Marta Schafstall – Data Protection

Privacy Policy

With the following privacy policy, we would like to inform you about the types of your personal data (hereinafter also referred to as "data") we process, for what purposes, and to what extent. The privacy policy applies to all processing of personal data carried out by us, both in the context of providing our services and, in particular, on our websites, in mobile applications, and within external online presences, such as our social media profiles (hereinafter collectively referred to as "online offer").

The terms used are not gender-specific.

Status: January 2026

Controller

Marta Schafstall
Bergstrasse 6
6004 Lucerne

E-mail address: marta.schafstall@gmail.com

Overview of Processing Activities

The following overview summarizes the types of processed data and the purposes of their processing and refers to the data subjects.

Types of Processed Data

Inventory data.
Payment data.
Contact details.
Content data.
Contract data.
Usage data.
Meta/communication data.

Categories of Data Subjects

Customers.
Interested parties.
Communication partners.
Users.
Business and contractual partners.

Purposes of Processing

Provision of contractual services and customer service.
Contact requests and communication.
Security measures.
Direct marketing.
Office and organizational procedures.
Management and responding to inquiries.
Feedback.
Marketing.
Profiles with user-related information.
Provision of our online offer and user-friendliness.
Information technology infrastructure.

Relevant Legal Bases

Below you will find an overview of the legal bases of the GDPR on which we process personal data. Please note that in addition to the regulations of the GDPR, national data protection regulations may apply in your or our country of residence or domicile. Should more specific legal bases be relevant in individual cases, we will inform you of these in the privacy policy.

Consent (Art. 6 para. 1 sentence 1 lit. a. GDPR) – The data subject has given consent to the processing of his or her personal data for one or more specific purposes.
Performance of a contract and prior requests (Art. 6 para. 1 sentence 1 lit. b. GDPR) – Processing is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract.
Legal obligation (Art. 6 para. 1 sentence 1 lit. c. GDPR) – Processing is necessary for compliance with a legal obligation to which the controller is subject.
Legitimate interests (Art. 6 para. 1 sentence 1 lit. f. GDPR) – Processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data.

In addition to the data protection regulations of the General Data Protection Regulation, national data protection regulations apply in Switzerland. This includes in particular the Federal Act on Data Protection (FADP). The FADP applies in particular if no EU/EEA citizens are affected and, for example, only data of Swiss citizens is processed.

Security Measures

We take appropriate technical and organizational measures in accordance with legal requirements, taking into account the state of the art, the costs of implementation and the nature, scope, context and purposes of processing as well as the risk of varying likelihood and severity for the rights and freedoms of natural persons, to ensure a level of security appropriate to the risk.

The measures include, in particular, securing the confidentiality, integrity and availability of data by controlling physical and electronic access to the data as well as access, entry, transfer, securing availability and separation of data. Furthermore, we have established procedures to ensure the exercise of data subject rights, deletion of data and responses to data hazards. Furthermore, we consider the protection of personal data as early as the development or selection of hardware, software and procedures in accordance with the principle of data protection, through technology design and through data protection-friendly default settings.

SSL encryption (https): To protect your data transmitted via our online offering, we use SSL encryption. You can recognize such encrypted connections by the prefix https:// in the address bar of your browser.

Transmission of Personal Data

In the context of our processing of personal data, it may happen that the data is transmitted to other entities, companies, legally independent organizational units or persons, or disclosed to them. Recipients of this data may include, for example, service providers commissioned with IT tasks or providers of services and content that are integrated into a website. In such cases, we comply with the legal requirements and, in particular, conclude corresponding contracts or agreements serving the protection of your data with the recipients of your data.

Data Processing in Third Countries

If we process data in a third country (i.e., outside the European Union (EU), the European Economic Area (EEA)) or if the processing takes place in the context of using third-party services or disclosure or transmission of data to other persons, entities or companies, this is only done in accordance with legal requirements.

Subject to express consent or contractually or legally required transmission, we process or have the data processed only in third countries with a recognized level of data protection, contractual obligation through so-called standard contractual clauses of the EU Commission, in the presence of certifications or binding internal corporate rules (Art. 44 to 49 GDPR, information page of the EU Commission: https://ec.europa.eu/info/law/law-topic/data-protection/international-dimension-data-protection_de).

