Privacy policy

1. Privacy at a glance General information The following information provides a simple overview of what happens to your personal data when you visit this website. 2. Hosting and website delivery We host this website with Vercel Inc., 440 N Barranca Avenue #4133, Covina, CA 91723, USA. When you open a page, Vercel necessarily processes your IP address and an approximate location derived from it, the date and time of access, the requested address including any URL parameters, your browser identifier (user agent) and technical connection data. The purpose is to deliver the website, protect it against attacks and misuse, and detect errors. The legal basis is Art. 6(1)(f) GDPR; our legitimate interest is operating the website securely and reliably. Vercel delivers the website through a worldwide network, usually from a location near you. Pages that are generated on the server only when requested are produced by Vercel in a data centre in Frankfurt am Main, where Vercel also processes enquiry form submissions when the form is offered. Vercel runs its service on infrastructure from Amazon Web Services, Microsoft Azure and Google Cloud. Vercel also processes some of the data listed above as an independent controller, for example to detect security threats, fraud and unauthorised access; Vercel's privacy notice applies to that processing. Vercel Inc. is certified under the EU-US Data Privacy Framework, so transfers to Vercel in the USA are covered by the European Commission's adequacy decision (Art. 45 GDPR). Logs containing this data can be viewed in our Vercel account for no more than 30 days; we do not forward them to any other service. Vercel does not publish a fixed period after which it deletes this data. According to its privacy notice, Vercel keeps data only for as long as necessary for purposes including its legal and contractual obligations, enforcing its rights and legitimate business purposes, and then deletes or anonymises it. So that an address without a language, such as wiederjut.com, opens in the language you last used, we store the language version (de or en) in the "NEXT_LOCALE" cookie. We set it when you switch language and, depending on your browser's language setting, also when you open a page. It is a session cookie that your browser normally deletes when you close it. If you choose the light or dark theme using the switch, we store that choice in your browser's local storage (entry "theme") so that it also applies on your next visit; it is not sent to us. Both are strictly necessary to keep the language you are using and the theme you have chosen (section 25(2) no. 2 TDDDG). If you choose "Find nearest" to look for the nearest workshop, your browser will usually ask whether the website may access your location. If you agree, the website works out in your browser which workshop is nearest to you; it does not store your location coordinates or send them to us or to Umami. This access happens only at your request and is strictly necessary for it (section 25(2) no. 2 TDDDG). Umami records the click on the button and, if you open the workshop shown, that choice (section 4), which shows which of our workshops is nearest to your location. 3. General information and mandatory disclosures The operators of this site take the protection of your personal data very seriously. Controller: Mami Dang Große Straße 63 15344 Strausberg Phone: +49 152 33958491 Email: info@wiederjut.com Contact by phone or WhatsApp If you call us or write to us on WhatsApp, we process your phone number, your name where given and the content of your enquiry in order to answer it. The legal basis is Art. 6(1)(b) GDPR where your enquiry relates to entering into or performing a contract, and otherwise Art. 6(1)(f) GDPR (legitimate interest in responding to enquiries). In the EU, WhatsApp is provided by WhatsApp Ireland Limited; its privacy policy applies to your use of WhatsApp. According to WhatsApp, this also involves transferring data to WhatsApp LLC and Meta Platforms, Inc. in the USA, for which WhatsApp relies on their certification under the EU-US Data Privacy Framework. We keep your enquiry for as long as it takes to deal with it and any resulting order, and delete it afterwards, unless statutory retention periods apply. Links to WhatsApp or Google Maps on this website are plain links: the provider receives data from you only when you open one. Your rights Subject to the legal requirements, you have the right to access the personal data we process about you and to have it rectified or erased, to restrict its processing, and to data portability (Art. 15 to 18 and 20 GDPR). You can withdraw any consent at any time with effect for the future (Art. 7(3) GDPR). To do so, contact the controller named above. Right to object (Art. 21 GDPR) Where processing is based on Art. 6(1)(f) GDPR, you may object to it at any time on grounds relating to your particular situation. Here too, a message to the controller named above is enough. You also have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR), in particular in the member state where you live or work or where the alleged infringement took place. The authority responsible for us is the Landesbeauftragte für den Datenschutz und für das Recht auf Akteneinsicht Brandenburg (the Brandenburg data protection commissioner), Stahnsdorfer Damm 77, 14532 Kleinmachnow, Germany. 