Privacy Policy

The privacy policy in German can be found here. The following is a rough translation of the original German one.

Introduction Link to heading

With the following privacy policy we would like to inform you which types of your personal data (hereinafter also referred to as ‘data’ for short), for what purposes and to what process and to what extent. The privacy policy applies to all processing of personal data carried out by us, both in the context of the provision of our services and, in particular, on our websites, in mobile applications and within external online external online presences, such as our social media profiles (hereinafter collectively referred to as ‘Online service’).

The terms used are not gender-specific.

Status: 31 August 2024

Responsible Person Link to heading

Karsten Kruse

Email address:

kruse@uber.space

Overview of Processing Link to heading

The following overview summarises the types of data processed and the purposes of their processing and refers to the data subjects.

Types of data processed

Contact data.
Content data.
Usage data.
Meta/communication data.

Categories of data subjects

Communication partner.
Users.

Purposes of the processing

Contact requests and communication.
Security measures.
Managing and responding to enquiries.
Feedback.
Provision of our online services and user-friendliness.
Information technology infrastructure.

Relevant Legal Bases Link to heading

Below you will find an overview of the legal bases of the GDPR, on the basis of which we process personal data. Please note that, in addition to the provisions of the GDPR, national data protection regulations may apply in your or our country of residence or domicile. Should more specific legal bases also apply in individual cases, we will inform you of these in the privacy policy.

Contract fulfilment and pre-contractual enquiries (Art. 6 para. 1 sentence 1 lit. b) GDPR) - The processing is necessary for the performance of a contract to which the data subject is party or for the implementation of pre-contractual measures taken at the request of the data subject.
Legitimate interests (Art. 6 para. 1 sentence 1 lit. f) GDPR) - Processing is necessary for the purposes of the legitimate interests pursued by the responsible person or a third party, except where such interests or fundamental rights and freedoms of the data subject, which require the protection of personal data, prevail.

Security Measures Link to heading

We take security measures in accordance with the legal requirements taking into account the state of the art, the costs of implementation and the nature, scope, context and purposes of processing as well as the different probabilities of occurrence and the extent of the rights and freedoms of natural persons, appropriate technical and organisational measures to ensure a level of protection appropriate to the risk.

The measures include, in particular, ensuring the confidentiality integrity and availability of data by controlling physical and electronic access to the data as well as the access, input, disclosure, ensuring availability and their separation. Furthermore, we have established procedures that ensure the exercise of data subject rights, the deletion of data and reactions to the jeopardisation of data. Further, we take the protection of personal data into account as early as the development and selection of hardware, software and procedures in accordance with the principle of data protection, through technology design and through data protection-friendly default settings.

TLS encryption (https): In order to protect the data you transmit via our online service, we use TLS encryption. You can recognise such encrypted connections by the prefix https:// in the address bar of your browser.

Transfer of Personal Data Link to heading

In the context of our processing of personal data, it may happen that the data is transferred to other bodies, companies, legally independent organisational units or persons or they are disclosed to them. The recipients of this data may include, for example service providers commissioned with IT tasks or providers of services and content that are integrated into a website. In such case, we observe the legal requirements and in particular conclude contracts or agreements that serve to protect your data with the recipients of your data.

Data Processing in Third Countries Link to heading

If we process data in a third country (i.e. outside the European Union Union (EU), the European Economic Area (EEA)) or if the processing in the context of the use of third-party services or the disclosure or transfer of data to other persons, bodies or companies happens, this will only take place in accordance with the legal requirements.

Subject to explicit consent or contractually or legally required transfer by contract or law, we process or have the data processed only in third countries with a recognised level of data protection, contractual obligation through so-called standard protection clauses of the EU Commission, in the presence of certifications or binding internal data protection regulations (Art. 44 to 49 GDPR, Information page of the EU Commission: https://ec.europa.eu/info/law/law-topic/data-protection/international-dimension-data-protection_de).

Deletion of Data Link to heading

The data processed by us will be deleted in accordance with the legal requirements, as soon as the consent authorised for processing is revoked or other authorisations cease to apply (e.g. if the purpose for processing this data no longer applies or they are not required for the purpose). If the data is not deleted because they are required for other and legally permissible purposes, their processing will be restricted to these purposes. This means that the data is blocked and not processed for other purposes. This applies, for example, to data that must be retained for commercial or tax law or whose storage is necessary for the assertion, exercise or defence of legal claims or for the protection of the rights of another natural or legal person.

Our data protection notices may also contain further information on the retention and deletion of data that take precedence for the respective processing operations.

Use of Cookies Link to heading

Cookies are small text files or other storage devices that store information on end devices and read information from the end devices. E.g. the login status in a user account, the contents of a shopping basket in an e-shop, the content accessed or the used functions of an online service. Cookies can also be used for various purposes, e.g. for the purposes of the functionality, security and convenience of online services and the creation of analyses of visitor flows.

