Privacy policy

This is an English translation for your convenience. Only the German version is legally binding.

1. Privacy at a glance

General information

The following gives you a simple overview of what happens to your personal data when you visit this website. Personal data is any data that can be used to identify you personally. You’ll find detailed information on data protection in the privacy policy below.

Data collection on this website

Who is responsible for data collection on this website?

Data on this website is processed by the website operator. You’ll find their contact details in the section “Controller” in this privacy policy.

How do we collect your data?

Some of your data is collected because you give it to us – for example, data you enter in a form.

Other data is collected automatically or, after your consent, by our IT systems when you visit the website. This is mostly technical data (e.g. browser, operating system or time of the page visit). This data is collected automatically as soon as you enter this website.

What do we use your data for?

Some of the data is collected to make sure the website works without errors. Other data may be used to analyze how you use the website. If contracts can be concluded or initiated through the website, the transmitted data is also processed for contract offers, orders or other requests.

What rights do you have regarding your data?

You have the right to receive information about the origin, recipients and purpose of your stored personal data free of charge at any time. You also have the right to request that this data be corrected or deleted. If you have given consent to data processing, you can withdraw this consent at any time for the future. Under certain circumstances, you also have the right to request that the processing of your personal data be restricted. You also have the right to lodge a complaint with the competent supervisory authority.

You can contact us at any time about this or any other questions about data protection.

Analytics and third-party tools

When you visit this website, your browsing behavior may be statistically analyzed. This is mainly done with so-called analytics programs.

You’ll find detailed information about these analytics programs in the privacy policy below.

2. Hosting

We host the content of our website with the following provider:

Hetzner

The provider is Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany (hereinafter Hetzner).

For details, see Hetzner’s privacy policy: hetzner.com/legal/privacy-policy.

We use Hetzner on the basis of Art. 6(1)(f) GDPR. We have a legitimate interest in presenting our website as reliably as possible. If consent was requested, processing is based exclusively on Art. 6(1)(a) GDPR and § 25(1) TDDDG (German Telecommunications Digital Services Data Protection Act), insofar as the consent covers storing cookies or accessing information on the user’s device (e.g. device fingerprinting) within the meaning of the TDDDG. Consent can be withdrawn at any time.

Data processing agreement

We have concluded a data processing agreement (DPA) for the use of the service above. This is a contract required by data protection law that ensures the provider processes our visitors’ personal data only according to our instructions and in compliance with the GDPR.

3. General information and mandatory information

Data protection

The operators of these pages take the protection of your personal data very seriously. We treat your personal data confidentially and in accordance with the statutory data protection regulations and this privacy policy.

When you use this website, various personal data is collected. Personal data is data that can be used to identify you personally. This privacy policy explains what data we collect and what we use it for. It also explains how and for what purpose this happens.

Please note that data transmission over the internet (e.g. when communicating by email) can have security gaps. Complete protection of data against access by third parties is not possible.

Controller

The party responsible for data processing on this website is:

Tommaso Maiocchi
Gertrudenstr. 34c
21244 Buchholz
Germany

Email: info@mitplanlos.de

The controller is the natural or legal person who, alone or jointly with others, decides on the purposes and means of processing personal data (e.g. names, email addresses or similar).

Storage period

Unless a more specific storage period is stated in this privacy policy, your personal data stays with us until the purpose for processing it no longer applies. If you make a justified request for deletion or withdraw your consent to data processing, your data will be deleted unless we have other legally permitted reasons for storing it (e.g. retention periods under tax or commercial law); in that case, the data will be deleted once those reasons no longer apply.

General information on the legal bases for data processing

If you have consented to data processing, we process your personal data on the basis of Art. 6(1)(a) GDPR or Art. 9(2)(a) GDPR if special categories of data under Art. 9(1) GDPR are processed. If you have expressly consented to the transfer of personal data to third countries, processing is also based on Art. 49(1)(a) GDPR. If you have consented to the storage of cookies or to access to information on your device (e.g. via device fingerprinting), processing is additionally based on § 25(1) TDDDG. Consent can be withdrawn at any time. If your data is needed to perform a contract or to take steps prior to entering into a contract, we process it on the basis of Art. 6(1)(b) GDPR. We also process your data if this is necessary to comply with a legal obligation, on the basis of Art. 6(1)(c) GDPR. Processing may also be based on our legitimate interest under Art. 6(1)(f) GDPR. The legal bases relevant in each individual case are explained in the following paragraphs of this privacy policy.

Recipients of personal data

In the course of our business, we work with various external parties. In some cases, this also requires transferring personal data to these parties. We only pass on personal data to external parties if this is necessary to perform a contract, if we are legally obliged to do so (e.g. passing data to tax authorities), if we have a legitimate interest under Art. 6(1)(f) GDPR in passing it on, or if another legal basis permits it. When using processors, we only pass on our customers’ personal data on the basis of a valid data processing agreement. In the case of joint processing, a joint processing agreement is concluded.

