• Published:
  • Updated:
  • Written by:

Privacy Policy

Privacy Policy

Status: 23 February 2024

Table of Contents

Controller

Michael Höpfl
Haid am Bühl 9
93489 Schorndorf

Email address: mail@michael-hoepfl.com

Overview of Processing

The following overview summarizes the types of data processed and the purposes of their processing and refers to the data subjects.

Types of Data Processed

  • Inventory data.
  • Contact data.
  • Content data.
  • Usage data.
  • Meta, communication and process data.

Categories of Data Subjects

  • Communication partners.
  • Users.

Purposes of Processing

  • Provision of contractual services and fulfillment of contractual obligations.
  • Contact requests and communication.
  • Security measures.
  • Reach measurement.
  • Managing and responding to inquiries.
  • Feedback.
  • Marketing.
  • Profiles with user-related information.
  • Provision of our online offering and user-friendliness.
  • Information technology infrastructure.

Relevant Legal Bases

Relevant legal bases under the GDPR: Below you will find an overview of the legal bases of the GDPR on the basis of which we process personal data. Please note that, in addition to the provisions of the GDPR, national data protection regulations may apply in your or our country of residence or registered office. Should more specific legal bases apply in individual cases, we will inform you of these in the privacy policy.

  • Consent (Art. 6 para. 1 sentence 1 lit. a) GDPR) – The data subject has given consent to the processing of personal data concerning them for one or more specific purposes.
  • Performance of a contract and pre-contractual inquiries (Art. 6 para. 1 sentence 1 lit. b) GDPR) – Processing is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract.
  • Legitimate interests (Art. 6 para. 1 sentence 1 lit. f) GDPR) – Processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data.

National data protection regulations in Germany: In addition to the data protection provisions of the GDPR, national data protection regulations apply in Germany. In particular, this includes the German Federal Data Protection Act (Bundesdatenschutzgesetz – BDSG). The BDSG contains special provisions concerning, among other things, the right of access, the right to erasure, the right to object, the processing of special categories of personal data, processing for other purposes, transfers, and automated individual decision-making including profiling. In addition, the data protection laws of the individual federal states may apply.

Reference to the applicability of the GDPR and the Swiss FADP: This privacy notice serves to provide information both under the Swiss Federal Act on Data Protection (Swiss FADP) and under the General Data Protection Regulation (GDPR). For reasons of broader geographical applicability and comprehensibility, we therefore use the terminology of the GDPR. In particular, instead of the Swiss FADP terms “processing” of “personal data”, “overriding interest” and “sensitive personal data”, we use the GDPR terms “processing” of “personal data”, “legitimate interest” and “special categories of data”. However, within the scope of application of the Swiss FADP, the legal meaning of these terms continues to be determined in accordance with the Swiss FADP.

Security Measures

We take appropriate technical and organizational measures in accordance with legal requirements, taking into account the state of the art, implementation costs and the nature, scope, circumstances and purposes of processing as well as the different probabilities of occurrence and the extent of threats to the rights and freedoms of natural persons, in order to ensure a level of security appropriate to the risk.

The measures include, in particular, safeguarding the confidentiality, integrity and availability of data by controlling physical and electronic access to the data as well as access, input, disclosure, safeguarding availability and separation of the data. Furthermore, we have established procedures to ensure the exercise of data subject rights, deletion of data and responses to threats to the data. We also take the protection of personal data into account when developing or selecting hardware, software and procedures, in accordance with the principles of data protection by design and data protection-friendly default settings.