Deletion of Data

The data processed by us will be deleted in accordance with the legal requirements as soon as their consent permitted for processing is revoked or other permissions cease to apply (e.g., if the purpose of processing this data has ceased to apply or it is not required for the purpose). If the data is not deleted because it is required for other and legally permissible purposes, its processing will be restricted to these purposes. This means that the data is blocked and not processed for other purposes. This applies, for example, to data that must be kept for commercial or tax reasons or whose storage is necessary for the establishment, exercise or defense of legal claims or for the protection of the rights of another natural or legal person.

Our privacy policy may also contain further details on the retention and deletion of data, which apply primarily to the respective processing activities.

Use of Cookies

Cookies are small text files or other storage notices that store information on terminal devices and read information from the terminal devices. For example, to store the login status in a user account, shopping cart contents in an e-shop, the content accessed or functions used of an online offer. Cookies can also be used for various purposes, e.g., for purposes of functionality, security and convenience of online offers, as well as for creating analyses of visitor flows.

Information on Consent: We use cookies in accordance with legal regulations. Therefore, we obtain prior consent from users, unless this is not legally required. Consent is in particular not necessary if the storage and reading of the information, including cookies, are absolutely necessary to provide the user with a telemedia service explicitly requested by them (i.e., our online offer). The revocable consent is clearly communicated to the users and contains information on the respective cookie usage.

Information on Data Protection Legal Bases: The data protection legal basis on which we process the personal data of users with the help of cookies depends on whether we ask users for consent. If the users consent, the legal basis for processing your data is the declared consent. Otherwise, the data processed with the help of cookies is processed on the basis of our legitimate interests (e.g., in a commercial operation of our online offer and improvement of its usability) or, if this takes place in the context of fulfilling our contractual obligations, when the use of cookies is necessary to fulfill our contractual obligations. The purposes for which the cookies are processed by us are explained in the course of this privacy policy or in the context of our consent and processing procedures.

Storage Duration: With regard to the storage duration, a distinction is made between the following types of cookies:

Temporary cookies (also: session cookies): Temporary cookies are deleted at the latest after a user has left an online offer and closed their end device (e.g., browser or mobile application).
Permanent cookies: Permanent cookies remain stored even after the end device is closed. For example, the login status can be saved or preferred content can be displayed directly when the user visits a website again. Likewise, the data of users collected with the help of cookies can be used for range measurement. Unless we provide users with explicit information on the type and storage duration of cookies (e.g., as part of obtaining consent), users should assume that cookies are permanent and the storage period can be up to two years.

General Information on Revocation and Objection (Opt-Out): Users can revoke the consent they have given at any time and also object to the processing in accordance with the legal requirements in Art. 21 GDPR. Users can also declare their objection via the settings of their browser, e.g., by deactivating the use of cookies (although this may also restrict the functionality of our online services). An objection to the use of cookies for online marketing purposes can also be declared via the websites https://optout.aboutads.info and https://www.youronlinechoices.com/.

Further Information on Processing Activities, Procedures and Services:

Processing of Cookie Data on the Basis of Consent: We use a cookie consent management procedure, in the context of which the consent of users to the use of cookies, or the processing and providers mentioned in the context of the cookie consent management procedure, can be obtained, managed and revoked by the users. Here, the declaration of consent is stored in order not to have to repeat its query and to be able to prove the consent in accordance with the legal obligation. Storage can take place on the server side and/or in a cookie (so-called opt-in cookie, or using comparable technologies) in order to be able to assign the consent to a user or their device. Subject to individual details on the providers of cookie management services, the following instructions apply: The duration of the storage of consent can be up to two years. In this process, a pseudonymous user identifier is formed and stored with the time of consent, details on the scope of consent (e.g., which categories of cookies and/or service providers) as well as the browser, system and end device used.

Business Services

We process data of our contractual and business partners, e.g., customers and interested parties (collectively referred to as "contractual partners") in the context of contractual and comparable legal relationships as well as associated measures and in the context of communication with the contractual partners (or pre-contractually), e.g., to answer inquiries.

We process this data to fulfill our contractual obligations. This includes in particular the obligations to provide the agreed services, any update obligations and remedies for warranty and other performance disruptions. In addition, we process the data to protect our rights and for the purpose of administrative tasks associated with these obligations as well as company organization. In addition, we process the data on the basis of our legitimate interests in proper and commercial business management as well as security measures to protect our contractual partners and our business operations from abuse, threats to their data, secrets, information and rights (e.g., for the involvement of telecommunications, transport and other auxiliary services as well as subcontractors, banks, tax and legal advisors, payment service providers or tax authorities). Within the scope of applicable law, we only pass on the data of contractual partners to third parties to the extent that this is necessary for the aforementioned purposes or to fulfill legal obligations. Contractual partners are informed about other forms of processing, e.g., for marketing purposes, within the scope of this privacy policy.

