cookies in accordance with legal regu­la­tions. We ther­e­fore obtain prior consent from users, unless this is not required by law. In parti­cular, consent is not required if the storage and reading of infor­ma­tion, inclu­ding cookies, is abso­lutely neces­sary in order to provide the user with a tele­media service expressly requested by them (i.e. our online offe­ring). Strictly neces­sary cookies gene­rally include cookies with func­tions that serve the display and opera­bi­lity of the online service, load balan­cing, secu­rity, storage of user prefe­rences and selec­tion options or similar purposes related to the provi­sion of the main and secon­dary func­tions of the online service requested by the user. The revo­cable consent is clearly commu­ni­cated to users and contains infor­ma­tion on the respec­tive use of cookies.

Infor­ma­tion on the legal basis under data protec­tion law: The legal basis under data protec­tion law on which we process users’ personal data with the help of cookies depends on whether we ask users for their consent. If users give their consent, the legal basis for proces­sing their data is their declared consent. Other­wise, the data processed using cookies will be processed on the basis of our legi­ti­mate inte­rests (e.g. in the commer­cial opera­tion of our online offe­ring and impro­ving its usabi­lity) or, if this is done in the context of fulfil­ling our contrac­tual obli­ga­tions, if the use of cookies is neces­sary to fulfill our contrac­tual obli­ga­tions. We will explain the purposes for which we process cookies in the course of this privacy policy or as part of our consent and proces­sing proce­dures.

Storage dura­tion: With regard to the storage dura­tion, a distinc­tion is made between the follo­wing types of cookies

- Tempo­rary cookies (also: session cookies): Tempo­rary cookies are deleted at the latest after a user has left an online offe­ring and closed their end device (e.g. browser or mobile appli­ca­tion).

- Perma­nent cookies: Perma­nent cookies remain stored even after the end device is closed. For example, the login status can be saved or preferred content can be displayed directly when the user visits a website again. The user data coll­ected with the help of cookies can also be used to measure reach. If we do not provide users with explicit infor­ma­tion on the type and storage dura­tion of cookies (e.g. when obtai­ning consent), users should assume that cookies are perma­nent and can be stored for up to two years.

General infor­ma­tion on revo­ca­tion and objec­tion (so-called “opt-out”): Users can with­draw the consent they have given at any time and object to proces­sing in accordance with the legal requi­re­ments. Among other things, users can rest­rict the use of cookies in their browser settings (although this may also rest­rict the func­tion­a­lity of our online offe­ring). An objec­tion to the use of cookies for online marke­ting purposes can also be declared via the websites https://optout.aboutads.info and https://www.youronlinechoices.com/.

- Legal bases: Legi­ti­mate inte­rests (Art. 6 para. 1 sentence 1 lit. f) GDPR). Consent (Art. 6 para. 1 sentence 1 lit. a) GDPR).

Further infor­ma­tion on proces­sing processes, proce­dures and services:

- Proces­sing of cookie data on the basis of consent: We use a proce­dure for consent manage­ment: proce­dure for obtai­ning, logging, mana­ging and revo­king consent, in parti­cular for the use of cookies and similar tech­no­lo­gies for storing, reading and proces­sing infor­ma­tion on users’ end devices and their proces­sing, in the context of which the user’s consent to the use of cookies, respec­tively the proces­sing and provi­ders mentioned in the context of consent manage­ment: Proce­dure for obtai­ning, logging, mana­ging and revo­king consent, in parti­cular for the use of cookies and similar tech­no­lo­gies for storing, reading and proces­sing infor­ma­tion on users’ end devices and their proces­sing proce­dures, can be obtained and managed and revoked by users. The decla­ra­tion of consent is stored so that it does not have to be requested again and the consent can be proven in accordance with the legal obli­ga­tion. Consent can be stored on the server and/or in a cookie (so-called opt-in cookie or with the help of compa­rable tech­no­lo­gies) in order to be able to assign the consent to a user or their device. Subject to indi­vi­dual infor­ma­tion on the provi­ders of cookie manage­ment services, the follo­wing infor­ma­tion applies: Consent may be stored for up to two years. A pseud­ony­mous user iden­ti­fier is created and stored with the time of consent, infor­ma­tion on the scope of consent (e.g. which cate­go­ries of cookies and/or service provi­ders) as well as the browser, system and end device used; legal basis: consent (Art. 6 para. 1 sentence 1 lit. a) GDPR).

Busi­ness services

We process data of our contrac­tual and busi­ness part­ners, e.g. custo­mers and inte­rested parties (coll­ec­tively referred to as “contrac­tual part­ners”) in the context of contrac­tual and compa­rable legal rela­ti­onships and asso­ciated measures and in the context of commu­ni­ca­tion with the contrac­tual part­ners (or pre-contrac­tual), e.g. to answer inqui­ries.

