LEGAL

Privacy policy

1. Controller and contact

[MUSTERMANN – FULL NAME / BUSINESS]
[MUSTERMANN – STREET / HOUSE NUMBER]
[MUSTERMANN – POSTCODE / CITY]
Email: [MUSTERMANN – PUBLIC EMAIL]
Telephone: [MUSTERMANN – CONFIRM TELEPHONE / CONTACT METHOD]

[MUSTERMANN – PRIVACY CONTACT AND DATA PROTECTION OFFICER ONLY IF ACTUALLY APPOINTED]

2. Hosting and server logs

The website is technically provided through United Domains webspace on IONOS infrastructure. The provider united-domains GmbH is based at Gautinger Straße 10, 82319 Starnberg; IONOS SE at Elgendorfer Straße 57, 56410 Montabaur. The operator must confirm the precise contracting party and agreed data processing arrangements: [MUSTERMANN – CONFIRM HOSTING CONTRACTING PARTY AND EXISTING DATA PROCESSING AGREEMENT].

United Domains describes its webspace product as processing data on IONOS servers in Germany and retaining access and usage data for eight weeks. The accessible log rotation for this installation currently also covers approximately eight weeks. This does not confirm additional contractual guarantees or particular retention arrangements in individual cases.

When the website is accessed, technical access data such as IP addresses or IP anonymisation features, time, requested address, HTTP method and status, referrer and browser identification are processed. Accessible web server logs must be distinguished from the provider's separately described analyses. The observed log format does not establish that every log is already fully anonymised. Processing serves delivery, stability and prevention of misuse; the intended legal basis is Article 6(1)(f) GDPR where supported by the balancing of interests.

Product information from the providers is available at United Domains – Webspace and IONOS – Webhosting . [MUSTERMANN – CONFIRM CONTRACTUAL RETENTION PERIODS, ADDITIONAL ANALYSES AND ANY RETENTION EXCEPTIONS]

The domain is technically resolved through United Domains name servers. Domain and DNS management do not establish the website or mailbox contracting party. The specific registrar and domain agreement must be confirmed separately.

3. Contact enquiries

The contact form requests your name, email address, enquiry type, message and acknowledgement of the privacy information. Depending on the enquiry, you may optionally provide a telephone number, date, location, requested service, number of people, company, contact person, website, project, period and budget. We use these details to handle and coordinate the enquiry and, where applicable, prepare a contract. The legal basis is Article 6(1)(b) GDPR for pre-contractual or contractual matters, otherwise Article 6(1)(f) GDPR for handling communication. The privacy acknowledgement confirms that you have read this information; it is not blanket consent to marketing.

Processing takes place on the server through the existing DriveLink Core form interface. Enquiries are forwarded by email to the recipient configured on the server; their contents are not displayed publicly. This form currently has no additional storage of the message as a website enquiry record enabled. The email mailbox and transport provider may store the message.

The sending path uses the existing WordPress and DriveLink Core mail processing. No separate SMTP plugin or phpmailer_init SMTP adapter is currently registered. The hosting PHP configuration specifies a local Sendmail transport; actual delivery is not claimed here. The website domain's MX records point to United Domains. This does not determine the provider of the recipient address to be used later. [MUSTERMANN – CONFIRM AUTHORISED RECIPIENTS, FUTURE MAILBOX PROVIDER AND DATA PROCESSING ARRANGEMENTS]

Enquiries are deleted once no longer needed for handling and possible follow-up questions. Statutory retention obligations and the necessary preservation or enforcement of claims may justify longer retention of individual contractual documents. [MUSTERMANN – CONFIRM THE SPECIFIC DELETION POLICY AND APPLICABLE PERIODS]

Please do not submit unnecessary sensitive health information through the form. If particular information is needed for a beauty service, its purpose, scope and lawful processing will be clarified in personal contact.

4. Security and prevention of misuse

DriveLink Security checks technical form evidence, an invisible test or honeypot field, minimum completion time, frequency and duplicate enquiries on the server. Pseudonymised technical identifiers, short-lived counters and security events are processed for this purpose. The necessary dlsec_visitor cookie, lasting up to 24 hours, may be used to associate form evidence. It serves security, not advertising or visitor profiling. The legal basis is Article 6(1)(f) GDPR; necessary storage must be assessed separately under section 25(2) TDDDG.