Which data is required for the aforementioned purposes is communicated to the contractual partners before or in the course of data collection, e.g., in online forms, by special marking (e.g., colors) or symbols (e.g., asterisks or similar), or personally.

We delete the data after the expiry of statutory warranty and comparable obligations, i.e., in principle after 4 years, unless the data is stored in a customer account, e.g., as long as they must be kept for legal reasons of archiving. The statutory retention period for documents relevant under tax law as well as for commercial books, inventories, opening balance sheets, annual financial statements, working instructions required to understand these documents and other organizational documents and booking vouchers is ten years, and six years for commercial and business letters received and copies of commercial and business letters sent. The period begins at the end of the calendar year in which the last entry was made in the book, the inventory, the opening balance sheet, the annual financial statement or the management report was drawn up, the commercial or business letter was received or sent, or the booking voucher was created, further the recording was made or the other documents were created.

Insofar as we use third-party providers or platforms to provide our services, the terms and conditions and privacy notices of the respective third-party providers or platforms apply in the relationship between the users and the providers.

Processed Data Types: Inventory data (e.g., names, addresses); payment data (e.g., bank details, invoices, payment history); contact details (e.g., email, telephone numbers); contract data (e.g., subject matter of contract, term, customer category); usage data (e.g., websites visited, interest in content, access times); meta/communication data (e.g., device information, IP addresses).
Data Subjects: Customers; interested parties; business and contractual partners.
Purposes of Processing: Provision of contractual services and customer service; security measures; contact requests and communication; office and organizational procedures; management and responding to inquiries.
Legal Bases: Performance of a contract and prior requests (Art. 6 para. 1 sentence 1 lit. b. GDPR); legal obligation (Art. 6 para. 1 sentence 1 lit. c. GDPR); legitimate interests (Art. 6 para. 1 sentence 1 lit. f. GDPR).

Further Information on Processing Activities, Procedures and Services:

Shop and E-Commerce: We process the data of our customers to enable them to select, purchase or order the selected products, goods and associated services, as well as their payment and delivery or execution. Insofar as necessary for the execution of an order, we use service providers, in particular postal, forwarding and shipping companies, to carry out the delivery or execution for our customers. For the processing of payment transactions, we use the services of banks and payment service providers. The required information is marked as such in the context of the order or comparable purchase process and includes the information required for delivery, provision and billing, as well as contact information to be able to consult if necessary; Legal Bases: Performance of a contract and prior requests (Art. 6 para. 1 sentence 1 lit. b. GDPR).

Use of Online Platforms for Offer and Distribution Purposes

We offer our services on online platforms operated by other service providers. In this context, in addition to our privacy policy, the privacy policy of the respective platforms applies. This applies in particular with regard to the execution of the payment transaction and the procedures used on the platforms for range measurement and interest-based marketing.

Processed Data Types: Inventory data (e.g., names, addresses); payment data (e.g., bank details, invoices, payment history); contact details (e.g., email, telephone numbers); contract data (e.g., subject matter of contract, term, customer category); usage data (e.g., websites visited, interest in content, access times); meta/communication data (e.g., device information, IP addresses).
Data Subjects: Customers.
Purposes of Processing: Provision of contractual services and customer service; marketing.
Legal Bases: Performance of a contract and prior requests (Art. 6 para. 1 sentence 1 lit. b. GDPR); legitimate interests (Art. 6 para. 1 sentence 1 lit. f. GDPR).

Provision of the Online Offer and Web Hosting

In order to be able to provide our online offer safely and efficiently, we use the services of one or more web hosting providers, from whose servers (or servers managed by them) the online offer can be accessed. For these purposes, we may use infrastructure and platform services, computing capacity, storage space and database services, as well as security services and technical maintenance services.

The data processed in the context of providing the hosting offer can include all information concerning the users of our online offer that arises in the context of use and communication. This regularly includes the IP address, which is necessary to deliver the contents of online offers to browsers, and all entries made within our online offer or from websites.

Processed Data Types: Content data (e.g., entries in online forms); usage data (e.g., websites visited, interest in content, access times); meta/communication data (e.g., device information, IP addresses).
Data Subjects: Users (e.g., website visitors, users of online services).
Purposes of Processing: Provision of our online offer and user-friendliness; information technology infrastructure (operation and provision of information systems and technical devices (computers, servers etc.)).
Legal Bases: Legitimate interests (Art. 6 para. 1 sentence 1 lit. f. GDPR).