We process this data in order to fulfill our contrac­tual obli­ga­tions. These include, in parti­cular, the obli­ga­tions to provide the agreed services, any updating obli­ga­tions and reme­dies in the event of warranty and other service disrup­tions. In addi­tion, we process the data to safe­guard our rights and for the purpose of the admi­nis­tra­tive tasks asso­ciated with these obli­ga­tions and the company orga­niza­tion. In addi­tion, we process the data on the basis of our legi­ti­mate inte­rests in proper and effi­cient busi­ness manage­ment and in secu­rity measures to protect our contrac­tual part­ners and our busi­ness opera­tions from misuse, threats to their data, secrets, infor­ma­tion and rights (e.g. to involve tele­com­mu­ni­ca­tions, trans­port and other auxi­liary services as well as subcon­trac­tors, banks, tax and legal advi­sors, payment service provi­ders or tax autho­ri­ties). Within the frame­work of appli­cable law, we only pass on the data of contrac­tual part­ners to third parties to the extent that this is neces­sary for the afore­men­tioned purposes or to fulfill legal obli­ga­tions. Contrac­tual part­ners will be informed about other forms of proces­sing, e.g. for marke­ting purposes, as part of this privacy policy.

We inform the contrac­tual part­ners which data is required for the afore­men­tioned purposes before or during data coll­ec­tion, e.g. in online forms, by means of special marking (e.g. colors) or symbols (e.g. aste­risks or similar), or in person.

We delete the data after the expiry of statu­tory warranty and compa­rable obli­ga­tions, i.e. gene­rally after 4 years, unless the data is stored in a customer account, e.g. as long as it must be retained for legal archi­ving reasons. The statu­tory reten­tion period is ten years for docu­ments rele­vant under tax law and for commer­cial books, invent­ories, opening balance sheets, annual finan­cial state­ments, the work instruc­tions and other orga­niza­tional docu­ments and accoun­ting records required to under­stand these docu­ments, and six years for commer­cial and busi­ness letters received and repro­duc­tions of commer­cial and busi­ness letters sent. The period begins at the end of the calendar year in which the last entry was made in the book, the inven­tory, the opening balance sheet, the annual finan­cial state­ments or the manage­ment report were prepared, the commer­cial or busi­ness letter was received or sent or the accoun­ting docu­ment was created, the record was made or the other docu­ments were created.

Insofar as we use third-party provi­ders or plat­forms to provide our services, the terms and condi­tions and data protec­tion notices of the respec­tive third-party provi­ders or plat­forms apply in the rela­ti­onship between the users and the provi­ders.

- Processed data types: Inven­tory data (e.g. names, addresses); payment data (e.g. bank details, invoices, payment history); contact data (e.g. email, tele­phone numbers); contract data (e.g. subject matter of contract, term, customer cate­gory).

- Data subjects: Inte­rested parties; busi­ness and contrac­tual part­ners. Custo­mers.

- Purposes of Proces­sing: Provi­sion of contrac­tual services and perfor­mance of contrac­tual obli­ga­tions; contact requests and commu­ni­ca­tion; Office and orga­niza­tional proce­dures. Mana­ging and respon­ding to inqui­ries.

- Legal basis: Perfor­mance of a contract and pre-contrac­tual inqui­ries (Art. 6 para. 1 sentence 1 lit. b) GDPR); Legal obli­ga­tion (Art. 6 para. 1 sentence 1 lit. c) GDPR). Legi­ti­mate inte­rests (Art. 6 para. 1 sentence 1 lit. f) GDPR).

Further infor­ma­tion on proces­sing processes, proce­dures and services:

- Rental services: We process the data of inte­rested parties and tenants in order to be able to provide them with the rental property.

Provi­ders and services used in the course of busi­ness acti­vi­ties

As part of our busi­ness acti­vi­ties, we use addi­tional services, plat­forms, inter­faces or plug-ins from third-party provi­ders (“services” for short) in compli­ance with legal requi­re­ments. Their use is based on our inte­rests in a proper, lawful and — This text area must be acti­vated with a premium license. -

Processed data types: Inven­tory data (e.g. names, addresses); Payment data (e.g. bank details, invoices, payment history — Contact data (e.g. email, tele­phone numbers); Content data (e.g. entries in online forms); Contract data (e.g. subject matter of the contract, dura­tion, customer cate­gory.

- Data subjects: Custo­mers; inte­rested parties; users (e.g. website visi­tors, users of the booking system.