4. Web analytics (Umami) This website uses Umami Cloud, a web analytics service provided by Umami Software, Inc., 28 Geary St, Suite 650 #243, San Francisco, California, USA. We use it to understand how our website is used and which content leads people to contact us, so that we can improve it. Umami does not set any cookies for this. When you open a page, your browser connects to Umami, loads the analytics script from cloud.umami.is and sends measurement data to gateway.umami.is. Umami necessarily receives your IP address in the process. It records page views with the page address including any URL parameters, the page title and the referring page, as well as screen size, browser language, browser, operating system, device type, time and an approximate location derived from the IP address (country, region, city). It also records events such as clicks on phone, WhatsApp and directions links, choosing a workshop, opening the price list or successfully submitting an enquiry, each with details such as the language version, the position on the page and identifiers for the workshop, service, service variant, audience or guide concerned. The website's version identifier is also sent. We do not send names, contact details or messages from the enquiry form to Umami. Umami creates pseudonymous identifiers from your IP address and your browser identifier (user agent), combined with a secret value and a value that changes regularly. It uses them to group page views into a visit and, until that value changes, to recognise repeat visits from the same IP address and browser. According to Umami, it processes the IP address itself only transiently, for example for security, network routing and approximate location functions. Umami stores nothing in your browser's local storage; the script only reads the "umami.disabled" entry there, which can be used to switch measurement off. The legal basis is Art. 6(1)(f) GDPR (legitimate interest in analysing use of our website with as little data as possible). Umami processes the data on our behalf under its data processing agreement, which forms part of its terms of service. Our account is set to the EU data region; however, Umami also uses subprocessors in the USA, such as Cloudflare for network and security services. Transfers to Umami in the USA are covered by the EU standard contractual clauses incorporated into the data processing agreement (Art. 46(2)(c) GDPR); you can request a copy using the contact details in section 3. According to Umami, analytics data is kept for six months on our plan. We keep aggregated counts, which contain no identifiers for individual visits, beyond that period so that we can compare trends over longer periods. You can object to this processing at any time using the contact details in section 3. If Do Not Track is switched on in your browser, the script sends no page views or events; it is still loaded, however, so Umami still receives your IP address when it loads. An ad or script blocker can prevent the script from loading. 5. Enquiry form and email delivery (Resend) If we offer an enquiry form on our contact page and you use it, we process the details you enter in order to answer your enquiry. We process: your name, your contact details (email address or phone number), the selected topic, the workshop you optionally choose, an optional preferred date, and your message. We also record the language version of the page from which you submitted the form. Name, contact details, topic and message are required; you may leave every other field blank. Your details are not stored in any database on this website. They are sent as an email to our inbox. We use Resend, a service provided by Plus Five Five, Inc., 2261 Market Street #5039, San Francisco, CA 94114, USA, to deliver the message. Resend processes the message content and the data needed for delivery on our behalf under its data processing agreement, which forms part of its terms of service. Resend also processes some of this data, such as service logs and usage data, as an independent controller, for example to detect fraud, security incidents and misuse; Resend's privacy policy applies to that processing. According to Resend, this data is stored in the USA, and emails and their delivery logs are kept for 30 days. If you provide an email address, it is set as the reply address so that we can answer you directly. The form is protected against automated submissions by technical measures. The legal basis is Art. 6(1)(b) GDPR where your enquiry relates to entering into or performing a contract, and otherwise Art. 6(1)(f) GDPR (legitimate interest in responding to enquiries). Resend is certified under the EU-US Data Privacy Framework, so transfers to Resend in the USA are covered by the European Commission's adequacy decision (Art. 45 GDPR). For any transfer not covered by that adequacy decision, the data processing agreement incorporates the EU standard contractual clauses (Art. 46(2)(c) GDPR). We keep your enquiry in our inbox for as long as it takes to deal with it and any resulting order, and delete it afterwards, unless statutory retention periods apply. You may object at any time to processing based on Art. 6(1)(f) GDPR; please use one of the other contact routes on this website to do so. A copy of the safeguards for the third-country transfer is available on request.