Further Information on Processing Activities, Procedures and Services:

Collection of Access Data and Log Files: We ourselves (or our web hosting provider) collect data on every access to the server (so-called server log files). The server log files may include the address and name of the accessed websites and files, date and time of access, amount of data transferred, notification of successful access, browser type along with version, the user's operating system, referrer URL (the previously visited page) and usually IP addresses and the requesting provider. The server log files can be used for security purposes, e.g., to prevent overload of the servers (in particular in the event of abusive attacks, so-called DDoS attacks) and to ensure server capacity and stability; Legal Bases: Legitimate interests (Art. 6 para. 1 sentence 1 lit. f. GDPR); Deletion of Data: Log file information is stored for a maximum of 30 days and then deleted or anonymized. Data whose further retention is required for evidentiary purposes is excluded from deletion until the final clarification of the respective incident.

Registration, Login and User Account

Users can create a user account. In the context of registration, the required mandatory information is communicated to the users and processed for the purpose of providing the user account based on contractual fulfillment. The processed data includes in particular the login information (username, password and an email address).

In the context of using our registration and login functions as well as using the user account, we store the IP address and the time of the respective user action. The storage takes place on the basis of our legitimate interests as well as those of the users in protection against abuse and other unauthorized use. This data is generally not passed on to third parties unless it is necessary to pursue our claims or there is a statutory obligation to do so.

Users can be informed about processes relevant to their user account, such as technical changes, by email.

Processed Data Types: Inventory data (e.g., names, addresses); contact details (e.g., email, telephone numbers); content data (e.g., entries in online forms); meta/communication data (e.g., device information, IP addresses).
Data Subjects: Users (e.g., website visitors, users of online services).
Purposes of Processing: Provision of contractual services and customer service; security measures; management and responding to inquiries; provision of our online offer and user-friendliness.
Legal Bases: Performance of a contract and prior requests (Art. 6 para. 1 sentence 1 lit. b. GDPR); legitimate interests (Art. 6 para. 1 sentence 1 lit. f. GDPR).

Further Information on Processing Activities, Procedures and Services:

Registration with Real Names: Due to the nature of our community, we ask users to use our offer only using real names. This means that the use of pseudonyms is not permitted; Legal Bases: Performance of a contract and prior requests (Art. 6 para. 1 sentence 1 lit. b. GDPR).
Deletion of Data after Termination: If users have terminated their user account, their data with respect to the user account will be deleted, subject to legal permission, obligation or consent of the users; Legal Bases: Performance of a contract and prior requests (Art. 6 para. 1 sentence 1 lit. b. GDPR).
No Retention Obligation for Data: It is the responsibility of users to back up their data prior to the end of the contract if termination has occurred. We are entitled to irretrievably delete all data of the user stored during the contract period; Legal Bases: Performance of a contract and prior requests (Art. 6 para. 1 sentence 1 lit. b. GDPR).

Blogs and Publication Media

We use blogs or comparable means of online communication and publication (hereinafter "publication medium"). The readers' data is processed for the purposes of the publication medium only to the extent necessary for its presentation and communication between authors and readers or for security reasons. For the rest, we refer to the information on processing the visitors of our publication medium within the scope of this privacy notice.

Processed Data Types: Inventory data (e.g., names, addresses); contact details (e.g., email, telephone numbers); content data (e.g., entries in online forms); usage data (e.g., websites visited, interest in content, access times); meta/communication data (e.g., device information, IP addresses).
Data Subjects: Users (e.g., website visitors, users of online services).
Purposes of Processing: Provision of contractual services and customer service; feedback (e.g., collecting feedback via online form); provision of our online offer and user-friendliness.
Legal Bases: Legitimate interests (Art. 6 para. 1 sentence 1 lit. f. GDPR).

Contact and Inquiry Management

When contacting us (e.g., via contact form, email, telephone or social media) as well as within the scope of existing user and business relationships, the details of the inquiring persons are processed in so far as this is necessary to answer the contact requests and any requested measures.

Responding to contact requests and the management of contact and inquiry data in the context of contractual or pre-contractual relationships is carried out to fulfill our contractual obligations or to answer (pre)contractual inquiries and otherwise on the basis of legitimate interests in responding to the inquiries and maintaining user or business relationships.