- Purposes of proces­sing: Provi­sion of contrac­tual services and fulfill­ment of contrac­tual obli­ga­tions. Office and orga­niza­tional proce­dures.

- Legal bases: Legi­ti­mate inte­rests (Art. 6 para. 1 sentence 1 lit. f) GDPR).

Payment proce­dures

In the context of contrac­tual and other legal rela­ti­onships, due to legal obli­ga­tions or other­wise on the basis of our legi­ti­mate inte­rests, we offer the data subjects effi­cient and secure payment options and use other service provi­ders in addi­tion to banks and credit insti­tu­tions (coll­ec­tively “payment service provi­ders”).

The data processed by the payment service provi­ders includes inven­tory data, such as the name and address, bank data, such as account numbers or credit card numbers, pass­words, TANs and checksums, as well as contract, total and reci­pient-related infor­ma­tion. The infor­ma­tion is required to carry out the tran­sac­tions. However, the data entered is only processed by the payment service provi­ders and stored by them. This means that we do not receive any account or credit card-related infor­ma­tion, but only infor­ma­tion with confir­ma­tion or nega­tive infor­ma­tion about the payment. Under certain circum­s­tances, the data may be trans­mitted by the payment service provi­ders to credit agen­cies. The purpose of this trans­mis­sion is to check iden­tity and credit­wort­hi­ness. Please refer to the payment service provi­ders’ terms and condi­tions and data protec­tion infor­ma­tion.

Payment tran­sac­tions are subject to the terms and condi­tions and data protec­tion notices of the respec­tive payment service provi­ders, which can be accessed on the respec­tive websites or tran­sac­tion appli­ca­tions. We also refer to these for further infor­ma­tion and the asser­tion of rights of revo­ca­tion, infor­ma­tion and other rights of data subjects.

- Processed data types: Inven­tory data (e.g. names, addresses); payment data (e.g. bank details, invoices, payment history); contract data (e.g. subject matter of the contract, dura­tion, customer cate­gory); usage data (e.g. websites visited, inte­rest in content, access times); meta, commu­ni­ca­tion and process data (e.g. IP addresses, time data, iden­ti­fi­ca­tion numbers, consent status).

- Data subjects: Custo­mers. Inte­rested parties.

- Purposes of proces­sing: Provi­sion of contrac­tual services and fulfill­ment of contrac­tual obli­ga­tions.

- Legal bases: Contract fulfill­ment and pre-contrac­tual inqui­ries (Art. 6 para. 1 sentence 1 lit. b) GDPR).

Further infor­ma­tion on proces­sing processes, proce­dures and services:

- PayPal: Payment services (tech­nical connec­tion of online payment methods) (e.g. PayPal, PayPal Plus, Brain­tree); service provider: PayPal (Europe) S.à r.l. et Cie, S.C.A., 22–24 Boule­vard Royal, L‑2449 Luxem­bourg; Legal basis: Perfor­mance of contract and pre-contrac­tual inqui­ries (Art. 6 para. 1 sentence 1 lit. b) GDPR); Website: https://www.paypal.com/de. Privacy Policy: https://www.paypal.com/de/webapps/mpp/ua/privacy-full.

- Stripe: Payment services (tech­nical connec­tion of online payment methods); Service provider: Stripe, Inc, 510 Town­send Street, San Fran­cisco, CA 94103, USA; Legal basis: Perfor­mance of a contract and pre-contrac­tual inqui­ries (Art. 6 para. 1 sentence 1 lit. b) GDPR); Website: https://stripe.com; Privacy Policy: https://stripe.com/de/privacy. Basis for third country trans­fers: Data Privacy Frame­work (DPF).

Provi­sion of the online offer and web hosting

We process users’ data in order to provide them with our online services. For this purpose, we process the user’s IP address, which is neces­sary to transmit the content and func­tions of our online services to the user’s browser or end device.

- Processed data types: Usage data (e.g. websites visited, inte­rest in content, access times); meta, commu­ni­ca­tion and proce­dural data (e.g. IP addresses, time data, iden­ti­fi­ca­tion numbers, consent status); content data (e.g. .e.g. entries in online forms).

- Data subjects: Users (e.g. website visi­tors, users of online services).

- Purposes of proces­sing: Provi­sion of our online services and user-friend­li­ness; infor­ma­tion tech­no­logy infra­struc­ture (opera­tion and provi­sion of infor­ma­tion systems and tech­nical devices (compu­ters, servers, etc.)). Secu­rity measures.

- Legal bases: Legi­ti­mate inte­rests (Art. 6 para. 1 sentence 1 lit. f) GDPR).

