Privacy policy

Controller

Synafloat GmbH, c/o BITZ, Fahrenheitstraße 1, 28359 Bremen, Germany. Commercial register: Amtsgericht Bremen, HRB 43235 HB. Represented by its Managing Director, Dr. Michael Blank.

Email: [email protected]

We have not appointed a data protection officer because the legal requirements for this (Art. 37 GDPR, § 38 BDSG) are not met. Please send questions about data protection to [email protected].

Hosting and delivery of the website

This website is hosted by Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany. The server is located in a data centre in Finland, within the EU. Hetzner processes the data on our behalf under a data processing agreement pursuant to Art. 28 GDPR.

When you visit the website, the server processes technically necessary data: IP address, date and time, requested address, referrer, browser and operating system. This serves the secure and stable delivery of the website, which is our legitimate interest (Art. 6(1)(f) GDPR). The web server's access logs are kept for up to 14 days and then deleted; the application's logs after 7 days.

To protect the contact form against mass requests, the server may briefly hold a sender's IP address in memory to limit the number of requests. The address is not stored permanently for this purpose; the entry expires after 60 seconds (Art. 6(1)(f) GDPR).

The Cloudflare service sits between your browser and our server (Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107, USA). Cloudflare forwards requests, protects the website against attacks and speeds up delivery. In doing so, Cloudflare processes your IP address and the technical data of the request on our behalf. Cloudflare operates a global network, so the data may also be processed in the USA. For the USA, an adequacy decision of the European Commission applies (EU-US Data Privacy Framework, Art. 45 GDPR), under which Cloudflare, Inc. is certified. Should this decision cease to apply, the European Commission's standard contractual clauses agreed in our data processing agreement with Cloudflare apply (Art. 46(2)(c) GDPR). The legal basis is Art. 6(1)(f) GDPR; our legitimate interest is a secure and fast website.

The fonts on this website are loaded from our own server. We do not embed content from other providers, such as videos, maps or scripts.

Contact form and email

When you write to us via the contact form, we process your name, your email address, depending on the enquiry type your company or organisation, the topic and your description, and any optional details you provide (such as your role, the timeframe, and details on your process, your question and your measurement options). We also store the enquiry type you chose, the language of the page, the time of submission and a coarse indication of how you found us (such as “search engine” or “direct”). Your browser derives this indication from the page you visited before; we do not store that page's address. When you email us, we process your email address and the content of your message.

We use this data to answer your enquiry. The legal basis is Art. 6(1)(b) GDPR where your enquiry concerns a contract, otherwise Art. 6(1)(f) GDPR. Our legitimate interest is to answer your enquiry and to maintain business contacts.

Based on your details on enquiry type, timeframe and measurement options, we automatically assign each enquiry an internal handling order. This is not a decision with legal or similarly significant effects; a person reads and answers every enquiry.

We store form enquiries in our customer management system EspoCRM, which we operate ourselves on our own server in the EU, and additionally send a copy to our business mailbox. The server is hosted by Hetzner Online GmbH in a data centre in Nuremberg. The transfer from the web server to EspoCRM runs over an encrypted connection (WireGuard) between our own servers; no third party is involved. Our mailboxes are hosted on our behalf by STRATO GmbH, Otto-Ostrowski-Straße 7, 10249 Berlin, Germany, under a data processing agreement pursuant to Art. 28 GDPR.

We send the form copy to our mailbox with transport encryption (TLS). Emails you send us directly are usually encrypted in transit as well, but not end-to-end. Please do not send us confidential documents by email.

We delete enquiries in the CRM and the mailbox once they are settled, at the latest 24 months after the last contact. If an enquiry leads to a contract, we keep the business correspondence for as long as commercial and tax law require (§ 257 HGB, § 147 AO; usually six to ten years).

Email updates on the development of the platform

In the contact form, you can also tick a box to receive email updates on the development of our platform. The platform is in development. The box is voluntary and not ticked in advance. We handle your enquiry without this consent as well.

We then use your email address to send you updates on the development of the platform. The legal basis is your consent (Art. 6(1)(a) GDPR). It is also your consent to receiving these emails under § 7(2) no. 2 UWG.

We add your address only once you confirm your consent (double opt-in). For this, we send you an email with a confirmation link after you submit the form. The link is valid for 7 days. It contains your email address, the language, the time of your enquiry, the link's expiry date and the version of the consent text, protected against changes by a signature. Because the address is part of the link, it also appears in the web server's access logs when you open it (see “Hosting and delivery of the website”). The confirmation is subject to the same short-term request limit as the contact form. If you do not confirm, we do not add your address.

When you confirm, we receive an email as evidence of your consent (Art. 7(1) GDPR). It contains your email address, the language, the times of enquiry and confirmation, and the version and wording of the consent text. We keep this evidence in our business mailbox. We add your email address to our mailing list. We do not store your IP address for this. We do not track whether you open our emails or follow links in them.

We send the updates ourselves from our own mailbox, as a blind copy (Bcc), so recipients do not see each other. We do not use a newsletter service or any other mailing service provider. The mailbox is hosted by STRATO GmbH (see “Contact form and email”).

Your address stays on the mailing list until you withdraw your consent. We keep the evidence of the consent for up to three years afterwards so that we can prove it. The legal basis for this is Art. 6(1)(f) GDPR; our legitimate interest is proving the consent.