Processed Data Types: Contact details (e.g., email, telephone numbers); content data (e.g., entries in online forms); usage data (e.g., websites visited, interest in content, access times); meta/communication data (e.g., device information, IP addresses).
Data Subjects: Communication partners.
Purposes of Processing: Provision of contractual services and customer service; contact requests and communication; management and responding to inquiries; feedback (e.g., collecting feedback via online form); provision of our online offer and user-friendliness.
Legal Bases: Performance of a contract and prior requests (Art. 6 para. 1 sentence 1 lit. b. GDPR); legitimate interests (Art. 6 para. 1 sentence 1 lit. f. GDPR).

Further Information on Processing Activities, Procedures and Services:

Contact Form: If users get in touch with us via our contact form, email or other communication channels, we process the data communicated to us in this context to handle the communicated concern. For this purpose, we process personal data in the context of pre-contractual and contractual business relationships, insofar as this is necessary for their performance and otherwise on the basis of our legitimate interests and the interests of the communication partners in answering the concerns and our statutory retention obligations; Legal Bases: Performance of a contract and prior requests (Art. 6 para. 1 sentence 1 lit. b. GDPR), legitimate interests (Art. 6 para. 1 sentence 1 lit. f. GDPR).

Newsletter and Electronic Notifications

We send newsletters, emails and other electronic notifications (hereinafter "newsletter") only with the consent of the recipients or a legal permission. Insofar as the contents of the newsletter are specifically described in the context of registering for it, they are decisive for the consent of the users. Otherwise, our newsletters contain information about our services and us.

To subscribe to our newsletters, it is generally sufficient to provide your email address. However, we may ask you to provide a name for the purpose of addressing you personally in the newsletter, or other details if these are required for the purposes of the newsletter.

Double Opt-In Procedure: Registration for our newsletter generally takes place in a so-called double opt-in procedure. This means that after registration you will receive an email in which you are asked to confirm your registration. This confirmation is necessary so that no one can register with external email addresses. Subscriptions to the newsletter are logged in order to be able to prove the registration process in accordance with legal requirements. This includes saving the registration and confirmation time as well as the IP address. Likewise, the changes to your data stored with the shipping service provider are logged.

Deletion and Restriction of Processing: We can store the unsubscribed email addresses for up to three years on the basis of our legitimate interests before deleting them to prove a formerly given consent. The processing of this data is restricted to the purpose of a possible defense against claims. An individual deletion request is possible at any time, provided that the former existence of consent is confirmed at the same time. In the event of obligations to permanently observe objections, we reserve the right to store the email address in a blocking list (so-called "blocklist") solely for this purpose.

The logging of the registration procedure is based on our legitimate interests for the purpose of proving its correct course. Insofar as we commission a service provider to send emails, this is based on our legitimate interests in an efficient and secure sending system.

Contents:

Information about us, our services, promotions and offers.

Processed Data Types: Inventory data (e.g., names, addresses); contact details (e.g., email, telephone numbers); meta/communication data (e.g., device information, IP addresses); usage data (e.g., websites visited, interest in content, access times).
Data Subjects: Communication partners; users (e.g., website visitors, users of online services).
Purposes of Processing: Direct marketing (e.g., by email or post); provision of contractual services and customer service.
Legal Bases: Consent (Art. 6 para. 1 sentence 1 lit. a. GDPR); legitimate interests (Art. 6 para. 1 sentence 1 lit. f. GDPR).
Possibility of Objection (Opt-Out): You can cancel the receipt of our newsletter at any time, i.e., revoke your consent or object to further receipt. You can find a link to cancel the newsletter either at the end of each newsletter or otherwise use one of the contact options specified above, preferably email, for this purpose.

Further Information on Processing Activities, Procedures and Services:

Measurement of Open and Click Rates: The newsletters contain a so-called "web beacon", i.e., a pixel-sized file that is retrieved from our server when the newsletter is opened, or from their server if we use a delivery service provider. In the context of this retrieval, technical information, such as information about the browser and your system, as well as your IP address and the time of retrieval, are initially collected. This information is used for the technical improvement of our newsletter based on technical data or the target groups and their reading behavior on the basis of their retrieval locations (which can be determined with the help of the IP address) or access times. This analysis also includes determining whether the newsletters are opened, when they are opened and which links are clicked. This information is assigned to individual newsletter recipients and stored in their profiles until deleted. The evaluations serve us to recognize the reading habits of our users and to adapt our content to them or to send different content according to the interests of our users. The measurement of open rates and click rates as well as storing the measurement results in the user profiles and their further processing are based on user consent. A separate revocation of success measurement is unfortunately not possible, in this case the entire newsletter subscription must be canceled or objected to. In this case, the stored profile information will be deleted.