International Data Transfers

Data processing in third countries: If we process data in a third country (i.e. outside the European Union (EU) or the European Economic Area (EEA)), or if processing takes place in connection with the use of third-party services or the disclosure or transfer of data to other persons, bodies or companies, this is done only in accordance with legal requirements. If the level of data protection in the third country has been recognized by means of an adequacy decision (Art. 45 GDPR), this serves as the basis for the data transfer. Otherwise, data transfers take place only if the level of data protection is otherwise safeguarded, in particular through standard contractual clauses (Art. 46 para. 2 lit. c) GDPR), explicit consent, or in the case of transfers required by contract or law (Art. 49 para. 1 GDPR). We also inform you of the basis for third-country transfers for the individual providers from third countries, with adequacy decisions taking precedence. Information on third-country transfers and existing adequacy decisions can be found in the information provided by the EU Commission: https://commission.europa.eu/law/law-topic/data-protection/international-dimension-data-protection_en?prefLang=de.

EU-US Trans-Atlantic Data Privacy Framework: As part of the so-called “Data Privacy Framework” (DPF), the EU Commission has also recognized the level of data protection for certain companies in the USA as adequate under the adequacy decision of 10 July 2023. The list of certified companies and further information about the DPF can be found on the website of the U.S. Department of Commerce at https://www.dataprivacyframework.gov/ (in English). In this privacy notice, we indicate which service providers we use are certified under the Data Privacy Framework.

Rights of Data Subjects

Rights of data subjects under the GDPR: As a data subject, you are entitled to various rights under the GDPR, arising in particular from Articles 15 to 21 GDPR:

  • Right to object: You have the right, on grounds relating to your particular situation, to object at any time to processing of personal data concerning you which is based on Art. 6 para. 1 lit. e or f GDPR; this also applies to profiling based on those provisions. Where personal data concerning you is processed for direct marketing purposes, you have the right to object at any time to the processing of personal data concerning you for such marketing; this also applies to profiling to the extent that it is related to such direct marketing.
  • Right to withdraw consent: You have the right to withdraw consent you have given at any time.
  • Right of access: You have the right to obtain confirmation as to whether personal data concerning you is being processed and to obtain access to this data as well as further information and a copy of the data in accordance with legal requirements.
  • Right to rectification: In accordance with legal requirements, you have the right to request completion of data concerning you or rectification of inaccurate data concerning you.
  • Right to erasure and restriction of processing: In accordance with legal requirements, you have the right to request that data concerning you be erased without undue delay or, alternatively, to request restriction of processing of the data.
  • Right to data portability: You have the right to receive data concerning you that you have provided to us in a structured, commonly used and machine-readable format in accordance with legal requirements, or to request its transmission to another controller.
  • Complaint to a supervisory authority: Without prejudice to any other administrative or judicial remedy, you have the right to lodge a complaint with a supervisory authority, in particular in the Member State of your habitual residence, place of work or place of the alleged infringement, if you consider that the processing of personal data concerning you infringes the GDPR.

Use of Cookies

Cookies are small text files or other storage records that store information on end devices and read information from end devices. For example, they may store the login status in a user account, the contents of a shopping cart in an e-shop, content accessed or functions used in an online offering. Cookies may also be used for various purposes, such as ensuring the functionality, security and convenience of online offerings and analyzing visitor flows.

Information on consent: We use cookies in accordance with legal requirements. We therefore obtain users’ prior consent unless this is not required by law. In particular, consent is not required if storing and reading information, including cookies, is strictly necessary to provide users with a telemedia service they have expressly requested (i.e. our online offering). Strictly necessary cookies generally include cookies with functions serving the display and operability of the online offering, load balancing, security, storage of user preferences and choices, or similar purposes related to providing the main and ancillary functions of the online offering requested by users. Revocable consent is clearly communicated to users and includes information about the respective use of cookies.

Information on data-protection legal bases: The legal basis under data protection law on which we process users’ personal data with the help of cookies depends on whether we ask users for consent. If users consent, the legal basis for processing their data is the consent given. Otherwise, data processed with the help of cookies is processed on the basis of our legitimate interests (e.g. in the commercially viable operation of our online offering and improvement of its usability) or, where this takes place in the context of fulfilling our contractual obligations, if the use of cookies is necessary to fulfill those obligations. We explain the purposes for which we process cookies in the course of this privacy policy or as part of our consent and processing procedures.