Further infor­ma­tion on proces­sing processes, proce­dures and services:

- Provi­sion of online offer on rented storage space: For the provi­sion of our online offer, we use storage space, compu­ting capa­city and soft­ware that we rent or other­wise obtain from a corre­spon­ding server provider (also called “web host”); legal basis: Legi­ti­mate inte­rests (Art. 6 para. 1 sentence 1 lit. f) GDPR).

- Coll­ec­tion of access data and log files: Access to our online offe­ring is logged in the form of so-called “server log files”. The server log files may include the address and name of the websites and files accessed, the date and time of access, the amount of data trans­ferred, noti­fi­ca­tion of successful access, browser type and version, the user’s opera­ting system, referrer URL (the previously visited page) and, as a rule, IP addresses and the reques­ting provider. The server log files may be used for secu­rity purposes, e.g. to avoid over­loa­ding the servers (espe­ci­ally in the event of abusive attacks, so-called DDoS attacks) and to ensure the utiliza­tion of the servers and their stabi­lity; legal basis: Legi­ti­mate inte­rests (Art. 6 para. 1 sentence 1 lit. f) GDPR). Dele­tion of data: Log file infor­ma­tion is stored for a maximum of 30 days and then deleted or anony­mized. Data whose further storage is required for eviden­tiary purposes is excluded from dele­tion until the respec­tive inci­dent has been finally clari­fied.

- Host Europe: Services in the field of the provi­sion of infor­ma­tion tech­no­logy infra­struc­ture and related services (e.g. storage space and/or compu­ting capa­ci­ties); service provider: Host Europe GmbH, Hansestrasse 111, 51149 Cologne, Germany; Legal basis: Legi­ti­mate inte­rests (Art. 6 para. 1 sentence 1 lit. f) GDPR); Website: https://www.hosteurope.de; Privacy Policy: http://www.hosteurope.de/AGB/Datenschutzerklaerung/. Data proces­sing agree­ment: https://www.hosteurope.de/Dokumente/.

- WordPress.com: Hosting and soft­ware for the crea­tion, provi­sion and opera­tion of websites, blogs and other online services; Service provider: Aut O’Mattic A8C Ireland Ltd, Grand Canal Dock, 25 Herbert Pl, Dublin, D02 AY86, Ireland; Legal basis: Legi­ti­mate inte­rests (Art. 6 para. 1 sentence 1 lit. f) GDPR); Website: https://wordpress.com; Privacy Policy: https://automattic.com/de/privacy/; Data proces­sing agree­ment: https://wordpress.com/support/data-processing-agreements/. Basis for third country trans­fers: Data Privacy Frame­work (DPF).

Blogs and publi­ca­tion media

We use blogs or compa­rable means of online commu­ni­ca­tion and publi­ca­tion (herein­after “publi­ca­tion medium”). Readers’ data is only processed for the purposes of the publi­ca­tion medium to the extent neces­sary for its presen­ta­tion and commu­ni­ca­tion between authors and readers or for secu­rity reasons. For further infor­ma­tion, please refer to the infor­ma­tion on the proces­sing of visi­tors to our publi­ca­tion medium in this data protec­tion notice.

- Processed data types: Inven­tory data (e.g. names, addresses); contact data (e.g. email, tele­phone numbers); content data (e.g. entries in online forms); usage data (e.g. websites visited, inte­rest in content, access times); meta, commu­ni­ca­tion and process data (e.g. IP addresses, time data, iden­ti­fi­ca­tion numbers, consent status).

- Data subjects: Users (e.g. website visi­tors, users of online services).

- Purposes of proces­sing: Provi­sion of contrac­tual services and fulfill­ment of contrac­tual obli­ga­tions; feed­back (e.g. coll­ec­ting feed­back via online form). Provi­sion of our online services and user-friend­li­ness.

- Legal basis: Legi­ti­mate inte­rests (Art. 6 para. 1 sentence 1 lit. f) GDPR).

Further infor­ma­tion on proces­sing processes, proce­dures and services:

- Medium: Hosting plat­form for blogs / websites; Service provider: A Medium Corpo­ra­tion, P.O. Box 602, San Fran­cisco, CA 94104–0602, USA; Legal basis: Legi­ti­mate inte­rests (Art. 6 para. 1 sentence 1 lit. f) GDPR); Website: https://medium.com/. Privacy Policy: https://medium.com/policy/medium-privacy-policy-f03bf92035c9.

Contact and request manage­ment

When cont­ac­ting us (e.g. by post, contact form, email, tele­phone or via social media) and in the context of exis­ting user and busi­ness rela­ti­onships, the infor­ma­tion of the inqui­ring persons is processed insofar as this is neces­sary to answer the contact inqui­ries and any requested measures.