Google Analytics: Measurement of the success of email campaigns and building of user profiles with a storage period of up to two years; Service Provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, parent company: Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA; Website: https://marketingplatform.google.com/intl/en/about/analytics/; Privacy Policy: https://policies.google.com/privacy; Possibility of Objection (Opt-Out): Opt-out plugin: https://tools.google.com/dlpage/gaoptout?hl=en, settings for display of advertisements: https://adssettings.google.com/authenticated; Further Information: Types of processing and processed data: https://privacy.google.com/businesses/adsservices; Data processing terms for Google advertising products and standard contractual clauses for third-country transfers of data: https://business.safety.google/adsprocessorterms.
Requirement for Use of Free Services: Consent to the sending of mailings can be made a condition for using free services (e.g. access to certain content or participation in certain promotions). If users wish to use the free service without subscribing to the newsletter, please contact us.
Reminder Emails for Order Process: If users do not complete an order process, we can remind users of the order process by email and send them a link to continue it. This function can be useful, for example, if the purchase process could not be continued due to a browser crash, mistake or forgetting. Sending is based on consent, which users can revoke at any time.
SendinBlue: Email marketing platform; Service Provider: SendinBlue SAS, 55, rue d’Amsterdam, 75008 Paris, France; Website: https://www.sendinblue.com/; Privacy Policy: https://www.sendinblue.com/legal/privacypolicy/; Standard Contractual Clauses (Guarantee of data protection level when processed in third countries): Concluded with provider.

Social Network Presences (Social Media)

We maintain online presences within social networks and process user data in this context to communicate with active users there or to offer information about us.

We point out that user data may be processed outside the territory of the European Union. This can result in risks for users, because, for example, the enforcement of user rights could be made more difficult.

Furthermore, user data within social networks is usually processed for market research and advertising purposes. For example, usage profiles can be created based on usage behavior and resulting interests of users. The usage profiles can in turn be used to place advertisements within and outside the networks that presumably correspond to the interests of the users. For these purposes, cookies are usually stored on the users' computers, in which the usage behavior and interests of the users are stored. Furthermore, data can also be stored in the usage profiles independently of the devices used by the users (in particular if the users are members of the respective platforms and are logged into them).

For a detailed description of the respective processing forms and the objection possibilities (opt-out), we refer to the privacy policies and details of the operators of the respective networks.

Also in the case of information requests and the assertion of data subject rights, we point out that these can be asserted most effectively with the providers. Only the providers have access to the user data in each case and can directly take appropriate measures and provide information. Should you nevertheless need help, you can contact us.

Processed Data Types: Contact details (e.g., email, telephone numbers); content data (e.g., entries in online forms); usage data (e.g., websites visited, interest in content, access times); meta/communication data (e.g., device information, IP addresses).
Data Subjects: Users (e.g., website visitors, users of online services).
Purposes of Processing: Contact requests and communication; feedback (e.g., collecting feedback via online form); marketing.
Legal Bases: Legitimate interests (Art. 6 para. 1 sentence 1 lit. f. GDPR).

Further Information on Processing Activities, Procedures and Services:

Instagram: Social network; Service Provider: Instagram Inc., 1601 Willow Road, Menlo Park, CA, 94025, USA; Legal Bases: Legitimate interests (Art. 6 para. 1 sentence 1 lit. f. GDPR); Website: https://www.instagram.com; Privacy Policy: https://instagram.com/about/legal/privacy.
Facebook Pages: Profiles within the social network Facebook – We are jointly responsible with Meta Platforms Ireland Limited for the collection (but not the further processing) of data of visitors to our Facebook page (so-called "Fanpage"). This data includes information about the types of content users view or interact with, or the actions they take (see under "Things you and others do and provide" in the Facebook Data Policy: https://www.facebook.com/policy), as well as information about the devices used by users (e.g., IP addresses, operating system, browser type, language settings, cookie data; see under "Device Information" in the Facebook Data Policy: https://www.facebook.com/policy). As explained in the Facebook Data Policy under "How do we use this information?", Facebook also collects and uses information to provide analysis services, so-called "Page Insights", to page operators so that they can gain insights into how people interact with their pages and the content associated with them. We have concluded a special agreement with Facebook ("Page Insights Controller Addendum", https://www.facebook.com/legal/terms/page_controller_addendum), which regulates in particular which security measures Facebook must observe and in which Facebook has agreed to fulfill data subject rights (i.e. users can, for example, send information or deletion requests directly to Facebook). The rights of users (in particular to information, deletion, objection and complaint to competent supervisory authority) are not restricted by the agreements with Facebook. Further information can be found in the "Information about Page Insights" (https://www.facebook.com/legal/terms/information_about_page_insights_data); Service Provider: Meta Platforms Ireland Limited, 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland; Legal Bases: Legitimate interests (Art. 6 para. 1 sentence 1 lit. f. GDPR); Website: https://www.facebook.com; Privacy Policy:https://www.facebook.com/about/privacy; Standard Contractual Clauses (Guarantee of data protection level when processed in third countries): https://www.facebook.com/legal/EU_data_transfer_addendum; Further Information: Joint responsibility agreement: https://www.facebook.com/legal/terms/information_about_page_insights_data.