Storage period: With regard to the storage period, the following types of cookies are distinguished:

  • Temporary cookies (also: session cookies): Temporary cookies are deleted at the latest after a user leaves an online offering and closes their end device (e.g. browser or mobile application).
  • Permanent cookies: Permanent cookies remain stored even after the end device is closed. For example, login status can be stored or preferred content displayed directly when the user visits a website again. Data collected from users with the help of cookies may also be used for reach measurement. Unless we provide users with explicit information about the type and storage duration of cookies (e.g. when obtaining consent), users should assume that cookies are permanent and may be stored for up to two years.

General information on withdrawal and objection (so-called “opt-out”): Users can withdraw consent they have given at any time and object to processing in accordance with legal requirements. Among other things, users can restrict the use of cookies in their browser settings (although this may also restrict the functionality of our online offering). An objection to the use of cookies for online marketing purposes can also be declared via the websites https://optout.aboutads.info and https://www.youronlinechoices.com/.

  • Legal bases: Legitimate interests (Art. 6 para. 1 sentence 1 lit. f) GDPR).

Provision of the Online Offering and Web Hosting

We process users’ data in order to provide them with our online services. For this purpose, we process the user’s IP address, which is necessary to transmit the content and functions of our online services to the user’s browser or end device.

  • Types of data processed: Usage data (e.g. websites visited, interest in content, access times); meta, communication and process data (e.g. IP addresses, time data, identification numbers, consent status).
  • Data subjects: Users (e.g. website visitors, users of online services).
  • Purposes of processing: Provision of our online offering and user-friendliness; information technology infrastructure (operation and provision of information systems and technical devices (computers, servers, etc.)). Security measures.
  • Legal bases: Legitimate interests (Art. 6 para. 1 sentence 1 lit. f) GDPR).

Further information on processing operations, procedures and services:

  • Collection of access data and log files: Access to our online offering is logged in the form of so-called “server log files”. Server log files may include the address and name of accessed web pages and files, date and time of access, transferred data volumes, notification of successful access, browser type and version, the user’s operating system, referrer URL (the previously visited page) and, as a rule, IP addresses and the requesting provider. Server log files may be used for security purposes, e.g. to avoid overloading servers (especially in the event of abusive attacks, so-called DDoS attacks), and to ensure server utilization and stability; Legal bases: Legitimate interests (Art. 6 para. 1 sentence 1 lit. f) GDPR). Deletion of data: Log file information is stored for a maximum of 30 days and then deleted or anonymized. Data whose further retention is required for evidentiary purposes is excluded from deletion until the respective incident has been finally clarified.

Blogs and Publication Media

We use blogs or comparable means of online communication and publication (hereinafter “publication medium”). Readers’ data is processed for the purposes of the publication medium only to the extent necessary for its presentation and communication between authors and readers or for security reasons. Otherwise, we refer to the information on processing visitors to our publication medium contained in this privacy notice.

  • Types of data processed: Inventory data (e.g. names, addresses); contact data (e.g. email, telephone numbers); content data (e.g. entries in online forms); usage data (e.g. websites visited, interest in content, access times); meta, communication and process data (e.g. IP addresses, time data, identification numbers, consent status).
  • Data subjects: Users (e.g. website visitors, users of online services).
  • Purposes of processing: Provision of contractual services and fulfillment of contractual obligations; feedback (e.g. collecting feedback via an online form); provision of our online offering and user-friendliness; security measures. Managing and responding to inquiries.
  • Legal bases: Legitimate interests (Art. 6 para. 1 sentence 1 lit. f) GDPR).

Further information on processing operations, procedures and services:

  • Comments and posts: If users leave comments or other posts, their IP addresses may be stored on the basis of our legitimate interests. This is done for our security in case someone leaves unlawful content in comments or posts (insults, prohibited political propaganda, etc.). In such a case, we ourselves may be held liable for the comment or post and therefore have an interest in the identity of the author.

    Furthermore, on the basis of our legitimate interests, we reserve the right to process user information for spam detection.

