DE | EN | FR
Menu

Privacy Policy

This is a courtesy translation. Only the German version is legally binding.

This privacy policy explains the nature, scope and purpose of the processing of personal data (hereinafter “data”) within my online offering and the websites, functions and content connected with it, as well as external online presences such as my social media profiles (hereinafter jointly referred to as “online offering”). With regard to the terms used, such as “processing” or “controller”, I refer to the definitions in Art. 4 of the General Data Protection Regulation (GDPR).

Controller

Björn Radde
Auf der Mammolshöhe 54
61462 Königstein, Germany
Email: info@radde.de
Owner: Björn Radde
Data protection contact: datenschutz@radde.de

Types of data processed

  • Inventory data (e.g. names, addresses).
  • Contact data (e.g. email, telephone numbers).
  • Content data (e.g. text entries, photographs, videos).
  • Usage data (e.g. websites visited, interest in content, access times).
  • Meta/communication data (e.g. device information, IP addresses).

Categories of data subjects

Visitors and users of the online offering (hereinafter, the data subjects are also collectively referred to as “users”).

Purpose of processing

  • Provision of the online offering, its functions and content.
  • Answering contact requests and communicating with users.
  • Security measures.
  • Reach measurement/marketing.

Terms used

  • “Personal data” means any information relating to an identified or identifiable natural person (hereinafter “data subject”); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier (e.g. a cookie) or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person.
  • “Processing” means any operation or set of operations which is performed on personal data, whether or not by automated means. The term is broad and covers practically any handling of data.
  • “Pseudonymisation” means the processing of personal data in such a manner that the personal data can no longer be attributed to a specific data subject without the use of additional information, provided that such additional information is kept separately and is subject to technical and organisational measures to ensure that the personal data are not attributed to an identified or identifiable natural person.
  • “Profiling” means any form of automated processing of personal data consisting of the use of personal data to evaluate certain personal aspects relating to a natural person, in particular to analyse or predict aspects concerning that natural person's performance at work, economic situation, health, personal preferences, interests, reliability, behaviour, location or movements.
  • “Controller” means the natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of the processing of personal data.
  • “Processor” means a natural or legal person, public authority, agency or other body which processes personal data on behalf of the controller.

Relevant legal bases

In accordance with Art. 13 GDPR, I inform you of the legal bases of my data processing. Unless the legal basis is stated in the privacy policy, the following applies: the legal basis for obtaining consent is Art. 6 (1) (a) and Art. 7 GDPR; the legal basis for processing to provide my services and carry out contractual measures as well as to answer enquiries is Art. 6 (1) (b) GDPR; the legal basis for processing to fulfil my legal obligations is Art. 6 (1) (c) GDPR; and the legal basis for processing to protect my legitimate interests is Art. 6 (1) (f) GDPR. In the event that vital interests of the data subject or another natural person require the processing of personal data, Art. 6 (1) (d) GDPR serves as the legal basis.

Security measures

In accordance with Art. 32 GDPR, taking into account the state of the art, the costs of implementation and the nature, scope, context and purposes of processing as well as the varying likelihood and severity of the risk to the rights and freedoms of natural persons, I take appropriate technical and organisational measures to ensure a level of protection appropriate to the risk.

These measures include, in particular, safeguarding the confidentiality, integrity and availability of data by controlling physical access to the data as well as access to, input, transfer, securing of availability and separation of the data. In addition, I have established procedures that ensure the exercise of data subjects' rights, the deletion of data and responses to threats to the data. Furthermore, the protection of personal data is already taken into account in the development or selection of hardware, software and procedures, in accordance with the principle of data protection by design and by default (Art. 25 GDPR).

Cooperation with processors and third parties

If, in the course of my processing, I disclose data to other persons and companies (processors or third parties), transfer it to them or otherwise grant them access to the data, this is done only on the basis of legal permission (e.g. if a transfer of data to third parties, such as payment service providers, is necessary for the performance of a contract pursuant to Art. 6 (1) (b) GDPR), if you have consented, if a legal obligation provides for it or on the basis of my legitimate interests (e.g. when using agents, web hosts, etc.).

If third parties are commissioned to process data on the basis of a so-called “data processing agreement”, this is done on the basis of Art. 28 GDPR.