Plugins and Embedded Functions as well as Content

We integrate functional and content elements into our online offer that are obtained from the servers of their respective providers (hereinafter referred to as "third-party providers"). These may be, for example, graphics, videos or city maps (hereinafter consistently referred to as "content").

The integration always presupposes that the third-party providers of this content process the IP address of the users, since without the IP address they could not send the content to their browser. The IP address is therefore required to display this content or functions. We strive to use only such content whose respective providers use the IP address only for delivering the content. Third-party providers may also use so-called pixel tags (invisible graphics, also referred to as "web beacons") for statistical or marketing purposes. The "pixel tags" can be used to evaluate information such as visitor traffic on the pages of this website. The pseudonymous information can also be stored in cookies on the user's device and, among other things, contain technical information about the browser and operating system, referring websites, visit time and other details about the use of our online offer, and can also be linked to such information from other sources.

Processed Data Types: Usage data (e.g., websites visited, interest in content, access times); meta/communication data (e.g., device information, IP addresses).
Data Subjects: Users (e.g., website visitors, users of online services).
Purposes of Processing: Provision of our online offer and user-friendliness; marketing; profiles with user-related information (creation of user profiles).
Legal Bases: Legitimate interests (Art. 6 para. 1 sentence 1 lit. f. GDPR).

Further Information on Processing Activities, Procedures and Services:

Instagram Plugins and Content: Instagram Plugins and Content – This may include, for example, content such as images, videos or texts and buttons with which users can share content of this online offer within Instagram. – We are jointly responsible with Meta Platforms Ireland Limited for the collection or receipt in the context of a transmission (but not the further processing) of "event data" that Facebook collects by means of functions of Instagram (e.g., embedding functions for content) that are executed on our online offer, or receives in the context of a transmission for the following purposes: a) display of content and advertising information that corresponds to the suspected interests of the users; b) delivery of commercial and transaction-related messages (e.g., addressing users via Facebook Messenger); c) improvement of ad delivery and personalization of functions and content (e.g., improving the detection of which content or advertising information presumably corresponds to the interests of the users). We have concluded a special agreement with Facebook ("Controller Addendum", https://www.facebook.com/legal/controller_addendum), which regulates in particular which security measures Facebook must observe (https://www.facebook.com/legal/terms/data_security_terms) and in which Facebook has agreed to fulfill data subject rights (i.e. users can, for example, send information or deletion requests directly to Facebook). Note: When Facebook provides us with measurements, analyses and reports (which are aggregated, i.e. do not contain information about individual users and are anonymous to us), then this processing is not carried out in the context of joint responsibility, but on the basis of a data processing agreement ("Data Processing Terms", https://www.facebook.com/legal/terms/dataprocessing), the "Data Security Terms" (https://www.facebook.com/legal/terms/data_security_terms) and with regard to processing in the USA on the basis of standard contractual clauses ("Facebook EU Data Transfer Addendum", https://www.facebook.com/legal/EU_data_transfer_addendum). The rights of users (in particular to information, deletion, objection and complaint to competent supervisory authority) are not restricted by the agreements with Facebook; Service Provider: Instagram Inc., 1601 Willow Road, Menlo Park, CA, 94025, USA; Legal Bases: Legitimate interests (Art. 6 para. 1 sentence 1 lit. f. GDPR); Website: https://www.instagram.com; Privacy Policy: https://instagram.com/about/legal/privacy.

Management, Organization and Auxiliary Tools

We use services, platforms and software of other providers (hereinafter referred to as "third-party providers") for the purposes of organization, administration, planning and provision of our services. In selecting third-party providers and their services, we comply with legal requirements.

