Legal notice #

Responsible for the content of this website:

Matthias Geörg
Talstraße 40
67487 Sankt Martin
Germany

Telephone: +49 160 96049716

Privacy policy #

This privacy policy explains the nature, scope and purpose of the processing of personal data (referred to below as “data”) in connection with the services we provide, this website and its associated pages, features and content, as well as our external online presence, such as our social media profiles (collectively, the “online offering”). For definitions of terms such as “processing” and “controller”, see Article 4 of the General Data Protection Regulation (GDPR).

Controller #

Matthias Geörg
Talstraße 40
67487 Sankt Martin
Germany

Email: mail@macbarfuss.de

Types of data processed #

Account and identity data (for example, names and addresses)
Contact details (for example, email addresses and telephone numbers)
Content data (for example, text, photographs and videos)
Usage data (for example, pages visited, interest in content and access times)
Metadata and communications data (for example, device information and IP addresses)

Categories of data subjects #

Visitors and users of the online offering (collectively referred to as “users” below).

Purposes of processing #

Providing this online offering, its features and content
Responding to enquiries and communicating with users
Security measures
Reach measurement and marketing

Definitions #

“Personal data” means any information relating to an identified or identifiable natural person (the “data subject”). A person is identifiable if they can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier (for example, a cookie) or one or more factors specific to their physical, physiological, genetic, mental, economic, cultural or social identity.

“Processing” means any operation or set of operations performed on personal data, whether or not by automated means. The term is broad and covers practically any use of data.

“Pseudonymisation” means processing personal data so that it can no longer be attributed to a specific data subject without additional information, provided that the additional information is kept separately and protected by technical and organisational measures.

“Profiling” means any form of automated processing of personal data used to evaluate personal aspects relating to a natural person, in particular to analyse or predict aspects concerning their work performance, financial situation, health, personal preferences, interests, reliability, behaviour, location or movements.

The “controller” is the natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of processing personal data.

A “processor” is a natural or legal person, public authority, agency or other body which processes personal data on behalf of the controller.

Applicable legal bases #

In accordance with Article 13 GDPR, the legal bases for our data processing are set out below. For users within the scope of the GDPR (the EU and European Economic Area), where a specific legal basis is not stated in this policy, the following applies:

Consent is based on Article 6(1)(a) and Article 7 GDPR.
Processing to provide our services, perform contractual measures and respond to enquiries is based on Article 6(1)(b) GDPR.
Processing necessary to comply with legal obligations is based on Article 6(1)(c) GDPR.
Where processing is necessary to protect the vital interests of the data subject or another natural person, it is based on Article 6(1)(d) GDPR.
Processing necessary to perform a task in the public interest or in the exercise of official authority is based on Article 6(1)(e) GDPR.
Processing necessary to protect our legitimate interests is based on Article 6(1)(f) GDPR.

Processing for purposes other than those for which data was collected is governed by Article 6(4) GDPR. Processing special categories of personal data (Article 9(1) GDPR) is governed by Article 9(2) GDPR.

Security measures #

Taking into account legal requirements, the state of the art, implementation costs, the nature, scope, context and purposes of processing, and the likelihood and severity of risks to the rights and freedoms of natural persons, we take appropriate technical and organisational measures to ensure a level of security appropriate to the risk.

These measures include protecting the confidentiality, integrity and availability of data by controlling physical access and access to data, as well as its entry, disclosure, availability and separation. We also have procedures for exercising data subject rights, deleting data and responding to threats to data. We take data protection into account when developing or selecting hardware, software and processes, in accordance with the principles of data protection by design and by default.

Working with processors, joint controllers and third parties #

We disclose data to, transfer it to or otherwise grant access to other people and organisations (processors, joint controllers or third parties) only where this is legally permitted—for example, where disclosure to a payment provider is necessary to fulfil a contract—where users have consented, where we are legally obliged to do so, or where it is justified by our legitimate interests (for example, when using agents or web hosts).

Where we disclose or transfer data to other companies in our corporate group, or grant them access to it, this is done in particular for administrative purposes as a legitimate interest and on an appropriate legal basis.

Transfers to third countries #

We process data in a third country (outside the European Union, European Economic Area or Swiss Confederation), or disclose or transfer it to people or organisations there, only where this is necessary to fulfil (pre-)contractual obligations, based on your consent or a legal obligation, or justified by our legitimate interests. Unless you have expressly consented or the transfer is contractually necessary, we process data in third countries only where an adequate level of data protection is recognised or appropriate safeguards are in place, such as EU standard contractual clauses, certifications or binding corporate rules (Articles 44–49 GDPR; see the European Commission’s information on international transfers).

Rights of data subjects #

Subject to the applicable legal requirements, you have the right to request confirmation as to whether data concerning you is being processed, access to that data, further information and a copy of the data.

You have the right to request completion of incomplete data concerning you and correction of inaccurate data.

You have the right to request the immediate deletion of data concerning you or, where the legal requirements apply, restriction of its processing.

You have the right to receive the data you have provided to us in accordance with the legal requirements and to request its transfer to another controller.

You also have the right to lodge a complaint with the competent supervisory authority in accordance with the legal requirements.

You may withdraw any consent you have given, with effect for the future.

Right to object #

You may object at any time to the future processing of data concerning you, in accordance with the legal requirements. In particular, you may object to processing for direct marketing purposes.

Cookies and objection to direct marketing #

Cookies are small files stored on users’ devices. They can store various pieces of information, primarily about a user (or the device on which the cookie is stored) during or after a visit to an online offering. Temporary cookies, also known as session or transient cookies, are deleted when a user leaves an online offering and closes their browser. A cookie might, for example, store the contents of a shopping basket or a login status. Persistent cookies remain stored after the browser is closed. They can, for example, retain a login status across visits or store users’ interests for reach measurement or marketing. Third-party cookies are offered by providers other than the controller of the online offering; cookies offered only by that controller are called first-party cookies.

We do not currently use cookies and have no plans to do so.

Deletion of data #

We delete or restrict the processing of data in accordance with legal requirements. Unless this policy expressly states otherwise, data we store is deleted as soon as it is no longer needed for its purpose and no statutory retention obligations prevent deletion.

Where data is not deleted because it is needed for other legally permissible purposes, its processing is restricted: the data is blocked and is not processed for other purposes. This applies, for example, to data that must be retained for commercial or tax reasons.

Changes and updates to this privacy policy #

Please check this privacy policy regularly. We update it whenever changes to our data processing make this necessary. We will notify you if an update requires your cooperation (for example, renewed consent) or another individual notification.

Hosting and email delivery #

The hosting services we use provide infrastructure and platform services, computing capacity, storage and database services, email delivery, security services and technical maintenance for the operation of this online offering.

We and our hosting provider process account, contact, content, contract, usage, metadata and communications data relating to customers, prospective customers and visitors to this online offering. This is based on our legitimate interest in providing the online offering efficiently and securely (Article 6(1)(f) GDPR in conjunction with Article 28 GDPR, data processing agreement).

Access data and server log files #

We and our hosting provider collect data about each access to the server hosting this service, based on our legitimate interests under Article 6(1)(f) GDPR. Server log data includes the name of the page or file accessed, the date and time of access, the amount of data transferred, whether access was successful, browser type and version, operating system, referrer URL (the previously visited page), IP address and requesting provider.

For security reasons, for example to investigate misuse or fraud, log file information is stored for a maximum of seven days and then deleted. Data that must be retained as evidence is exempt from deletion until the relevant incident has been fully resolved.

Original German text generated with Datenschutz-Generator.de by lawyer Dr Thomas Schwenke.