- Processed data types: Contact data (e.g. email, tele­phone numbers); Content data (e.g. entries in online forms); Usage data (e.g. websites visited, inte­rest in content, access times); Meta, commu­ni­ca­tion and process data (e.g. IP addresses, time data, iden­ti­fi­ca­tion numbers, consent status).

- Data subjects: Commu­ni­ca­tion part­ners.

- Purposes of Proces­sing: Contact requests and commu­ni­ca­tion; Mana­ging and respon­ding to inqui­ries; Feed­back (e.g. coll­ec­ting feed­back via online form). Provi­sion of our online services and user-friend­li­ness.

- Legal basis: Legi­ti­mate inte­rests (Art. 6 para. 1 sentence 1 lit. f) GDPR). Contract fulfill­ment and pre-contrac­tual inqui­ries (Art. 6 para. 1 sentence 1 lit. b) GDPR).

Further infor­ma­tion on proces­sing processes, proce­dures and services:

- Contact form: If users contact us via our contact form, e‑mail or other commu­ni­ca­tion chan­nels, we process the data provided to us in this context to process the commu­ni­cated request; legal basis: fulfill­ment of contract and pre-contrac­tual inqui­ries (Art. 6 para. 1 sentence 1 lit. b) GDPR), legi­ti­mate inte­rests (Art. 6 para. 1 sentence 1 lit. f) GDPR).

Web analysis, moni­to­ring and opti­miza­tion

Web analysis (also referred to as “reach measu­re­ment”) is used to evaluate the flow of visi­tors to our online offe­ring and may include beha­vior, inte­rests or demo­gra­phic infor­ma­tion about visi­tors, such as age or gender, as pseud­ony­mous values. With the help of reach analysis, we can, for example, reco­gnize at what time our online offer or its func­tions or content are most frequently used or invite reuse. We can also under­stand which areas require opti­miza­tion.

In addi­tion to web analysis, we may also use test proce­dures, e.g. to test and opti­mize diffe­rent versions of our online offe­ring or its compon­ents.

Unless other­wise stated below, profiles, i.e. data summa­rized for a usage process, can be created for these purposes and infor­ma­tion can be stored in a browser or in a terminal device and read out from it. The infor­ma­tion coll­ected includes, in parti­cular, websites visited and the elements used there, as well as tech­nical infor­ma­tion such as the browser used, the computer system used and infor­ma­tion on usage times. If users have consented to the coll­ec­tion of their loca­tion data from us or from the provi­ders of the services we use, loca­tion data may also be processed.

The IP addresses of users are also stored. However, we use an IP masking proce­dure (i.e. pseud­ony­miza­tion by shor­tening the IP address) to protect users. In general, no clear user data (such as e‑mail addresses or names) is stored in the context of web analysis, A/B testing and opti­miza­tion, but pseud­onyms. This means that we and the provi­ders of the soft­ware used do not know the actual iden­tity of the users, but only the infor­ma­tion stored in their profiles for the purposes of the respec­tive processes.

- Processed data types: Usage data (e.g. websites visited, inte­rest in content, access times); meta, commu­ni­ca­tion and proce­dural data (e.g. .e.g. IP addresses, time data, iden­ti­fi­ca­tion numbers, consent status).

- Data subjects: Users (e.g. website visi­tors, users of online services).

- Purposes of proces­sing: Reach measu­re­ment (e.g. access statis­tics, reco­gni­tion of retur­ning visi­tors); profiles with user-related infor­ma­tion (crea­tion of user profiles). Provi­sion of our online services and user-friend­li­ness.

- Secu­rity measures: IP masking (pseud­ony­miza­tion of the IP address).

- Legal bases: Legi­ti­mate inte­rests (Art. 6 para. 1 sentence 1 lit. f) GDPR). Consent (Art. 6 para. 1 sentence 1 lit. a) GDPR).

Further infor­ma­tion on proces­sing processes, proce­dures and services:

- Google Analy­tics: We use Google Analy­tics to measure and analyze the use of our online offe­ring on the basis of a pseud­ony­mous user iden­ti­fi­ca­tion number. This iden­ti­fi­ca­tion number does not contain any unique data, such as names or email addresses. It is used to assign analysis infor­ma­tion to an end device in order to reco­gnize which content users have called up within one or more usage processes, which search terms they have used, which they have called up again or which they have inter­acted with our online offe­ring. The time of use and its dura­tion are also stored, as well as the sources of the users who refer to our online offe­ring and tech­nical aspects of their end devices and brow­sers.