Transfers to third countries

If I process data in a third country (i.e. outside the European Union (EU) or the European Economic Area (EEA)), or if this happens in the context of using third-party services or disclosing or transferring data to third parties, this is done only if it is necessary to fulfil my (pre-)contractual obligations, on the basis of your consent, on the basis of a legal obligation or on the basis of my legitimate interests. Subject to legal or contractual permissions, I process data in a third country, or have it processed there, only if the special requirements of Art. 44 et seq. GDPR are met. This means that processing takes place, for example, on the basis of special guarantees, such as the officially recognised determination of a level of data protection equivalent to that of the EU (a so-called adequacy decision of the EU Commission, e.g. for the USA the “EU-U.S. Data Privacy Framework”) or compliance with officially recognised special contractual obligations (so-called “standard contractual clauses”).

Rights of data subjects

You have the right to obtain confirmation as to whether data concerning you is being processed and to obtain access to this data as well as further information and a copy of the data in accordance with Art. 15 GDPR.

In accordance with Art. 16 GDPR, you have the right to request the completion of data concerning you or the correction of inaccurate data concerning you.

In accordance with Art. 17 GDPR, you have the right to request that data concerning you be deleted without delay or, alternatively, in accordance with Art. 18 GDPR, to request a restriction of the processing of the data.

You have the right to receive the data concerning you that you have provided to me in accordance with Art. 20 GDPR and to request its transfer to other controllers.

In accordance with Art. 77 GDPR, you also have the right to lodge a complaint with the competent supervisory authority.

Right of withdrawal

You have the right to withdraw consent given, in accordance with Art. 7 (3) GDPR, with effect for the future.

Right to object

You can object to the future processing of data concerning you at any time in accordance with Art. 21 GDPR. In particular, you can object to processing for the purposes of direct marketing.

Cookies, consent and analytics

This website uses the analytics service Google Analytics 4 (see below). It is only loaded if you consent to the “Statistics” category in the cookie banner. Without your consent, no cookies are set and no data is transmitted to Google. Your choice in the cookie banner is stored only locally in your browser (localStorage); this is technically necessary so that your decision can be respected (Section 25 (2) No. 2 TDDDG). You can change or withdraw your choice at any time via the “Cookie settings” link in the footer. Apart from this, no third-party content such as videos, maps, fonts or social media plugins is embedded. The references to my social network profiles are simple links: data is only transmitted to the respective provider when you click on such a link and visit the provider's website, where the provider's privacy policy applies.

Google Analytics 4

If you have given your consent, I use Google Analytics 4, a web analytics service provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (“Google”). Google Analytics helps me understand how visitors use this website, for example which pages are viewed, how long visitors stay and how they found the website. For this purpose, Google Analytics sets cookies (e.g. “_ga” and “_ga_W49ZLMMRPR”, stored for up to 2 years) and processes usage data such as pages viewed, time spent, referral source, approximate location (country/city), device and browser information. Google Analytics 4 does not store IP addresses.

The legal basis is your consent pursuant to Art. 6 (1) (a) GDPR and Section 25 (1) TDDDG. You can withdraw your consent at any time with effect for the future via “Cookie settings” in the footer; the Google Analytics cookies are then removed. A data processing agreement has been concluded with Google. It cannot be ruled out that data is transferred to servers of Google LLC in the USA. Google LLC is certified under the EU-US Data Privacy Framework, on the basis of which the European Commission has determined an adequate level of data protection (Art. 45 GDPR); the European Commission's standard contractual clauses apply in addition. The collected data is deleted automatically after the retention period set in Google Analytics (maximum 14 months).

Further information: Google Privacy Policy and Google Analytics and privacy.

Deletion of data

The data processed by me is deleted or its processing restricted in accordance with Art. 17 and 18 GDPR. Unless expressly stated in this privacy policy, the data stored by me is deleted as soon as it is no longer required for its intended purpose and there are no statutory retention obligations preventing deletion. If the data is not deleted because it is required for other and legally permissible purposes, its processing is restricted. This means that the data is blocked and not processed for other purposes. This applies, for example, to data that must be retained for commercial or tax reasons.