    On the same legal basis, in the case of polls we reserve the right to store users’ IP addresses for the duration of the poll and to use cookies to prevent multiple voting.

    Personal information provided in comments and posts, any contact and website information, as well as the content itself, will be stored by us permanently until the user objects; Legal bases: Legitimate interests (Art. 6 para. 1 sentence 1 lit. f) GDPR).

Contact and Inquiry Management

When contacting us (e.g. by post, contact form, email, telephone or via social media) and in the context of existing user and business relationships, the information provided by the inquiring persons is processed insofar as this is necessary to answer the contact inquiries and any requested measures.

  • Types of data processed: Contact data (e.g. email, telephone numbers); content data (e.g. entries in online forms); usage data (e.g. websites visited, interest in content, access times); meta, communication and process data (e.g. IP addresses, time data, identification numbers, consent status).
  • Data subjects: Communication partners.
  • Purposes of processing: Contact requests and communication; managing and responding to inquiries; feedback (e.g. collecting feedback via an online form). Provision of our online offering and user-friendliness.
  • Legal bases: Legitimate interests (Art. 6 para. 1 sentence 1 lit. f) GDPR). Performance of a contract and pre-contractual inquiries (Art. 6 para. 1 sentence 1 lit. b) GDPR).

Further information on processing operations, procedures and services:

  • Contact form: If users contact us via our contact form, email or other communication channels, we process the data provided to us in this context in order to handle the communicated request; Legal bases: Performance of a contract and pre-contractual inquiries (Art. 6 para. 1 sentence 1 lit. b) GDPR), legitimate interests (Art. 6 para. 1 sentence 1 lit. f) GDPR).

Web Analysis, Monitoring and Optimization

Web analysis (also referred to as “reach measurement”) is used to evaluate visitor flows to our online offering and may include behavior, interests or demographic information about visitors, such as age or gender, as pseudonymous values. With the help of reach analysis, we can, for example, identify when our online offering or its functions or content are used most frequently or encourage repeat use. We can also understand which areas require optimization.

In addition to web analysis, we may also use testing procedures, for example to test and optimize different versions of our online offering or its components.

Unless otherwise stated below, profiles, i.e. data summarized for a usage process, may be created for these purposes and information may be stored in and read from a browser or end device. The information collected includes in particular websites visited and elements used there, as well as technical information such as the browser used, the computer system used and information on usage times. If users have consented to the collection of their location data by us or by providers of the services we use, location data may also be processed.

Users’ IP addresses are also stored. However, we use an IP masking procedure (i.e. pseudonymization by shortening the IP address) to protect users. In general, no directly identifying user data (such as email addresses or names) is stored in the context of web analysis, A/B testing and optimization, but rather pseudonyms. This means that neither we nor the providers of the software used know the users’ actual identity, only the information stored in their profiles for the purposes of the respective procedures.

  • Types of data processed: Usage data (e.g. websites visited, interest in content, access times); meta, communication and process data (e.g. IP addresses, time data, identification numbers, consent status).
  • Data subjects: Users (e.g. website visitors, users of online services).
  • Purposes of processing: Reach measurement (e.g. access statistics, recognition of returning visitors). Profiles with user-related information (creation of user profiles).
  • Security measures: IP masking (pseudonymization of the IP address).
  • Legal bases: Consent (Art. 6 para. 1 sentence 1 lit. a) GDPR).

Further information on processing operations, procedures and services:

  • Matomo: Matomo is software used for web analysis and reach measurement. When Matomo is used, cookies are generated and stored on users’ end devices. User data collected through the use of Matomo is processed only by us and is not shared with third parties. The cookies are stored for a maximum period of 13 months: https://matomo.org/faq/general/faq_146/; Legal bases: Consent (Art. 6 para. 1 sentence 1 lit. a) GDPR). Deletion of data: The cookies have a maximum storage period of 13 months.

Presence in Social Networks (Social Media)

We maintain online presences within social networks and process user data in this context in order to communicate with users active there or to provide information about us.