Withdrawing your consent to data processing

Many data processing operations are only possible with your express consent. You can withdraw consent you have already given at any time. The lawfulness of the processing carried out until the withdrawal remains unaffected.

Right to object to data collection in special cases and to direct marketing (Art. 21 GDPR)

Right to lodge a complaint with the competent supervisory authority

In the event of violations of the GDPR, data subjects have the right to lodge a complaint with a supervisory authority, in particular in the member state of their habitual residence, their place of work or the place of the alleged violation. This right exists without prejudice to other administrative or judicial remedies.

Right to data portability

You have the right to have data that we process automatically on the basis of your consent or to perform a contract handed over to you or to a third party in a common, machine-readable format. If you request the direct transfer of the data to another controller, this will only be done where technically feasible.

Access, correction and deletion

Within the applicable legal provisions, you have the right at any time to free information about your stored personal data, its origin and recipients and the purpose of the processing, and, if applicable, a right to have this data corrected or deleted. You can contact us at any time about this or any other questions about personal data.

Right to restrict processing

You have the right to request that the processing of your personal data be restricted. You can contact us about this at any time. The right to restriction of processing applies in the following cases:

• If you dispute the accuracy of your personal data stored by us, we usually need time to check this. For the duration of the check, you have the right to request that the processing of your personal data be restricted.
• If your personal data was or is being processed unlawfully, you can request restriction of processing instead of deletion.
• If we no longer need your personal data but you need it to exercise, defend or establish legal claims, you have the right to request restriction of processing instead of deletion.
• If you have lodged an objection under Art. 21(1) GDPR, your interests and ours must be weighed. As long as it hasn’t been determined whose interests prevail, you have the right to request that the processing of your personal data be restricted.

If you have restricted the processing of your personal data, this data may – apart from being stored – only be processed with your consent or to establish, exercise or defend legal claims, to protect the rights of another natural or legal person, or for reasons of important public interest of the European Union or a member state.

SSL/TLS encryption

For security reasons and to protect the transmission of confidential content, such as requests you send to us as the site operator, this site uses SSL/TLS encryption. You can recognize an encrypted connection by the browser’s address bar changing from “http://” to “https://” and by the lock icon in your browser bar.

When SSL/TLS encryption is active, the data you send to us can’t be read by third parties.

4. Data collection on this website

Cookies

Our website uses so-called “cookies”. Cookies are small data packets and do no harm to your device. They are stored on your device either temporarily for the duration of a session (session cookies) or permanently (persistent cookies). Session cookies are deleted automatically at the end of your visit. Persistent cookies stay on your device until you delete them yourself or your browser deletes them automatically.

Cookies can come from us (first-party cookies) or from third-party companies (third-party cookies). Third-party cookies allow certain services of third-party companies to be integrated into websites (e.g. cookies for handling payment services).

Cookies have different functions. Many cookies are technically necessary because certain website features wouldn’t work without them (e.g. a shopping cart or displaying videos). Other cookies may be used to analyze user behavior or for advertising purposes.

Cookies that are necessary for electronic communication, to provide certain features you have requested, or to optimize the website (e.g. cookies for audience measurement) (necessary cookies) are stored on the basis of Art. 6(1)(f) GDPR, unless another legal basis is stated. The website operator has a legitimate interest in storing necessary cookies to provide its services in a technically error-free and optimized way. If consent to the storage of cookies and similar recognition technologies was requested, processing is based exclusively on this consent (Art. 6(1)(a) GDPR and § 25(1) TDDDG); consent can be withdrawn at any time.

You can set your browser to inform you when cookies are set and to allow cookies only in individual cases, to block cookies for certain cases or in general, and to delete cookies automatically when you close the browser. If cookies are disabled, the functionality of this website may be limited.

Cookies we use

Change cookie settings

You can change or withdraw your cookie consent at any time:

Google Tag Manager

This website uses Google Tag Manager, a service of Google Ireland Limited. Google Tag Manager itself does not process any personal data. It is only used to manage website tags (e.g. Google Analytics or Google Ads) in one place.

The services integrated via Google Tag Manager are only loaded after you have given consent through the cookie consent tool.

Google Analytics 4 (GA4)

This website uses Google Analytics 4, a web analytics service of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland.

Google Analytics uses cookies and similar technologies to analyze information about how this website is used and to create reports on website activity. Users’ IP addresses are shortened (IP anonymization), so they can’t be directly linked to a person.

The data is processed exclusively on the basis of your express consent under Art. 6(1)(a) GDPR.

Consent is obtained through the cookie consent tool on this website and can be withdrawn at any time.

The information collected by Google Analytics may be transferred to Google servers in the USA. For this transfer, Google uses the standard contractual clauses approved by the EU Commission under Art. 46 GDPR.

Google Ads conversion tracking with Consent Mode

We run ads through Google Ads, a service of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. To see whether an ad led to a sign-up, we use Google Ads conversion tracking. The only conversion we count is creating an account. We do not send your name, email address or the contents of your groups to Google.

