Protecting your personal data matters to us. Below we inform you in accordance with Articles 13 and 14 of the General Data Protection Regulation (GDPR) which data we process when you visit this website, for which purpose and on which legal basis this happens, and which rights you have. Please note: this website is a template; the company details named here are placeholders and must be adapted before publication.
1. Controller and data protection officer
The controller within the meaning of Article 4 (7) GDPR is websitebestellen, Torstraße 123, 10119 Berlin, Germany, represented by its managing director Max Mustermann, telephone +49 30 1234 5678, e-mail contact@websitebestellen.com. For data protection matters you can reach us at the same address using the subject line “Datenschutz”. A data protection officer has not been appointed at present because the statutory conditions of § 38 BDSG are not met.
2. Data collected when visiting the website (server log files)
Each time you call up this website, your browser transmits technically necessary data which our server records in what are known as log files. In particular, the following is recorded:
- shortened IP address of the requesting device
- date and time of access
- name and URL of the file retrieved and the volume of data transferred
- browser type, browser version and operating system used
- the previously visited page (referrer), where transmitted
- notification of whether the retrieval was successful and the HTTP status code
The legal basis is Article 6 (1) (f) GDPR. Our legitimate interest lies in delivering the website free of technical errors, investigating misuse and ensuring system security. This data is not merged with other data sources and is not used for profiling. Log files are deleted after seven days at the latest, unless they are required to investigate a specific security incident.
3. Cookies and consent
We only use technically necessary cookies as long as you have not given any further consent. Necessary cookies store, for example, your language selection and your decision in the consent banner. The legal basis for this is § 25 (2) no. 2 TDDDG in conjunction with Article 6 (1) (f) GDPR.
We only use non-essential cookies and comparable technologies on your device after you have expressly consented in the banner. The legal basis is then § 25 (1) TDDDG and Article 6 (1) (a) GDPR. Your consent is voluntary and can be withdrawn at any time with effect for the future by reopening the cookie settings or deleting the cookies stored in your browser. The lawfulness of processing carried out up to the withdrawal remains unaffected.
Recording of your consent (consent management)
Article 7 (1) GDPR obliges us to be able to demonstrate that consent was given. For this purpose we record every decision made in the consent banner in a separate register. The following is recorded:
- the time of the decision (date and time)
- the type of decision: granting, change or withdrawal
- the categories consented to (essential, statistics, marketing)
- your IP address and the identifier transmitted by your browser (user agent)
- the page on which the decision was made and the language version
- the version of the banner text and of this privacy policy
- a randomly generated consent ID
Without the IP address and browser identifier the record would be worthless, because the decision could not be attributed to any visit. The legal basis for this recording is Article 6 (1) (c) GDPR in conjunction with Article 7 (1) GDPR — compliance with a legal obligation. An objection under Article 21 GDPR is not possible in this respect, because the record exists precisely for your protection.
The entries cannot be altered: a withdrawal does not delete the earlier decision but is added as a new entry, so that the status at any point in time remains verifiable. The records are deleted automatically three years after the respective decision; this period follows the standard limitation period under § 195 BGB. Your consent ID is shown to you in the cookie settings — you can use it to refer to your entry without having to provide any further data.
4. Contacting us, contact form and applications
If you contact us via the contact form, by e-mail, telephone or messenger, we process the data you provide — usually your name, telephone number, e-mail address and the content of your message — solely in order to handle your enquiry. Mandatory fields are marked as such; all other information is voluntary.
If your enquiry is aimed at concluding or performing a contract, the legal basis is Article 6 (1) (b) GDPR. In all other cases we base the processing on our legitimate interest in answering enquiries efficiently pursuant to Article 6 (1) (f) GDPR. We process application data on the basis of § 26 (1) BDSG in conjunction with Article 88 GDPR and delete it no later than six months after the selection procedure has been completed, unless you have agreed to longer storage in our applicant pool.
5. Hosting and delivery
This website is hosted by a service provider with data centres inside the European Union. On our behalf, the host processes the connection data described above in order to deliver the website, create backups and fend off attacks. The legal basis is Article 6 (1) (f) GDPR; a data processing agreement pursuant to Article 28 GDPR is in place with the provider. No transfer to third countries takes place in this context.
6. Web analytics and reach measurement
We only load analytics and marketing services after you have agreed in the consent banner. Without your consent, no third-party scripts are executed and no identifiers are stored on or read from your device. If consent is given, we process pseudonymised usage data such as pages viewed, time on page, approximate region and device category in order to improve content and loading times. The legal basis is Article 6 (1) (a) GDPR in conjunction with § 25 (1) TDDDG.
7. Processing on our behalf and recipients of the data
We use carefully selected service providers who process personal data exclusively on our behalf and in accordance with our instructions. A data processing agreement pursuant to Article 28 GDPR is in place with each of these providers, governing the technical and organisational measures, the sub-processors used and the deletion routine at the end of the contract. Categories of recipients are:
- hosting and infrastructure providers within the EU
- providers for e-mail delivery and customer communication
- accounting and invoicing service providers within the scope of statutory obligations
- after consent: providers of web analytics and advertising services
Transfers to countries outside the EU and the EEA only take place where an adequacy decision of the European Commission exists or appropriate safeguards under Article 46 GDPR — in particular standard contractual clauses together with supplementary measures — have been agreed. Data is not passed on to third parties for advertising purposes.
8. Storage period
We store personal data only for as long as is necessary for the respective purpose. Enquiries without a contractual context are deleted no later than six months after they have been finally dealt with. Data from contractual relationships is subject to the commercial and tax retention periods of six and ten years respectively under § 257 HGB and § 147 AO. Once the relevant period has expired, the data is deleted or its processing is restricted.
9. Your rights as a data subject
You have the following rights against us in respect of the personal data relating to you:
- access to the data processed under Article 15 GDPR
- rectification of inaccurate or incomplete data under Article 16 GDPR
- erasure of your data under Article 17 GDPR, unless a retention obligation prevents this
- restriction of processing under Article 18 GDPR
- data portability in a structured, commonly used format under Article 20 GDPR
- objection to processing based on legitimate interests under Article 21 GDPR
An informal message to contact@websitebestellen.com is sufficient to exercise these rights. We answer requests free of charge within one month; for complex requests this period may be extended by two further months, of which we will inform you. In order to prevent misuse we may request additional information to verify your identity.
10. Right to complain to a supervisory authority
Without prejudice to any other legal remedy, you have the right under Article 77 GDPR to lodge a complaint with a data protection supervisory authority, in particular in the Member State of your residence, your place of work or the place of the alleged infringement. The authority responsible for us is the Berlin Commissioner for Data Protection and Freedom of Information, Alt-Moabit 59–61, 10555 Berlin.
11. Data security
Throughout your visit to the website we use TLS encryption in line with the current state of the art. In addition, we take appropriate technical and organisational measures under Article 32 GDPR to protect your data against accidental or deliberate manipulation, loss, destruction and unauthorised access. These include a role-based authorisation concept, encrypted backups, regular updates of the systems in use and a confidentiality obligation for all employees.
12. Changes to this privacy policy
We adapt this privacy policy whenever the legal situation, our services or the nature of the data processing changes. The version published on this page applies in each case. We will inform you separately about material changes affecting your consent and will obtain fresh consent where necessary.