Please note that user data may be processed outside the European Union. This may result in risks for users because, for example, enforcement of users’ rights could be made more difficult.

Furthermore, user data within social networks is generally processed for market research and advertising purposes. For example, usage profiles can be created based on usage behavior and the resulting interests of users. These usage profiles can in turn be used, for example, to display advertisements within and outside the networks that are presumed to correspond to users’ interests. For these purposes, cookies are generally stored on users’ computers in which usage behavior and interests are stored. In addition, data may be stored in usage profiles independently of the devices used by users, particularly if users are members of the respective platforms and are logged in to them.

For a detailed description of the respective forms of processing and the options for objection (opt-out), we refer to the privacy policies and information provided by the operators of the respective networks.

In the case of requests for information and the exercise of data subject rights, we also point out that these can be asserted most effectively with the providers. Only the providers have access to users’ data and can directly take appropriate measures and provide information. If you nevertheless require assistance, you can contact us.

  • Types of data processed: Contact data (e.g. email, telephone numbers); content data (e.g. entries in online forms); usage data (e.g. websites visited, interest in content, access times); meta, communication and process data (e.g. IP addresses, time data, identification numbers, consent status).
  • Data subjects: Users (e.g. website visitors, users of online services).
  • Purposes of processing: Contact requests and communication; feedback (e.g. collecting feedback via an online form). Marketing.
  • Legal bases: Legitimate interests (Art. 6 para. 1 sentence 1 lit. f) GDPR).

Further information on processing operations, procedures and services:

  • LinkedIn: Social network; Service provider: LinkedIn Ireland Unlimited Company, Wilton Place, Dublin 2, Ireland; Legal bases: Legitimate interests (Art. 6 para. 1 sentence 1 lit. f) GDPR); Website: https://www.linkedin.com; Privacy Policy: https://www.linkedin.com/legal/privacy-policy; Basis for third-country transfers: Data Privacy Framework (DPF); Opt-out: https://www.linkedin.com/psettings/guest-controls/retargeting-opt-out; Further information: We are jointly responsible with LinkedIn Ireland Unlimited Company for the collection (but not further processing) of visitor data for the purpose of creating “Page Insights” (statistics) for our LinkedIn profiles.
    This data includes information about the types of content users view or interact with, or actions they take, as well as information about the devices used by users (e.g. IP addresses, operating system, browser type, language settings, cookie data) and information from users’ profiles, such as job function, country, industry, seniority, company size and employment status. Privacy information on LinkedIn’s processing of user data can be found in LinkedIn’s privacy policy: https://www.linkedin.com/legal/privacy-policy
    We have entered into a special agreement with LinkedIn Ireland (“Page Insights Joint Controller Addendum (the ‘Addendum’)”, https://legal.linkedin.com/pages-joint-controller-addendum), which in particular regulates the security measures LinkedIn must observe and in which LinkedIn has agreed to fulfill data subject rights (i.e. users can, for example, direct requests for information or deletion directly to LinkedIn). Users’ rights (in particular access, erasure, objection and complaint to the competent supervisory authority) are not restricted by the agreements with LinkedIn. Joint responsibility is limited to the collection of data by and its transfer to LinkedIn Ireland Unlimited Company, a company based in the EU. Further processing of the data is the sole responsibility of LinkedIn Ireland Unlimited Company, in particular the transfer of data to its parent company LinkedIn Corporation in the USA.
  • X: Social network; Service provider: Twitter International Company, One Cumberland Place, Fenian Street, Dublin 2 D02 AX07, Ireland; Legal bases: Legitimate interests (Art. 6 para. 1 sentence 1 lit. f) GDPR). Privacy Policy: https://twitter.com/privacy, (Settings: https://twitter.com/personalization).

Plugins and Embedded Functions and Content

We integrate functional and content elements into our online offering that are obtained from the servers of their respective providers (hereinafter referred to as “third-party providers”). These may include, for example, graphics, videos or city maps (hereinafter collectively referred to as “content”).