We use Google Consent Mode (v2). The Google tag is loaded on every page, but always starts with ad and analytics storage set to “denied”. As long as you have not agreed to marketing cookies, no cookies are set and no advertising identifiers are read; click identifiers (such as the “gclid”) are also removed from the data. Google then only receives cookieless signals, for example that a page was viewed or a sign-up was completed. For technical reasons, your IP address, browser information, the page visited and the time are transmitted. Google uses these signals to estimate conversions statistically without linking them to a person. The legal basis is our legitimate interest in measuring the success of our advertising (Art. 6(1)(f) GDPR).

If you agree to marketing cookies in the cookie banner, Google sets the cookie _gcl_au (stored for 90 days). This allows a sign-up to be attributed to a click on an ad. The legal basis is then your consent under Art. 6(1)(a) GDPR and Section 25(1) TDDDG. You can withdraw your consent at any time in the cookie settings; the cookie is then deleted.

Data may be transferred to Google servers in the USA. Google is certified under the EU-US Data Privacy Framework; the standard contractual clauses under Art. 46 GDPR also apply. For more information, see Google’s privacy policy and business.safety.google/privacy.

Server log files

The provider of these pages automatically collects and stores information in so-called server log files, which your browser sends to us automatically. These are:

• Browser type and version
• Operating system used
• Referrer URL
• Host name of the accessing computer
• Time of the server request
• IP address

This data is not combined with other data sources.

This data is collected on the basis of Art. 6(1)(f) GDPR. The website operator has a legitimate interest in the technically error-free presentation and optimization of its website – for this, the server log files must be recorded.

Spam protection during sign-up (Cloudflare Turnstile)

When you create an account, we use Cloudflare Turnstile (Cloudflare, Inc., USA) to make automated sign-ups harder. For this, a small script from Cloudflare is loaded on the sign-up page. When you submit the form, we verify a token generated by Turnstile with Cloudflare on the server. Technical data (e.g. IP address, browser information) may be transmitted to Cloudflare. The legal basis is Art. 6(1)(f) GDPR (legitimate interest in protection against abuse and spam). Its use is technically required for signing up.

Newsletter and onboarding emails

When you create an account, the newsletter and getting-started tips are turned on at first. We use the newsletter for occasional news about PlanLos! (e.g. new features). The getting-started tips are short emails after you sign up. The legal basis for the newsletter is Art. 6(1)(f) GDPR (legitimate interest in informing you about the service) or – where consent is required – Art. 6(1)(a) GDPR; for onboarding emails it is Art. 6(1)(b) GDPR (use of your account). You can turn both off at any time in your account settings under notifications.

To send the newsletter and onboarding emails, we use Brevo (Sendinblue GmbH, Köpenicker Straße 126, 10179 Berlin, Germany). For this, we transmit your name, email address and your newsletter and getting-started settings to Brevo. Processing takes place under a data processing agreement in accordance with Art. 28 GDPR.

Inquiries by email, phone or fax

If you contact us by email, phone or fax, your inquiry including all resulting personal data (name, inquiry) will be stored and processed by us for the purpose of handling your request. We don’t pass this data on without your consent.

This data is processed on the basis of Art. 6(1)(b) GDPR if your inquiry is related to the performance of a contract or is necessary to take steps prior to entering into a contract. In all other cases, processing is based on our legitimate interest in effectively handling the inquiries sent to us (Art. 6(1)(f) GDPR) or on your consent (Art. 6(1)(a) GDPR) if it was requested; consent can be withdrawn at any time.

The data you send us through contact requests stays with us until you ask us to delete it, withdraw your consent to storage, or the purpose for storing the data no longer applies (e.g. after your request has been handled). Mandatory legal provisions – in particular statutory retention periods – remain unaffected.

5. External services

Instagram

We run a public profile on Instagram at instagram.com/mitplanlos. This website only contains links to it – no Instagram plugins, embeds or tracking pixels. When you click, you leave our website; the privacy policy of Meta Platforms Ireland Limited applies there.

Bunny Fonts

To display fonts consistently, this site uses so-called web fonts provided by Bunny Fonts (bunny.net). The provider is BunnyWay d.o.o., Cesta komandanta Staneta 4A, 1215 Medvode, Slovenia (EU).

When you open a page, your browser loads the required web fonts into its cache to display text and fonts correctly.

For this, your browser has to connect to the servers of BunnyWay d.o.o. in Slovenia (EU). This lets BunnyWay know that this website was accessed via your IP address. Web fonts are used on the basis of Art. 6(1)(f) GDPR. The website operator has a legitimate interest in a consistent typeface on its website. If your browser doesn’t support web fonts, a standard font from your computer is used.

More information about Bunny Fonts: fonts.bunny.net/faq and bunny.net/privacy.

← Back to the home page · Imprint