Administration and login functions are access restricted; WordPress may set necessary login cookies there. The current technical retention period for security events is 30 days; temporary misuse counters and a necessary security cookie are processed separately. The security cookie expires after one day. [MUSTERMANN – CONFIRM AUTHORISED ACCESS AND THE OPERATIONAL LOG POLICY]

This draft does not claim any active external Turnstile processing. This text and the integration must be reviewed before additional external verification procedures are activated.

Cookies and similar technologies

Technically necessary storage supports the requested website functions: security functions, language preference and management or documentation of privacy settings. Necessary storage must be distinguished from consent to optional services. No optional analytics or marketing services are currently configured in Real Cookie Banner.

Details of the cookies and services currently configured in Real Cookie Banner can be found under Cookie settings. The policy there is generated dynamically from the existing RCB configuration; no second, manually maintained cookie table is used.

WordPress may store technical information to support display for the duration of the browser session. Real Cookie Banner uses local storage to coordinate its consent processing. Only resources from this website were requested in the public browser visits checked; no external analytics, marketing or Instagram API connection was detected.

5. Privacy preferences / Real Cookie Banner

Real Cookie Banner manages privacy preferences and stores the chosen settings or required evidence. The public configuration currently checked contains no configured optional analytics or marketing services. Necessary storage for security, language and preferences must be distinguished from consent to optional services. Accept all does not activate services that have not been configured.

You can reopen the native settings interface at any time:

The current RCB configuration specifies 30 days for the decision cookie and 120 months for documentation on the server. The technical configuration does not establish that this evidence retention period is necessary in every case. [MUSTERMANN – CONFIRM THE NECESSITY OF THE CONFIGURED EVIDENCE RETENTION PERIOD AND LEGAL BASIS]

6. Languages and TranslatePress

German is the source language. TranslatePress provides stored English translations through the English language address. Necessary language storage may help retain the chosen language. The configured automatic provider is TranslatePress AI / MTAPI; automatic translation is currently blocked because the MTAPI quota is below the minimum threshold required by the installed integration. Accordingly, no ongoing automatic transmission of new website texts to Google or another newly configured provider is claimed. Any regular reactivation must first be reviewed technically and for data protection with the actual provider.

The selected language is determined by the language address. No separate TranslatePress language cookie was detected during the public visits and language switching checked. Language-specific RCB cookies document privacy settings. [MUSTERMANN – CONFIRM HISTORICAL TRANSLATION PROCESSING AND ANY PROVIDER AGREEMENTS]

7. Instagram and external links

The existing Instagram feed provider, Smash Balloon, is currently not connected to an account. The existing fallback is displayed publicly; no active Instagram API feed or initial external Instagram media requests are therefore claimed. When you deliberately follow an external Instagram link, you leave this website. Instagram/Meta processes the subsequent visit under its own privacy information. Data transfers and any necessary consent must be reviewed again before a real feed or external embeds are connected.

8. Images, fonts and embedded content

The website fonts and regular project images checked are delivered locally from the website server. No externally loaded Google Fonts or enabled analytics or advertising pixels were detected on the public pages checked. This assessment covers the homepage and collaborations page; newly added external content must be reviewed separately before publication.

9. Recipients and international transfers

Access is limited to the authorised persons and contracted providers needed for operation and enquiries. Transfers to third countries are to be described only where an actually used service causes them. [MUSTERMANN – CONFIRM THE PROVIDER LIST, PROCESSING LOCATIONS AND ANY NECESSARY SAFEGUARDS]

10. Your rights

Subject to the statutory conditions, you have rights of access, rectification, erasure, restriction of processing and data portability. Where processing is based on consent, it can be withdrawn with effect for the future. You may object to processing based on legitimate interests for reasons relating to your particular situation. You also have the right to complain to a data protection supervisory authority.

[MUSTERMANN – CONFIRM THE COMPETENT SUPERVISORY AUTHORITY FOR THE OPERATOR'S LOCATION]

11. Updates

Technical draft dated October 2026. Changes to actual services and processing must be reflected in this text before they are activated. Publication requires complete operator details and legal review.