Privacy

1. Controller

The controller within the meaning of the GDPR is:
Samland Digital UG (haftungsbeschränkt)
Schlachthofstr. 1
96450 Coburg
Germany

Questions about data protection are answered by Marc Fühnen at hallo@samland.digital.

2. Hosting and server logs

This website and our applications run on servers of Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany, in data centres in Germany. A data processing agreement under Art. 28 GDPR is in place with Hetzner. When you open a page, the servers technically process your IP address, date and time, the requested address, the HTTP status, the amount of data transferred and the browser identifier. These log data serve secure operation, troubleshooting and defence against attacks (Art. 6 (1) (f) GDPR). They are not merged with other data and are stored only as long as required for these purposes.

3. Booking the digital open hour

Through the booking form on the start page you can reserve a slot in the digital open hour. We process: name, e-mail address, desired slot (date and time), your language choice and optionally your topic. The purpose is arranging, preparing, holding and following up the appointment; the legal basis is Art. 6 (1) (b) GDPR (pre-contractual step at your request). The booking is kept with its state (requested, accepted, confirmed, cancelled) until the appointment has taken place or been cancelled, and beyond that only as far as statutory retention obligations require; on request we delete it at any time unless a retention obligation prevents it. To protect against abuse the form checks an invisible honeypot field, matches the e-mail domain against a list of disposable providers and limits the number of bookings per hour per IP address, e-mail address and e-mail domain. For this we store a salted hash of your IP address (not the address itself), your e-mail address in normalised form, its domain and the check result for 30 days (Art. 6 (1) (f) GDPR, protecting the service from automated bookings).

4. Calendar (Google Calendar)

Accepted appointments are entered into our Google calendar "Digitalsprechstunde". The calendar entry contains date and time, your name, your e-mail address, your topic and the booking number; you are not invited as an attendee and receive no e-mail from Google. The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, as a processor under a data processing agreement. Google may process data in the USA; Google LLC is certified under the EU-US Data Privacy Framework, and EU standard contractual clauses apply in addition (Art. 45, 46 GDPR). The legal basis is Art. 6 (1) (b) GDPR. The entry is kept as long as the booking itself.

5. E-mail delivery (Postmark)

We send the confirmation of your booking, changes of its state and our internal notification about new bookings via the e-mail service Postmark of ActiveCampaign, LLC, 1 North Dearborn Street, Chicago, IL 60602, USA, as a processor. Transmitted are the recipient address, name, slot and topic as well as technical delivery data. Postmark processes data in the USA on the basis of EU standard contractual clauses (Art. 46 (2) (c) GDPR). The legal basis is Art. 6 (1) (b) GDPR. Postmark keeps delivery logs and content for a limited time for delivery and troubleshooting.

6. Contact by e-mail, phone and WhatsApp

When you contact us by e-mail, phone or via the WhatsApp link, we process your details and the content of the message to handle your request (Art. 6 (1) (b) GDPR for enquiries about an order, otherwise Art. 6 (1) (f) GDPR, our interest in answering). The WhatsApp link merely opens the WhatsApp app or WhatsApp Web with our number; the conversation then runs via WhatsApp (Meta Platforms Ireland Limited, Merrion Road, Dublin 4, Ireland) under their privacy terms. If you prefer not to, write to us by e-mail. We keep correspondence as long as it is needed for handling and beyond that only where commercial or tax retention obligations apply.

7. Customer area (sign-in)

For ongoing projects there may be access to our customer area. There we process account data (name, e-mail address, password as a hash, language setting, account settings), the content and files you upload there, and technical session data. Uploaded files are stored in the object storage of Hetzner Online GmbH in Germany. The purpose is the project work with you; the legal basis is Art. 6 (1) (b) GDPR. The data is deleted when the account is deleted or the project is completed and no retention obligations apply. All e-mails of the customer area (sign-in codes, activation, password reset, e-mail address change, invitations to a workspace) are also sent via Postmark; section 5 applies.

8. Cookies

We only set technically necessary cookies: a language cookie (two years) and, only in the customer area after sign-in, a session cookie (30 days). Neither requires consent (Section 25 (2) No. 2 TDDDG); that is why there is no cookie banner. Details are in the cookie notice.

9. No tracking, no external services

We do not use analytics or statistics services, advertising or social media plugins, tracking pixels or embedded maps or videos. Fonts and all other resources are loaded from our own server, so no data is transmitted to font providers or content delivery networks. We do not create usage profiles and do not sell data.

10. Your rights

You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18) and data portability (Art. 20). You may withdraw any consent you have given at any time with effect for the future (Art. 7 (3)). An informal e-mail is sufficient; we usually reply within two working days and at the latest within the statutory one-month period.

11. Right to object (Art. 21 GDPR)

Where we process data on the basis of Art. 6 (1) (f) GDPR, you may object at any time on grounds relating to your particular situation. We will then no longer process the data unless we can demonstrate compelling legitimate grounds that override your interests, or the processing serves to establish, exercise or defend legal claims. We do not carry out direct marketing.

12. Supervisory authority

The supervisory authority responsible for us is the Bavarian State Office for Data Protection Supervision (BayLDA), Promenade 18, 91522 Ansbach, Germany, www.lda.bayern.de. You may also contact the supervisory authority at your place of residence.

13. Changes

We update this policy when the website, our processors or the legal situation change. The version published here applies; the date is shown above.