In this context, personal data can be processed and stored on the servers of the third-party providers. Various data may be affected by this, which we process in accordance with this privacy policy. This data may include, in particular, master data and contact data of users, data on processes, contracts, other processes and their contents.

If users are referred to third-party providers or their software or platforms in the context of communication, business or other relationships with us, the third-party providers may process usage data and metadata for security purposes, service optimization or marketing purposes. We therefore ask you to observe the privacy policies of the respective third-party providers.

Processed Data Types: Content data (e.g., entries in online forms); usage data (e.g., websites visited, interest in content, access times); meta/communication data (e.g., device information, IP addresses).
Data Subjects: Communication partners; users (e.g., website visitors, users of online services).
Purposes of Processing: Contact requests and communication; provision of contractual services and customer service; office and organizational procedures.
Legal Bases: Legitimate interests (Art. 6 para. 1 sentence 1 lit. f. GDPR).

Further Information on Processing Activities, Procedures and Services:

Memberspot: External member area; Service Provider: Memberspot GmbH, Rilkestr. 26, 71642 Ludwigsburg; Legal Bases: Legitimate interests (Art. 6 para. 1 sentence 1 lit. f. GDPR); Website: https://www.memberspot.de; Privacy Policy: https://www.memberspot.de/datenschutz.

Changes and Updates to the Privacy Policy

We ask you to regularly inform yourself about the content of our privacy policy. We adapt the privacy policy as soon as changes in the data processing carried out by us make this necessary. We will inform you as soon as the changes require a cooperative action on your part (e.g. consent) or other individual notification becomes necessary.

If we provide addresses and contact information of companies and organizations in this privacy policy, please note that the addresses may change over time and ask you to check the details before contacting us.

Rights of Data Subjects

As a data subject under the GDPR, you have various rights, which arise in particular from Art. 15 to 21 GDPR:

Right to Object: You have the right to object, on grounds relating to your particular situation, at any time to processing of personal data concerning you which is based on Art. 6 para. 1 lit. e or f GDPR; this also applies to profiling based on those provisions. Where personal data concerning you are processed for direct marketing purposes, you have the right to object at any time to processing of personal data concerning you for such marketing; this also applies to profiling to the extent that it is related to such direct marketing.
Right to Withdraw Consent: You have the right to withdraw given consent at any time.
Right of Access: You have the right to obtain confirmation as to whether or not data concerning you are being processed, and, where that is the case, access to the personal data and further information and a copy of the data in accordance with legal requirements.
Right to Rectification: You have the right, in accordance with legal requirements, to demand the completion of data concerning you or the rectification of inaccurate data concerning you.
Right to Erasure and Restriction of Processing: You have the right, in accordance with legal requirements, to demand that data concerning you be deleted immediately, or alternatively, in accordance with legal requirements, to demand restriction of processing of the data.
Right to Data Portability: You have the right to receive data concerning you, which you have provided to us, in a structured, commonly used and machine-readable format or to demand its transmission to another controller in accordance with legal requirements.
Complaint to Supervisory Authority: Without prejudice to any other administrative or judicial remedy, you have the right to lodge a complaint with a supervisory authority, in particular in the Member State of your habitual residence, place of work or place of the alleged infringement, if you consider that the processing of personal data concerning you infringes the requirements of the GDPR.

Definitions of Terms

In this section you will find an overview of the terms used in this privacy policy. Many of the terms are taken from the law and defined in particular in Art. 4 GDPR. The legal definitions are binding. The following explanations, on the other hand, are primarily intended to aid understanding. The terms are sorted alphabetically.

Personal Data: "Personal data" means any information relating to an identified or identifiable natural person (hereinafter "data subject"); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier (e.g. cookie) or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person.
Profiles with User-Related Information: The processing of "profiles with user-related information", or "profiles" for short, includes any form of automated processing of personal data consisting of using personal data to analyze, evaluate or predict certain personal aspects relating to a natural person (depending on the type of profiling, this may include different information concerning demographics, behavior and interests, such as interaction with websites and their content, etc.) (e.g. interests in certain content or products, clicking behavior on a website or location). Cookies and web beacons are frequently used for profiling purposes.
Controller: The "controller" is the natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of the processing of personal data.
Processing: "Processing" means any operation or set of operations which is performed on personal data, whether or not by automated means. The term is broad and covers virtually any handling of data, whether collecting, evaluating, storing, transmitting or deleting.