Notes on consent: We use cookies in accordance with the legal regulations. We therefore obtain prior consent from users, unless this is not required by law. In particular, consent is not required if the storage and reading of information, including cookies, are absolutely necessary in order to provide the user with an expressly requested telemedia service (i.e. our online service). The revocable consent is clearly communicated to users and contains the information on the respective cookie use.

Notes on legal bases under data protection law: On which legal basis under data protection law we process the personal data of users with the help of cookies depends on whether we ask users for their consent. If the users consent, the legal basis for the processing of their data is the consent. Otherwise, the data processed with the help of cookies will be processed on the basis of our legitimate interests (e.g. in the business operation of our online service and improvement of its usability) or, if the use of cookies is necessary to fulfil our contractual obligations. The purposes for which cookies are processed by us, will be clarified in the course of this privacy policy or in the context of our consent and processing procedures.

Storage duration: With regard to the storage duration, the following types of cookies are distinguished:

Temporary cookies (also: session cookies): Temporary cookies are deleted at the latest after a user has left an online service and closed their end device (e.g. browser or mobile application).
Permanent cookies: Permanent cookies remain stored even after the end device is closed. For example, the login status can be saved or favourite content can be displayed directly when the user visits a website again. Likewise user data collected with the help of cookies can also be used to measure reach. If we do not provide users with explicit information about the type and storage duration of cookies (e.g. in the context of obtaining consent), users should assume that cookies are permanent and that the storage period can be up to two years.

General information on revocation and objection (opt-out): Users can revoke the consents they have given at any time and also object to the processing in accordance with the legal requirements in Art. 21 GDPR. Users can also declare their objection via the settings of their browser, e.g. by deactivating the use of cookies (although this may also restrict the functionality of our online services). An objection to the use of cookies for online marketing purposes can also be done via the websites https://optout.aboutads.info and https://www.youronlinechoices.com/.

Further information on processing, procedures and services:

Processing of cookie data on the basis of consent: We use a procedure for cookie consent management, in the context of which the consent of users to the use of cookies, or to the procedure and provider is obtained and can be managed and revoked by the users. The declaration of consent is stored so that it does not have to be requested again and to be able to prove the consent in accordance with the legal obligation. The storage can take place on the server and/or in a cookie (so-called opt-in cookie, or with the help of comparable technologies) in order to assign the consent to a user or their device. Subject to individual information on the providers of cookie management services, the following information applies: The duration of the storage of the consent can be up to two years. A pseudonymous user identifier is created and linked to the time of consent, information on the scope of consent (e.g. which categories of cookies and/or service providers) as well as the browser, system and end device used is stored.

Provision of the Online Service and Web Hosting Link to heading

We process users’ data in order to provide them with our online services. For this purpose, we process the IP address of the user, which is necessary in order to be able to transmit the content and functions of our online services to the user’s browser or end device.

Processed data types: Usage data (e.g. websites visited, interest in content, access times); meta/communication data (e.g. device information, IP addresses); content data (e.g. entries in online forms).
Data subjects: Users (e.g. website visitors, users of online services).
Purposes of the processing: Provision of our online service and user-friendliness; information technology infrastructure (operation and provision of information systems and technical devices (computers, servers, etc.)); security measures.
Legal basis: Legitimate interests (Art. 6 para. 1 sentence 1 lit. f) GDPR).

Further Information on Processing, Procedures and Services:

Provision of online serive on rented storage space: We use storage space for the provision of our online service, computing capacity and software that we rent from a corresponding server provider (also referred to as ‘web host’) or obtain otherwise; Legal basis: Legitimate interests (Art. 6 para. 1 sentence 1 lit. f) GDPR).
Collection of access data and log files: Access to our online service is recorded in the form of so-called ‘server log files’. The server log files may include the address and name of the websites and files accessed, the date and time of access, the amount of transferred data volumes, notification of successful retrieval, browser type and version, the user’s operating system, referrer URL (the previously visited page) and, as a rule, IP addresses and the requesting provider. The server log files can be used for security purposes, e.g. to avoid overloading the server (especially in the case of abusive attacks, so-called DDoS attacks) and, on the other hand, to ensure the utilisation of the servers and their stability; Legal basis: Legitimate interests (Art. 6 para. 1 sentence 1 lit. f) GDPR); Deletion of data: Log file information is stored for a maximum period of 30 days and then deleted or anonymised. Data whose further storage is required for evidence purposes are excluded from deletion until final clarification of the respective incident.
Email dispatch and hosting: The web hosting services we use also include the sending, receipt and storage of emails. For these purposes, the addresses of the recipients and senders as well as other information regarding the sending of emails (e.g. the providers involved) and the content of the respective emails are processed. The aforementioned data may also be processed for the purpose of recognising SPAM. Please note that emails on the Internet are generally not sent in encrypted form. As a rule emails are encrypted in transit, but (unless the so-called end-to-end encryption method is used) they are not encrypted on the servers from which they are sent and received. We can therefore not be held liable for the transmission path of the emails between the sender and receipt on our server; Legal basis: Legitimate interests (Art. 6 para. 1 sentence 1 lit. f) GDPR).
Uberspace: Services in the field of the provision of information technology infrastructure and related services (e.g. storage space and/or computing capacity); Service provider: Uberspace, Kaiserstr. 15, 55116 Mainz, Germany; Legal basis: Legitimate interests (Art. 6 para. 1 sentence 1 lit. f) GDPR); Website: uberspace.de; Data protection declaration: https://uberspace.de/de/about/privacy/; Order processing contract: Is provided by the service provider.
STRATO: Services in the field of the provision of information technology infrastructure and related services (e.g. storage space and/or computing capacity); Service provider: STRATO AG, Pascalstraße 10,10587 Berlin, Germany; Legal basis: Legitimate interests (Art. 6 para. 1 sentence 1 lit. f) GDPR); Website: https://www.strato.de; Data protection declaration: https://www.strato.de/datenschutz; Order processing contract: Is provided by the service provider.