Pseud­ony­mous profiles of users are created with infor­ma­tion from the use of various devices, whereby cookies may be used. Google Analy­tics does not log or store indi­vi­dual IP addresses for EU users. However, Analy­tics provides rough geogra­phic loca­tion data by deri­ving the follo­wing meta­data from IP addresses: City (and the city’s inferred lati­tude and longi­tude), Conti­nent, Country, Region, Subcon­ti­nent (and ID-based coun­ter­parts). For EU traffic, IP address data is used exclu­si­vely for this deri­va­tion of geolo­ca­tion data before it is imme­dia­tely deleted. They are not logged, are not acces­sible and are not used for other purposes. When Google Analy­tics coll­ects measu­re­ment data, all IP queries are performed on EU-based servers before the traffic is forwarded to Analy­tics servers for proces­sing; service provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland; Legal basis: Consent (Art. 6 para. 1 sentence 1 lit. a) GDPR); Website: https://marketingplatform.google.com/intl/de/about/analytics/; Secu­rity measures: IP masking (pseud­ony­miza­tion of the IP address); Privacy Policy: https://policies.google.com/privacy; Data proces­sing agree­ment: https://business.safety.google/adsprocessorterms/; Basis for third country trans­fers: Data Privacy Frame­work (DPF); Opt-Out: Opt-out plug-in: https://tools.google.com/dlpage/gaoptout?hl=de; Settings for the display of adver­ti­se­ments: https://myadcenter.google.com/personalizationoff. Further infor­ma­tion: https://business.safety.google/adsservices/ (types of proces­sing and processed data).

- Matomo (without cookies): Matomo is a data protec­tion-friendly web analysis soft­ware that is used without cookies and in which recur­ring users are reco­gnized with the help of a so-called “digital finger­print”, which is stored anony­mously and changed every 24 hours; With the “digital finger­print”, user move­ments within our online offer are recorded with the help of pseud­ony­mized IP addresses in combi­na­tion with user-side browser settings in such a way that it is not possible to draw conclu­sions about the iden­tity of indi­vi­dual users. The user data coll­ected through the use of Matomo is only processed by us and is not shared with third parties; legal basis: Legi­ti­mate inte­rests (Art. 6 para. 1 sentence 1 lit. f) GDPR). Website: https://matomo.org/.

Plugins and embedded func­tions and content

We incor­po­rate func­tional and content elements into our online offe­ring that are obtained from the servers of their respec­tive provi­ders (herein­after referred to as “third-party provi­ders”). These may be, for example, graphics, videos or city maps (herein­after uniformly referred to as “content”).

The inte­gra­tion always requires that the third-party provi­ders of this content process the IP address of the user, as they would not be able to send the content to their browser without the IP address. The IP address is ther­e­fore required to display this content or func­tion. We endeavor to only use content whose respec­tive provi­ders only use the IP address to deliver the content. Third-party provi­ders may also use so-called pixel tags (invi­sible graphics, also known as “web beacons”) for statis­tical or marke­ting purposes. Pixel tags can be used to analyze infor­ma­tion such as visitor traffic on the pages of this website. The pseud­ony­mous infor­ma­tion may also be stored in cookies on the user’s device and may contain, among other things, tech­nical infor­ma­tion about the browser and opera­ting system, refer­ring websites, time of visit and other infor­ma­tion about the use of our online offer, as well as being linked to such infor­ma­tion from other sources.

- Processed data types: Usage data (e.g. websites visited, inte­rest in content, access times); meta, commu­ni­ca­tion and proce­dural data (e.g. IP addresses, time data, iden­ti­fi­ca­tion numbers, consent status). Loca­tion data (infor­ma­tion on the geogra­phical posi­tion of a device or person).

- Data subjects: Users (e.g. website visi­tors, users of online services).

- Purposes of proces­sing: Provi­sion of our online services and user-friend­li­ness; marke­ting. Profiles with user-related infor­ma­tion (crea­tion of user profiles).

- Legal bases: Legi­ti­mate inte­rests (Art. 6 para. 1 sentence 1 lit. f) GDPR). Consent (Art. 6 para. 1 sentence 1 lit. a) GDPR).

Further infor­ma­tion on proces­sing opera­tions, proce­dures and services:

- Google Fonts (provi­sion on own server): Provi­sion of font files for the purpose of a user-friendly presen­ta­tion of our online offer; service provider: The Google Fonts are hosted on our server, no data is trans­mitted to Google; Legal basis: Legi­ti­mate inte­rests (Art. 6 para. 1 sentence 1 lit. f) GDPR).

