Privacy policy

1. Controller

This website is jointly operated by two legally independent companies. The controllers responsible for data processing on this website are:

The controller is the natural or legal person who, alone or jointly with others, determines the purposes and means of processing personal data (e.g. names, email addresses, etc.).

2. Data protection officer

We have appointed an external data protection officer for data protection matters. You can contact them directly at any time with your concerns:

3. Contact form

If you send us a message via the contact form on this website, we process the data you provide (name, email address, message text) exclusively for the purpose of handling your enquiry.

Legal basis: Art. 6 (1) (b) GDPR (pre-contractual enquiry) or Art. 6 (1) (f) GDPR (legitimate interest in responding to contact enquiries).

This website is technically operated on our behalf by Dennis Hüsker (further information: webtuningstudio.de), under a data processing agreement pursuant to Art. 28 GDPR. The contact form is submitted via a server-side endpoint operated by Dennis Hüsker (webtuningstudio.de), which sends the message via SMTP through Google Workspace (Google Ireland Limited). A data processing agreement under Art. 28 GDPR is in place with both Dennis Hüsker (webtuningstudio.de) and Google.

Your IP address is additionally stored automatically for a maximum of 10 minutes to prevent abuse (spam) via the contact form (Art. 6 (1) (f) GDPR). This data is then automatically deleted.

Your contact enquiry is deleted after it has been processed, and at the latest after 30 days, unless statutory retention obligations require otherwise.

4. Server log files (hosting)

This website is hosted on a server provided by Hostinger, which is managed on our behalf by our service provider Dennis Hüsker (further information: webtuningstudio.de) under a data processing agreement (Art. 28 GDPR). Hostinger acts as a sub-processor of Dennis Hüsker (webtuningstudio.de). Every access to the website automatically records server log files: IP address, timestamp of access, page requested, browser type, referrer (the page you came from).

• Purpose: ensuring website security, troubleshooting and technical maintenance, abuse prevention
• Legal basis: legitimate interest (Art. 6 (1) (f) GDPR)
• Recipients: Dennis Hüsker (further information: webtuningstudio.de) as processor, Hostinger (Lithuania, European data centre) as its sub-processor
• Retention period: 30–90 days per Hostinger's standard policy, then automatically deleted
• Your rights: as this data is technically necessary and deleted after a short period, no separate case-by-case disclosure obligation applies.

5. Content Delivery Network (CDN)

To deliver the website faster and protect it against overload attacks (e.g. DDoS), we use the in-house Content Delivery Network (CDN) of our hosting provider Hostinger, which is managed on our behalf by our service provider Dennis Hüsker (further information: webtuningstudio.de). This is not an additional external provider, but part of the same Hostinger infrastructure already described under point 4. This necessarily involves processing your IP address within this infrastructure, as this is required for the technical delivery of website content to your device.

• Purpose: faster load times, protection against overload attacks (DDoS) and abuse
• Legal basis: legitimate interest (Art. 6 (1) (f) GDPR)
• Recipients: Dennis Hüsker (further information: webtuningstudio.de) as processor, Hostinger (Lithuania, European data centre) as its sub-processor
• Retention period: per Hostinger's standard policy, typically a few days
• Your rights: you have the same data subject rights regarding this data as described under point 14.

6. Hostinger Analytics

Through the Hostinger account managed by Dennis Hüsker (further information: webtuningstudio.de), usage data about the website is evaluated (page visits, time on page, device types), based on the same access data described under point 4, including the IP address. As the IP address is considered personal data, this is not anonymised data but personal data.

• Purpose: understanding and optimising our website usage
• Legal basis: legitimate interest (Art. 6 (1) (f) GDPR)
• Recipients: Dennis Hüsker (further information: webtuningstudio.de) as processor, Hostinger (Lithuania, European data centre) as its sub-processor
• Retention period: per Hostinger's standard policy (typically 30 days)
• Your rights: you have the same data subject rights regarding this data as described under point 14.