You can withdraw your consent at any time with effect for the future, for example by replying to one of our emails or by email to [email protected]. This does not affect the lawfulness of the processing before the withdrawal (Art. 7(3) GDPR).

Online appointment booking

At book.synafloat.com you can book a call with us. There we run our own booking tool, Easy!Appointments. It runs on our own server at Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany, in a data centre in Finland. This is the same server that hosts this website. The section “Hosting and delivery of the website” applies to the access logs of the booking page; the Cloudflare service is not placed in front of the booking page.

For a booking, we process your first and last name, your email address, your company and, if you provide it, your phone number. We also process the type of call you chose, the date you chose and your short note. Please do not put confidential information in the note. When you confirm the privacy notice, the tool stores this confirmation with the time and your IP address. Together with the confirmation, it also stores your first and last name and your email address.

We use this data to prepare and hold the call and to manage the appointment. The legal basis is Art. 6(1)(b) GDPR where the call concerns a contract, otherwise Art. 6(1)(f) GDPR. Our legitimate interest is to answer enquiries and to maintain business contacts. We store the confirmation of the privacy notice as evidence that we informed you (Art. 5(2) GDPR); the legal basis is Art. 6(1)(f) GDPR.

The booking tool writes the appointment into our calendar. The calendar is kept in our own Nextcloud on our own server at Hetzner Online GmbH in Nuremberg. The transfer runs encrypted over the private network between our servers at Hetzner.

We send the confirmation and cancellation from [email protected] through our mailbox at STRATO GmbH, Otto-Ostrowski-Straße 7, 10249 Berlin, Germany. STRATO operates the mailbox on our behalf under Art. 28 GDPR (see “Contact form and email”). You can cancel or move the appointment via the link in the email.

The booking page sets only technically necessary cookies, for the session and to protect the form (§ 25(2) no. 2 TDDDG). No consent is required for them. The booking page embeds no analytics services and no content from other providers. Our own server generates the image captcha against spam. These cookies apply only to book.synafloat.com. This website itself still sets only the NEXT_LOCALE cookie (see “Cookies and local storage”).

A daily automatic job deletes the booking data three months after the appointment, including the stored confirmation of the privacy notice. The entry in our calendar holds the date, your name and your contact details. It, the confirmation emails in our mailbox and anything that becomes an enquiry or a contract follow the periods in “Contact form and email”. These are 24 months after the last contact and, for contracts, the statutory retention periods.

We back up the booking tool's data on our server and, in encrypted form, on a storage account at Hetzner in the EU. We keep the backups for up to 12 months. The same applies to the backups of our Nextcloud, which holds the calendar. We use backups only to restore the service. The legal basis is Art. 6(1)(f) GDPR; our legitimate interest is the security and availability of the service.

Video calls with Nextcloud Talk

Only if you choose a video call when booking does the confirmation contain a link to a guest room in Nextcloud Talk. Nextcloud Talk runs in our own Nextcloud. This is the same server at Hetzner Online GmbH in Nuremberg that also holds the calendar.

You do not need an account. You choose a display name and wait in a lobby until we admit you to the call. During the call, we process your display name, your IP address, audio, video and chat messages. Audio and video run encrypted through our own server. Chat messages are deleted after one hour. We do not record the call. Your IP address and display name also appear in the logs of this server and are deleted there after 14 days at the latest.

The legal basis is Art. 6(1)(b) GDPR where the call concerns a contract, otherwise Art. 6(1)(f) GDPR. Our legitimate interest is to answer enquiries, to maintain business contacts and to run the server securely. Instead of a video call, we can also talk by phone. You can also invite us into your own video tool. In that case, that provider's privacy terms apply.

Cookies and local storage

This website sets a single cookie: NEXT_LOCALE. It stores your language choice (“de” or “en”), contains no identifier and is deleted when you close your browser. It is strictly necessary to show the website in the language you chose (§ 25(2) no. 2 TDDDG); no consent is required. We store no other data in your browser. The booking page book.synafloat.com sets its own technically necessary cookies (see “Online appointment booking”). We set no analytics or advertising cookies and use no analytics services.

Your rights

You have the right of access (Art. 15 GDPR), rectification (Art. 16 GDPR), erasure (Art. 17 GDPR), restriction of processing (Art. 18 GDPR) and data portability (Art. 20 GDPR). To exercise them, write to [email protected].

Right to object (Art. 21 GDPR)

You have the right to object at any time, on grounds relating to your particular situation, to the processing of your data that we base on Art. 6(1)(f) GDPR. We will then stop processing the data unless we can demonstrate compelling legitimate grounds that override your interests, rights and freedoms, or the processing serves the establishment, exercise or defence of legal claims.

If we process your data for direct marketing, you can object to this at any time without giving reasons. An informal objection to [email protected] is sufficient.

Right to lodge a complaint

You can lodge a complaint with a data protection supervisory authority (Art. 77 GDPR). The authority responsible for us is:

The State Commissioner for Data Protection and Freedom of Information of the Free Hanseatic City of Bremen (Der Landesbeauftragte für Datenschutz und Informationsfreiheit der Freien Hansestadt Bremen), Georgstraße 122–124, 27570 Bremerhaven, Germany, email: [email protected]

No obligation to provide data, no automated decisions

You are not obliged to give us any data. Without contact details, however, we cannot answer an enquiry. No automated decision within the meaning of Art. 22 GDPR takes place.