- Google Fonts (obtained from the Google server): Obtai­ning fonts (and symbols) for the purpose of a tech­ni­cally secure, main­ten­ance-free and effi­cient use of fonts and symbols with regard to topi­cality and loading times, their uniform presen­ta­tion and conside­ra­tion of possible licen­sing rest­ric­tions. The provider of the fonts is informed of the user’s IP address so that the fonts can be made available in the user’s browser. In addi­tion, tech­nical data (language settings, screen reso­lu­tion, opera­ting system, hard­ware used) are trans­mitted that are neces­sary for the provi­sion of the fonts depen­ding on the devices used and the tech­nical envi­ron­ment. This data may be processed on a server of the font provider in the USA — When visi­ting our online offer, users’ brow­sers send their browser HTTP requests to the Google Fonts Web API (i.e. a soft­ware inter­face for retrie­ving fonts). The Google Fonts Web API provides users with the Google Fonts Casca­ding Style Sheets (CSS) and then the fonts speci­fied in the CCS. These HTTP requests include (1) the IP address used by the respec­tive user to access the Internet, (2) the requested URL on the Google server and (3) the HTTP headers, inclu­ding the User-Agent, which describes the browser and opera­ting system versions of the website visi­tors, as well as the referral URL (i.e. the web page on which the Google font is to be displayed). IP addresses are neither logged nor stored on Google servers and are not analyzed. The Google Fonts Web API logs details of HTTP requests (requested URL, user agent and referrer URL). Access to this data is rest­ricted and strictly controlled. The requested URL iden­ti­fies the font fami­lies for which the user wants to load fonts. This data is logged so that Google can deter­mine how often a parti­cular font family is requested. With the Google Fonts Web API, the user agent must adapt the font that is gene­rated for the respec­tive browser type. The user agent is prima­rily logged for debug­ging and used to gene­rate aggre­gated usage statis­tics to measure the popu­la­rity of font fami­lies. These aggre­gated usage statis­tics are published on the Google Fonts “Analy­tics” page. Finally, the referral URL is logged so that the data can be used for produc­tion main­ten­ance and to gene­rate an aggre­gated report on the top inte­gra­tions based on the number of font requests. Accor­ding to its own infor­ma­tion, Google does not use any of the infor­ma­tion coll­ected by Google Fonts to create profiles of end users or to place targeted ads; service provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland; Legal basis: Legi­ti­mate inte­rests (Art. 6 para. 1 sentence 1 lit. f) GDPR); Website: https://fonts.google.com/; Privacy Policy: https://policies.google.com/privacy; Basis for third country trans­fers: Data Privacy Frame­work (DPF). Further infor­ma­tion: https://developers.google.com/fonts/faq/privacy?hl=de.

- Google Maps: We inte­grate the maps of the “Google Maps” service provided by Google. The processed data may include, in parti­cular, IP addresses and loca­tion data of users; service provider: Google Cloud EMEA Limited, 70 Sir John Rogerson’s Quay, Dublin 2, Ireland; Legal basis: Consent (Art. 6 para. 1 sentence 1 lit. a) GDPR); Website: https://mapsplatform.google.com/; Privacy Policy: https://policies.google.com/privacy. Basis for third country trans­fers: Data Privacy Frame­work (DPF).

- Insta­gram plugins and content: Insta­gram plugins and content — This may include, for example, content such as images, videos or text and buttons with which users can share content from this online offe­ring within Insta­gram. — We are jointly respon­sible with Meta Plat­forms Ireland Limited for the coll­ec­tion or receipt in the context of a trans­mis­sion (but not the further proces­sing) of “event data” that Face­book coll­ects using Insta­gram func­tions (e.g. embed­ding func­tions for content) that are executed on our online offer or receives in the context of a trans­mis­sion for the follo­wing purposes: a) Display of content and adver­ti­sing infor­ma­tion that corre­sponds to the presumed inte­rests of the users; b) Deli­very of commer­cial and tran­sac­tion-related messages (e.g. addres­sing users via Insta­gram). (e.g. addres­sing users via Face­book Messenger); c) impro­ving ad deli­very and perso­na­liza­tion of features and content (e.g. impro­ving the reco­gni­tion of which content or adver­ti­sing infor­ma­tion presu­mably corre­sponds to the inte­rests of users). We have concluded a special agree­ment with Face­book (“Addendum for Data Control­lers”, https://www.facebook.com/legal/controller_addendum), which regu­lates in parti­cular which secu­rity measures Face­book must observe (https://www.facebook.com/legal/terms/data_security_terms) and in which Face­book has agreed to fulfill the rights of data subjects (i.e. users can, for example, send infor­ma­tion or dele­tion requests directly to Face­book). Note: If Face­book provides us with measu­re­ments, analyses and reports (which are aggre­gated, i.e. do not contain any infor­ma­tion about indi­vi­dual users and are anony­mous to us), this proces­sing is not carried out within the frame­work of joint respon­si­bi­lity, but on the basis of a data proces­sing agree­ment (“Data Proces­sing Terms”, https://www.facebook.com/legal/terms/dataprocessing) the “Data Secu­rity Terms” (https://www.facebook.com/legal/terms/data_security_terms) and, with regard to proces­sing in the USA, on the basis of stan­dard contrac­tual clauses (“Face­book-EU Data Transfer Addendum, https://www.facebook.com/legal/EU_data_transfer_addendum). The rights of users (in parti­cular to infor­ma­tion, dele­tion, objec­tion and complaint to the compe­tent super­vi­sory autho­rity) are not rest­ricted by the agree­ments with Face­book; service provider: Meta Plat­forms Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland; Legal basis: Legi­ti­mate inte­rests (Art. 6 para. 1 sentence 1 lit. f) GDPR); Website: https://www.instagram.com. Privacy policy: https://instagram.com/about/legal/privacy/.