7. Map service (OpenStreetMap)

We use the map service OpenStreetMap (OSM) on this website to display our locations. The provider is the OpenStreetMap Foundation, St John's Innovation Centre, Cowley Road, Cambridge, CB4 0WS, United Kingdom.

The map is not loaded automatically. Only once you actively click the "Load map & confirm" button is a connection to OpenStreetMap's servers established and your IP address transmitted. This is based on your consent (Art. 6 (1) (a) GDPR). You can withdraw this consent at any time with future effect by clearing this site's browser data.

Further information on how user data is handled can be found in OpenStreetMap's privacy policy: osmfoundation.org/wiki/Privacy_Policy

8. Video showcase

The videos embedded on this website are delivered exclusively from our own server (self-hosted). There is no embedding via third-party providers such as YouTube or Vimeo, so no data is transmitted to external providers when the videos are played. The information on server log files under point 4 applies.

9. Web fonts (Google Fonts)

This website uses Google Fonts for a consistent display of typefaces. The fonts are hosted locally on our own server. No connection to Google's servers is made when the website is accessed, and no data is transmitted to Google.

10. Application form (careers page)

If you apply to us via the application form on our careers page, we process the data you provide there (name, phone number, email address, your message, and the details requested during the application flow regarding the desired position, e.g. driving licence, shift availability, forklift licence, or desired start date) exclusively to carry out the recruitment process.

Legal basis: Section 26 (1) BDSG (German Federal Data Protection Act — data processing in the employment context) and Art. 6 (1) (b) GDPR (initiation of an employment relationship).

Retention period: your application documents are deleted after the recruitment process has concluded. In the event of a rejection, we retain the data for up to 6 months to be able to respond to any claims under the German General Equal Treatment Act (AGG). With your express consent, we may also retain your documents for longer for future job openings (inclusion in a talent pool).

Recipients: your data is viewed exclusively internally by employees responsible for personnel selection and is not disclosed to third parties.

11. Cookies

This website does not use tracking or marketing cookies. Only technically necessary functions are used (e.g. storing your consent to load the OpenStreetMap map as described under point 7), which are required for the operation of the website and do not require separate consent under Section 25 TTDSG (German Telecommunications and Telemedia Data Protection Act) (Art. 6 (1) (f) GDPR).

12. SSL/TLS encryption

For security reasons and to protect the transmission of confidential content, this website uses SSL/TLS encryption. You can recognise an encrypted connection by the browser's address bar changing from "http://" to "https://" and by the padlock icon in your browser bar. When SSL or TLS encryption is active, the data you transmit to us cannot be read by third parties.

13. External links

Our website contains links to third-party websites (e.g. partner companies). We have no influence over the content of these external websites and therefore cannot accept any liability for this external content. The respective provider or operator of the linked pages is always responsible for their content. The linked pages were checked for possible legal violations at the time of linking; no unlawful content was identifiable at that time. However, permanent monitoring of the content of linked pages is not reasonable without concrete evidence of a legal violation. If we become aware of any legal violations, we will remove such links immediately.

14. Your rights under the GDPR

With regard to your personal data stored by us, you generally have the following rights:

• Right of access (Art. 15 GDPR)
• Right to rectification (Art. 16 GDPR)
• Right to erasure (Art. 17 GDPR)
• Right to restriction of processing (Art. 18 GDPR)
• Right to data portability (Art. 20 GDPR)
• Right to object to processing based on Art. 6 (1) (f) GDPR (Art. 21 GDPR)
• Right to withdraw consent given, with future effect (Art. 7 (3) GDPR)

To exercise these rights, you can contact us at any time using the contact details given under point 1.

15. Right to lodge a complaint with a supervisory authority

You have the right to lodge a complaint with a data protection supervisory authority regarding our processing of your personal data. The competent authority is:

16. Changes to this privacy policy

We reserve the right to amend this privacy policy to ensure it always complies with current legal requirements, or to reflect changes to our services in the privacy policy. The new privacy policy will then apply to your next visit.