[PEARL: LEGAL REVIEW REQUIRED]
This text accurately describes what the website does technically, which is the part a developer can establish. It is not legal advice and has not been reviewed by a lawyer. Have it checked against the GDPR and the German TDDDG before launch, and fill in every remaining placeholder.
1. Controller
[PEARL: ADD CONTROLLER DETAILS]
The legal entity responsible for processing, its address and a contact email. This must match the imprint. Add a data protection officer if PEARL is required to appoint one.
2. Hosting and server log files
When you visit this website, the hosting provider’s server automatically records information that your browser transmits. This typically includes the page requested, the date and time of the request, the amount of data transferred, the referring page, your browser and operating system, and your IP address. This data is used to operate the site securely and reliably and is not combined with other data sources.
The legal basis is Art. 6 (1) (f) GDPR, based on our legitimate interest in the technically error-free operation and security of this website.
[PEARL: ADD HOSTING PROVIDER AND RETENTION PERIOD]
Name the provider and its address, state how long log files are kept, and link to the data processing agreement (Auftragsverarbeitungsvertrag) you have in place with them. You must have one.
3. Cookies
This website sets no cookies for ordinary visitors. WordPress sets session cookies only for users who log in to the administration area, which is not available to the public.
4. Fonts and external resources
All fonts used on this website are hosted on our own server. No connection is made to Google Fonts or any other font service, and no content delivery network is used. As a result, your IP address is not transmitted to any third party in order to display this page.
5. Contact form
If you send us a message using the contact form, the details you provide (your name, email address, optionally your organisation, the reason for contact and the content of your message) are forwarded to us by email so that we can respond. They are not stored in this website’s database.
To limit automated abuse, the site briefly stores a one-way hash of your IP address for one hour in order to count submissions. The IP address itself is not retained, and the hash cannot be used to identify you afterwards.
The legal basis is your consent under Art. 6 (1) (a) GDPR, given by ticking the box on the form, and Art. 6 (1) (b) or (f) GDPR where the enquiry relates to a contract or to pre-contractual steps. You may withdraw your consent at any time with effect for the future.
[PEARL: ADD EMAIL RETENTION PERIOD AND MAILBOX PROVIDER]
State how long enquiry emails are kept in your mailbox and who provides that mailbox, since the message is stored there rather than on the website.
6. Analytics
This website uses no analytics or tracking by default. No profile of your visit is created and no data is passed to advertising networks.
[PEARL: UPDATE THIS SECTION IF ANALYTICS ARE SWITCHED ON]
If you enable Plausible under Settings → PEARL, describe it here: cookieless, aggregated, no personal data, legitimate interest under Art. 6 (1) (f) GDPR, and name the host (plausible.io in the EU, or your own instance). If you enable Google Analytics instead, this section must describe the consent banner, the transfer of data to Google, and the legal basis of consent under Art. 6 (1) (a) GDPR.
7. Your rights
You have the right to obtain information about the personal data we hold about you (Art. 15 GDPR), to have it corrected (Art. 16), erased (Art. 17) or its processing restricted (Art. 18), to data portability (Art. 20), and to object to processing based on legitimate interests (Art. 21). To exercise any of these rights, contact us using the details in section 1.
You also have the right to lodge a complaint with a supervisory authority. For North Rhine-Westphalia this is the Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen.
8. SSL/TLS encryption
This site uses TLS encryption for all traffic. You can recognise an encrypted connection by the „https://“ prefix in your browser’s address bar.
9. Changes to this policy
[PEARL: ADD LAST-UPDATED DATE]
State when this policy was last revised, and update it whenever the site’s processing changes.