- YouTube videos: Video content; YouTube videos are inte­grated via a special domain (reco­gnizable by the compo­nent “youtube-nocookie”) in the so-called “extended data protec­tion mode”, whereby no cookies are coll­ected on user acti­vi­ties in order to perso­na­lize the video play­back. Nevert­heless, infor­ma­tion about the user’s inter­ac­tion with the video (e.g. remem­be­ring the last play­back point) may be stored; service provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland; Legal basis: Consent (Art. 6 para. 1 sentence 1 lit. a) GDPR); Website: https://www.youtube.com; Privacy Policy: https://policies.google.com/privacy. Basis for third country trans­fers: Data Privacy Frame­work (DPF).

Defi­ni­tions of terms

This section provides an over­view of the terms used in this privacy policy. Where the terms are defined by law, their legal defi­ni­tions apply. However, the follo­wing expl­ana­tions are prima­rily intended to aid under­stan­ding.

- Personal data: “Personal data” means any infor­ma­tion rela­ting to an iden­ti­fied or iden­ti­fiable natural person (herein­after “data subject”); an iden­ti­fiable natural person is one who can be iden­ti­fied, directly or indi­rectly, in parti­cular by refe­rence to an iden­ti­fier such as a name, an iden­ti­fi­ca­tion number, loca­tion data, an online iden­ti­fier (e.g. cookie) or to one or more factors specific to the physical, physio­lo­gical, genetic, mental, economic, cultural or social iden­tity of that natural person.

- Profiles with user-related infor­ma­tion: The proces­sing of “profiles with user-related infor­ma­tion”, or “profiles” for short, includes any type of auto­mated proces­sing of personal data that consists of using this personal data to analyze, evaluate or predict certain personal aspects rela­ting to a natural person (depen­ding on the type of profiling, this may include various infor­ma­tion rela­ting to demo­gra­phics, beha­vior and inte­rests, such as inter­ac­tion with websites and their content, etc.) (e.g. inte­rests in certain content or products, click beha­vior on a website or loca­tion). Cookies and web beacons are often used for profiling purposes.

- Reach measu­re­ment: Reach measu­re­ment (also known as web analy­tics) is used to evaluate the flow of visi­tors to an online offe­ring and can include the beha­vior or inte­rests of visi­tors in certain infor­ma­tion, such as website content. With the help of reach analysis, opera­tors of online offers can, for example, reco­gnize at what time users visit their websites and what content they are inte­rested in. This enables them to better adapt the content of their websites to the needs of their visi­tors, for example. For the purposes of reach analysis, pseud­ony­mous cookies and web beacons are often used to reco­gnize retur­ning visi­tors and thus obtain more precise analyses of the use of an online offer.

- Loca­tion data: Loca­tion data is gene­rated when a mobile device (or another device with the tech­nical requi­re­ments for loca­tion deter­mi­na­tion) connects to a radio cell, a WLAN or similar tech­nical means and func­tions of loca­tion deter­mi­na­tion. Loca­tion data is used to indi­cate the geogra­phi­cally deter­minable posi­tion on earth at which the respec­tive device is located. Loca­tion data can be used, for example, to display map func­tions or other loca­tion-depen­dent infor­ma­tion.

- Controller: “Controller” means the natural or legal person, public autho­rity, agency or other body which, alone or jointly with others, deter­mines the purposes and means of the proces­sing of personal data.

- Proces­sing: “Proces­sing” means any opera­tion or set of opera­tions which is performed on personal data, whether or not by auto­mated means. The term is broad and covers prac­ti­cally every hand­ling of data, whether it is coll­ec­tion, analysis, storage, trans­mis­sion or dele­tion.