Contact and Enquiry Management Link to heading

When you contact us (e.g. via contact form, email, phone or via social media) and within the framework of existing user and business relationships, the details of the enquiring persons are processed to the extent that this is necessary to answer the contact enquiries and any requested measures.

Types of data processed: Contact details (e.g. email, phone numbers); Content data (e.g. entries in online forms); Usage data (e.g. websites visited, interest in content, access times); Meta/communication data (e.g. device information, IP addresses).
Affected persons: Communication partners.
Purposes of processing: Contact enquiries and communication; Administration and response to enquiries; Feedback (e.g. collecting feedback via online form); Provision of our online service and user-friendliness.
Legal basis: Legitimate interests (Art. 6 Para. 1 Clause 1 lit. f) GDPR); Contractual performance and pre-contractual enquiries (Art. 6 Para. 1 Clause 1 Clause b) GDPR).

Further information on processing, methods and services:

Contact form: When users contact us via our contact form, email or other means of communication, we process the data communicated to us in this context to process the communicated request; Legal basis: Contract fulfilment and pre-contractual enquiries (Art. 6 para. 1 sentence 1 lit. b) GDPR), Legitimate interests (Art. 6 para. 1 sentence 1 lit. f) GDPR).

Changing and Updating of the Privacy Policy Link to heading

We ask you to inform yourself about the content of our privacy policy on a regular basis. We adapt the privacy policy as soon as the changes to the data processing carried out by us make this necessary. We will inform you as soon as the changes require an act of cooperation on your part (e.g. consent) or any other individual notification becomes necessary.

If we provide addresses and contact information of companies and organisations in this privacy policy, please note that the addresses may change over time and please check the details before contacting us.

Rights of the Data Subjects Link to heading

As a data subject, you are entitled to various rights under the GDPR, which arise in particular from Art. 15 to 21 GDPR:

Right to object: You have the right to object, on grounds relating to your particular situation, to object at any time to the processing of personal data concerning you which is based on Art. 6 para. 1 lit. e or f GDPR; This also applies to an objection based on these provisions. If the personal data concerning you is processed in order to direct marketing, you have the right at any time to object to the processing of personal data concerning you for the purpose of such advertising; This also applies to profiling insofar as it is associated with such direct advertising.
Right to revoke consent: You have the right to revoke your consent at any time.
Right to information: You have the right to request confirmation as to whether the data in question is being processed and to information about this data as well as further information and a copy of the data in accordance with the legal requirements.
Right to rectification: You have the right to request the completion of data concerning you or the rectification of inaccurate data concerning you.
Right to delete and restriction of processing: You have the right, in accordance with the statutory provisions, to demand that data concerning you be deleted immediately, or alternatively, to demand that the processing of the data be restricted in accordance with the statutory provisions.
Right to data portability: You have the right to receive data concerning you that you have made available to us in a structured, common and machine-readable format, in accordance with the statutory requirements, or to request that it be transmitted to another responsible party.
Complaint to a supervisory authority: Without prejudice to any other administrative or judicial remedy, you have the right to lodge a complaint with a supervisory authority, in particular in the Member State of your habitual residence, place of work or place of the alleged infringement, if you believe that the processing of personal data concerning you violates the provisions of the GDPR.

Definitions of Terms Link to heading

This section provides you with an overview of the terms used in this privacy policy. Many of the terms are taken from the law and are defined primarily in Art. 4 GDPR. The legal definitions are binding. The following explanations, on the other hand, are intended primarily to help you understand. The terms are sorted alphabetically.

Personal data: ‘Personal data’ is all information that relates to an identified or identifiable natural person (hereinafter ‘data subject’); a natural person is considered identifiable if he or she can be identified directly or indirectly, in particular by assignment to an identifier such as a name, an identification number, location data, an online identifier (e.g. cookie) or to one or more special characteristics that express the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person.
Responsible person: The ‘responsible person’ is the natural or legal person, public authority, institution or other body that, alone or jointly with others, decides on the purposes and means of processing personal data.
Processing: ‘Processing’ is any operation or series of operations performed on personal data with or without the aid of automated procedures. The term is broad and covers practically every handling of data, be it collection, evaluation, storage, transmission or deletion.