In accordance with legal requirements in Germany, data is retained in particular for 10 years pursuant to Sections 147 (1) AO and 257 (1) Nos. 1 and 4, (4) HGB (books, records, management reports, accounting vouchers, commercial books, documents relevant for taxation, etc.) and for 6 years pursuant to Section 257 (1) Nos. 2 and 3, (4) HGB (commercial letters).

In accordance with legal requirements in Austria, data is retained in particular for 7 years pursuant to Section 132 (1) BAO (accounting documents, receipts/invoices, accounts, vouchers, business papers, statements of income and expenditure, etc.), for 22 years in connection with real estate and for 10 years for documents relating to electronically supplied services, telecommunications, radio and television services provided to non-entrepreneurs in EU member states and for which the Mini-One-Stop-Shop (MOSS) is used.

Contractual services

I process the data of my contractual partners and interested parties as well as other clients, customers or contractual partners (uniformly referred to as “contractual partners”) in accordance with Art. 6 (1) (b) GDPR in order to provide my contractual or pre-contractual services to them. The data processed, the nature, scope, purpose and necessity of its processing are determined by the underlying contractual relationship.

The data processed includes the master data of my contractual partners (e.g. names and addresses), contact data (e.g. email addresses and telephone numbers) as well as contract data (e.g. services used, contract content, contractual communication, names of contact persons) and payment data (e.g. bank details, payment history).

As a matter of principle, I do not process special categories of personal data unless they are part of commissioned or contractual processing.

I process data that is necessary to establish and fulfil the contractual services and point out the necessity of providing it if this is not evident to the contractual partners. Disclosure to external persons or companies only takes place if it is necessary within the scope of a contract. When processing data provided to me in the context of an order, I act in accordance with the instructions of the clients and the legal requirements.

When my online services are used, I may store the IP address and the time of the respective user action. This storage is based on my legitimate interests as well as the users' interest in protection against misuse and other unauthorised use. As a matter of principle, this data is not passed on to third parties unless it is necessary to pursue my claims pursuant to Art. 6 (1) (f) GDPR or there is a legal obligation to do so pursuant to Art. 6 (1) (c) GDPR.

The data is deleted when it is no longer required to fulfil contractual or statutory duties of care or to deal with any warranty and comparable obligations; the necessity of retaining the data is reviewed every three years. Otherwise, the statutory retention obligations apply.

Contacting me

When you contact me (e.g. via the contact form, email, telephone or social media), the user's details are processed to handle the contact request in accordance with Art. 6 (1) (b) GDPR. The users' details may be stored in a customer relationship management system (“CRM system”) or a comparable request management system.

I delete requests when they are no longer required. I review the necessity every two years; statutory archiving obligations also apply.

Hosting and email delivery

The hosting services I use serve to provide the following services: infrastructure and platform services, computing capacity, storage space and database services, email delivery, security services and technical maintenance services, which I use for the purpose of operating this online offering.

In doing so, I or my hosting provider process inventory data, contact data, content data, contract data, usage data, meta and communication data of customers, interested parties and visitors to this online offering on the basis of my legitimate interests in the efficient and secure provision of this online offering pursuant to Art. 6 (1) (f) GDPR in conjunction with Art. 28 GDPR (conclusion of a data processing agreement).

Collection of access data and log files

On the basis of my legitimate interests within the meaning of Art. 6 (1) (f) GDPR, I or my hosting provider collect data about every access to the server on which this service is located (so-called server log files). The access data includes the name of the website accessed, file, date and time of access, amount of data transferred, notification of successful access, browser type and version, the user's operating system, referrer URL (the previously visited page), IP address and the requesting provider.

For security reasons (e.g. to investigate misuse or fraud), log file information is stored for a maximum of 7 days and then deleted. Data whose further retention is necessary for evidentiary purposes is excluded from deletion until the respective incident has been finally clarified.

Online presences on social media

I maintain online presences within social networks and platforms in order to communicate with the customers, interested parties and users active there and to inform them about my services. When accessing the respective networks and platforms, the terms and conditions and data processing guidelines of their respective operators apply.

Unless otherwise stated in this privacy policy, I process the data of users if they communicate with me within the social networks and platforms, e.g. write posts on my online presences or send me messages.