Integration always requires that the third-party providers of this content process users’ IP addresses, since without the IP address they could not send the content to users’ browsers. The IP address is therefore required to display this content or these functions. We endeavor to use only content whose respective providers use the IP address solely to deliver the content. Third-party providers may also use so-called pixel tags (invisible graphics, also known as “web beacons”) for statistical or marketing purposes. Pixel tags can be used to evaluate information such as visitor traffic on the pages of this website. The pseudonymous information may also be stored in cookies on users’ devices and may contain, among other things, technical information about the browser and operating system, referring websites, visit times and other information about the use of our online offering, and may also be linked with such information from other sources.

  • Types of data processed: Usage data (e.g. websites visited, interest in content, access times); meta, communication and process data (e.g. IP addresses, time data, identification numbers, consent status); inventory data (e.g. names, addresses); contact data (e.g. email, telephone numbers); content data (e.g. entries in online forms).
  • Data subjects: Users (e.g. website visitors, users of online services).
  • Purposes of processing: Provision of our online offering and user-friendliness.
  • Legal bases: Consent (Art. 6 para. 1 sentence 1 lit. a) GDPR). Legitimate interests (Art. 6 para. 1 sentence 1 lit. f) GDPR).

Further information on processing operations, procedures and services:

  • Google Fonts (obtained from Google server): Obtaining fonts (and symbols) for the purpose of technically secure, maintenance-free and efficient use of fonts and symbols with regard to up-to-dateness and loading times, uniform presentation and consideration of possible licensing restrictions. The font provider is informed of the user’s IP address so that the fonts can be made available in the user’s browser. In addition, technical data (language settings, screen resolution, operating system, hardware used) is transmitted as necessary to provide the fonts depending on the devices and technical environment used. This data may be processed on a server of the font provider in the USA. When visiting our online offering, users’ browsers send browser HTTP requests to the Google Fonts Web API (i.e. a software interface for retrieving fonts). The Google Fonts Web API provides users with the Cascading Style Sheets (CSS) from Google Fonts and then the fonts specified in the CSS. These HTTP requests include (1) the IP address used by the respective user to access the internet, (2) the requested URL on the Google server, and (3) the HTTP headers, including the user agent describing the browser and operating system versions of website visitors, as well as the referring URL (i.e. the web page on which the Google font is to be displayed). IP addresses are neither logged nor stored on Google servers and are not analyzed. The Google Fonts Web API logs details of HTTP requests (requested URL, user agent and referring URL). Access to this data is restricted and strictly controlled. The requested URL identifies the font families for which the user wishes to load fonts. This data is logged so Google can determine how often a particular font family is requested. With the Google Fonts Web API, the user agent is used to adapt the font generated for the respective browser type. The user agent is logged primarily for debugging and is used to generate aggregated usage statistics measuring the popularity of font families. These aggregated usage statistics are published on Google Fonts’ “Analytics” page. Finally, the referring URL is logged so the data can be used for production maintenance and to generate an aggregated report on top integrations based on the number of font requests. According to Google, it does not use any information collected by Google Fonts to create end-user profiles or serve targeted ads; Service provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland; Legal bases: Legitimate interests (Art. 6 para. 1 sentence 1 lit. f) GDPR); Website: https://fonts.google.com/; Privacy Policy: https://policies.google.com/privacy; Basis for third-country transfers: Data Privacy Framework (DPF). Further information: https://developers.google.com/fonts/faq/privacy?hl=de.
  • YouTube videos: Video content; Service provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland; Legal bases: Consent (Art. 6 para. 1 sentence 1 lit. a) GDPR); Website: https://www.youtube.com; Privacy Policy: https://policies.google.com/privacy; Basis for third-country transfers: Data Privacy Framework (DPF). Opt-out: Opt-out plugin: https://tools.google.com/dlpage/gaoptout?hl=de, settings for the display of advertisements: https://myadcenter.google.com/personalizationoff.

Created with free Datenschutz-Generator.de by Dr. Thomas Schwenke

Search: