Privacy Policy ⋆ Format:perfekt!

With this privacy policy, we would like to inform you about the nature, scope and purpose of the processing of personal data (hereinafter also referred to as “data”). Personal data are all data that have a personal reference to you, e.g. name, address, e-mail address or your user behavior. The data protection information applies to all data processing operations carried out by us, both within the scope of our core activities and for the online media provided by us.

Person responsible for data processing

Florian Fani
c/o Block Services
Stuttgarter Str. 106
70736 Fellbach
Imprint: https://formatperfekt.de/impressum
datenschutz@formatperfekt.de

CONTACT

Which personal data we process and for which purposes

Unless otherwise stated in this privacy policy, the processing of your data and its disclosure to third parties is limited to those data that are necessary and appropriate to respond to your inquiries, to protect our rights and to comply with legal obligations. We will inform you which data is required for this before or in the course of data collection. Insofar as we use third-party providers to provide our services, the data protection notices of the respective third-party providers apply.

Data concerned:

When using this website: Usage and metadata such as the IP address and access time.
When contacting:
- Inventory data such as name and address
- Contact data such as e-mail address, telephone number and postal address
When donating via PayPal: payment data

Data subjects:

Visitors to this website
Customers and clients
Communication partners

Processing purposes:

Provision of user-friendly and secure online offers
Communication and answering of inquiries as well as contractual service provision
Office and organizational procedures
Server monitoring and security measures including firewall
Advertising and marketing (including measurements of reach, access numbers and conversion).

Legal basis:

The European Data Protection Regulation (GDPR, German: DSGVO) forms the authoritative basis for the processing of personal data within the EU. Within the framework of the legal requirements of the GDPR, the processing of your data is carried out in accordance with the following legally defined specifications:

Consent according to Art. 6 para. 1 p. 1 lit. a. GDPR: We may not process your data without having obtained your express permission for a specific purpose in advance.
Contract performance and pre-contractual requests pursuant to Art. 6 para. 1 p. 1 lit. b. GDPR: We may process your data if this is necessary for the (pre-)contractual provision of services with which you commission us.
Legitimate interests pursuant to Art. 6 para. 1 p. 1 lit. f. GDPR: Unless your rights and interests prevail, we may process your data to protect our legitimate interests.

In addition, national regulations for the protection of personal data apply, in Germany in particular the Federal Data Protection Act (BDSG).

Your rights according to GDPR

According to the GDPR, you have the following rights, which you can assert at any time with the above-mentioned responsible person (Florian Fani):

Right to information: You have the right to request information from us about whether and what data we process from you.
Right to rectification: You have the right to request the rectification of inaccurate or completion of incomplete data.
Right to erasure: You have the right to request the erasure of your data.
Right to restriction: in certain cases, you have the right to request that we only process your data in a restricted manner.
Right to data portability: You have the right to request that we transfer your data to you or another responsible party in a structured, common and machine-readable format.
Right of withdrawal: you have the right to withdraw your consent to data processing at any time.
Right to object: You have the right to object at any time to the processing of your data, which we base on our legitimate interest pursuant to Art. 6 (1) lit. f GDPR. If you exercise your right to object, we ask you to explain the reasons. We will then no longer process your personal data unless we can prove to you that compelling reasons worthy of protection for the data processing outweigh your interests and rights. Irrespective of the above, you have the right at any time to object to the processing of your personal data for purposes of advertising and data analysis. Please address your objection to the contact address of the data controller indicated above.
Right of complaint: you have the right to complain to a supervisory authority if you believe that the processing of personal data concerning you violates the provisions of the GDPR. The competent authority for the operator of this website is the Saxon Data Protection Officer Andreas Schurig (P.O. Box 11 01 32, 01330 Dresden or Devrientstraße 5, 01067 Dresden), telephone: 03 51 / 85471-101, fax: 03 51 / 85471-109, e-mail : saechsdsb@slt.sachsen.de, homepage : https://www.saechsdsb.de/.

How we protect your data

In addition to adhering to the principle of data economy, we have implemented adequate technical and organizational security measures to protect your personal data from manipulation, loss, destruction, unauthorized access based on a thorough analysis of the processing processes and data flows as well as the assessment of resulting risks. This includes physically and electronically controlled access to the data, but also encrypted data transmission via SSL protocol. Various other protection mechanisms are active on the website, which contribute to a high level of protection of the users’ personal data on the basis of Art. 6 (1) p. 1 lit. b and f GDPR and process metadata such as the IP address (shortened in accordance with GDPR and thus anonymized) for this purpose.

In addition, there is the contractual level of protection in the event that the transfer or disclosure of personal data is unavoidable. This may be the case with IT service providers who are necessarily integrated for the trouble-free operation of this website. Furthermore, this is the case if you write to us by post. In these cases, we take care to protect your data in accordance with the legal requirements. Processing contracts exist with the corresponding providers.

The data processing mainly takes place in Germany or within the EU. If processing takes place in a third country outside the EU or the European Economic Area (EEA), this is done in compliance with and in accordance with the legal requirements to ensure an adequate level of protection (Art. 44 to 49 GDPR, information page of the EU Commission: https://ec.europa.eu/info/law/law-topic/data-protection/international-dimension-data-protection_de).

When we will delete your data

On the one hand, we delete your data when we no longer need it, i.e. when the data processing purpose and thus the legal basis ceases to exist (Art. 6 (1) a GDPR) or we no longer have a legitimate interest in data processing (Art. 6 (1) f GDPR). On the other hand, your data will be deleted in response to a legitimate request for deletion if you exercise your right to object and there are no compelling reasons worthy of protection against the deletion or if you exercise your right of withdrawal and no other legal basis for processing within the meaning of Art. 6 (1) lit. b-f GDPR applies.

If, however, we still need to retain (certain parts of) your data for other purposes, because this is required, for example, by tax retention periods (usually 6 years for business correspondence or 10 years for accounting records) or the assertion, exercise or defense of legal claims arising from contractual relationships (up to four years), or if the data is needed to protect the rights of another natural or legal person, we will delete (the part of) your data only after these periods have expired. However, until the expiration of these periods, we limit the processing of this data to these purposes (fulfillment of retention obligations).

Data processing during the use of this website

By accessing this website in your browser, usage and communication data is inevitably collected. This includes, for example, access times, information about end devices used and your IP address. When contacting or during the payment process, further types of data are added.

Webhosting

To maintain our Internet pages, we use a provider on whose server our Internet pages are stored and made available for retrieval on the Internet (hosting). In this context, the provider may process all data transmitted via the browser used by you, which is generated during the use of our Internet pages. This includes, in particular, your IP address, which the provider needs to deliver our online offer to the browser you use, as well as all entries you make on our website. In addition, the provider we use may collect:

the date and time of access to our website
time zone difference from Greenwich Mean Time (GMT)
access status (HTTP status)
the amount of data transferred
the Internet service provider of the accessing system
the type of browser you are using and its version
the operating system you are using
the website from which you may have accessed our website
the pages or sub-pages that you visit on our website.

The aforementioned data is stored as log files on the servers of our provider. This is necessary to ensure the stability and security of the operation of our website.

Data concerned:

Content data (e.g. posts, photos, videos)
Usage data (e.g. access times, web pages clicked on)
Communication data (e.g. information about the device used, IP address)

Persons concerned: Users of our Internet presence

Processing purpose: Playing out our Internet pages, ensuring the operation of our Internet pages.

Legal basis: Legitimate interest, Art. 6 para. 1 lit. f GDPR.

Web hoster we use: will only be disclosed on request for security reasons.

Cookies

As far as possible, we refrain from using cookies on this website. These are small text files for communication between websites and your terminal device, which you can control via your browser settings.

The service providers involved in the provision of services may use cookies on their web services, but are required to inform you separately and obtain your consent.

Data concerned:

Usage data (e.g. access times, web pages clicked on).
Communication data (e.g. information about the device used, IP address).
Data subjects: Visitors and users of this website

Purpose of processing: improvement of online presence.

Legal basis:

Revocable consent pursuant to Art. 6 para. 1 lit. a GDPR.
Legitimate interest pursuant to Art. 6 (1) lit. f GDPR, unless consent is obtained.

Google Web Fonts

Our website uses so-called web fonts provided by Google LLC., 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA (Google) for the uniform display of fonts. When you call up a page, your browser loads the required web fonts into the browser cache in order to display texts and fonts correctly.

For this purpose, the browser you are using must connect to Google’s servers. This gives Google knowledge that our website has been accessed via your IP address. The use of Google Web Fonts is in the interest of a uniform and appealing presentation of our online offers and represents a legitimate interest within the meaning of Art. 6 (1) lit. f DSGVO. If your browser does not support web fonts, a standard font will be used by your computer.

You can find more information about Google Web Fonts at https://developers.google.com/fonts/faq and in Google’s privacy policy: https://www.google.com/policies/privacy/

Font Awesome

Our website uses so-called web fonts or icons for the uniform display of fonts or icons, which are provided by Fonticons, Inc. When you call up a page, your browser loads the required web fonts or icons into its browser cache in order to display texts, fonts and icons correctly.

For this purpose, the browser you are using must connect to the servers of Fonticons, Inc. This enables Fonticons, Inc. to know that our website has been accessed via your IP address. Font Awesome is used in the interest of a uniform and appealing presentation of our online offers. This represents a legitimate interest within the meaning of Art. 6 para. 1 lit. f DSGVO.

If your browser does not support Font Awesome, a standard font from your computer will be used. You can find more information about Font Awesome at https://fontawesome.com/help and in the privacy policy of Fonticons, Inc: https://fontawesome.com/privacy.

Content Delivery Network

We use a content delivery network (CDN) to serve our web pages. A CDN is a network of regionally distributed servers connected via the Internet. The CDN provides scaling storage and delivery capacities. This optimizes the loading times of our Internet pages and ensures optimal data throughput even during large load peaks. User requests on our Internet pages are routed via servers of the CDN. Statistics are created from these data streams. On the one hand, this serves to detect potential threats to our Internet pages from malware at an early stage and, on the other hand, to continuously improve our offer and make our Internet pages more user-friendly for you as a user.

We would like to point out that, depending on the country of domicile of the service provider mentioned below, the data collected via the service may be transmitted and processed outside the area of the European Union. In this case, there is a risk that the level of data protection prescribed by the GDPR may not be complied with and that the enforcement of your rights may not be possible or may be difficult.

Data Concerned:

Content data (e.g. posts, photos, videos)
Usage data (e.g. access times, web pages clicked on)
Communication data (e.g. information about the device used, IP address)
Data subjects: Users of our Internet presence

Purpose of processing: technical optimization of the Internet presence, analysis of errors and user behavior

Legal basis: Legitimate interest, Art. 6 para. 1 lit. f GDPR

CDN service provider used:

Cloudflare

Service provider: Cloudflare Inc., 101 Townsend St., San Francisco, CA 94107, USA
Website: https://www.cloudflare.com/
Privacy Policy: https://www.cloudflare.com/privacypolicy/
Scope of Data Collection: https://blog.cloudflare.com/what-cloudflare-logs/

Contacting us and e-mail correspondence

If you contact us via e-mail, social media, telephone, mail, our contact form or otherwise and in doing so provide us with personal data such as your name, telephone number or e-mail address, or provide further information about yourself or your request, we will process this data to respond to your inquiry within the scope of the pre-contractual or contractual relationship existing between us.

Data concerned:

Usage data (e.g. IP address)
Inventory data (e.g. names, addresses)
Contact data (e.g. e-mail address, telephone number, postal address)
Content data (texts, photos, videos)
Contract data (e.g. subject matter of the contract, duration of the contract)

Data subjects: Interested parties, customers, communication partners

Purpose of processing: communication as well as answering contact requests, office and organization procedures.

Legal basis: contract performance and pre-contractual inquiries, Art. 6 para. 1 lit. b GDPR, legitimate interest, Art. 6 para. 1 lit. f GDPR.

When exchanging e-mails via the e-mail addresses specified in the imprint and in this privacy policy and when contacting us via the contact form, your data may be processed on cloud servers of Google as a third-party provider. This concerns not only usage and metadata, which inevitably arise and are processed, among other things, to secure servers, but also other data such as your e-mail address and name as well as exchanged media. In this case, it should be noted that the servers may be located outside the EU, so that compliance with a level of data protection prescribed by the GDPR and the enforcement of your rights may not be possible or may be difficult.

The legal basis for this processing is your consent according to Art. 6 (1) lit. a GDPR by ticking the checkbox when sending your request, the purpose of fulfilling the contract and processing pre-contractual requests according to Art. 6 (1) lit. b GDPR as well as our legitimate interest according to Art. 6 (1) lit. f GDPR to offer you a reliable contact option with reasonable effort.

Service provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland.
Parent company: Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA.
Website: https://cloud.google.com/
Privacy Policy: https://www.google.com/policies/privacy

Data processing within the scope of core business activities

Your data is processed for the pre-contractual or contractual provision of services. Affected are, on the one hand, your contact data for communication and organization and, on the other hand, files that we jointly process or create for you. As listed below, other types of data may also be affected. The following information also applies to the exchange via the internal login area on this website (self-hosted software).

Data processing in this case is basically based on the purpose and requirements. The type, scope and purpose of the processing of your data depend on the pre-contractual or contractual relationships existing between us.

Within the collaboration network, we take care to protect your personal data through the following measures: In principle, we act according to the principles of Privay by Design and Default, i.e. also data economy in internal communication and anonymization as far as practicable. The members of the network have mutually signed order data processing agreements and are subject to the high data protection requirements of the EU-DSGVO. In addition, however, this data protection notice concerns processing by Florian Fani, while the other members of the network act as independent actors and are responsible for their own data processing, so that the associated risks for end customers can be excluded here.

For the purpose of organization, administration, planning and service provision, we use services, platforms and software from third-party providers. In this context, data transmission to third parties is also possible, such as payment institutions in the context of payment transactions, service providers commissioned with IT tasks or providers of services and content that are integrated into a website. In such cases, we comply with the legal requirements and conclude appropriate contracts with the processors to protect your data.

In addition, the following applies: Unless otherwise stated in the further data protection information, the processing of your data and its transfer to third parties is limited to those data that are necessary and appropriate to answer your inquiries and/or to fulfill the contract concluded between you and us, to protect our rights and to fulfill legal obligations.

We will inform you which data is required for this before or in the course of data collection. Insofar as we use third-party providers for the provision of services, the data protection notices of the respective third-party providers apply.

Data concerned:

Contact data (e.g. name, address)
Inventory data (e.g. e-mail, telephone number)
Content data (e.g. text input, text files)
Payment data (e.g. bank details, invoices)
Contract data (e.g. subject matter of contract, duration of contract)
Usage and metadata (e.g. devices used, operating system installed, IP address).

Data subjects: Interested parties and communication partners, business and contractual partners, users and coachees.

Purpose of processing: provision of pre-contractual and contractual services, communication as well as answering contact requests, office and organizational procedures.

Legal basis: consent (Art. 6 para. 1 p. 1 lit. a GDPR), contract performance and pre-contractual inquiries (Art. 6 para. 1 lit. b GDPR), legal obligation (Art. 6 para. 1 lit. c GDPR), legitimate interest (Art. 6 para. 1 lit. f GDPR).

Based on the above processing purposes and legal bases, the following supplementary notes on the services and auxiliary tools used for planning, organization, administration, communication and collaboration should be noted:

Data handling

The processed files may allow conclusions to be drawn about your person through their content or metadata, especially as they are processed by us in the context of other personal data. The exchange of files takes place primarily via the internal login area via our server. For sending files via e-mail or contact form, the instructions in the section “E-mail traffic” apply.

For larger files, the use of WeTransfer is possible:

Service Provider: WeTransfer B.V., Oostelijke Handelskade 751, Amsterdam 1019 BW, The Netherlands.
Website: https://wetransfer.com/
Privacy Policy: https://wetransfer.com/legal/privacy
Terms of Use: https://wetransfer.com/legal/terms

Storage and deletion periods: In principle, the data should be deleted after the purpose of the data processing has been fulfilled. We process your files exclusively on secured computer systems and delete them from our hard drives within three months of order completion. Earlier deletion is possible if you inform us after the project completion that your files should be deleted immediately. As far as storage with the above-mentioned service providers is concerned, we refer to their terms and conditions of use and data protection information. We would also like to point out that complete and complete deletion of all data traces within the aforementioned storage and deletion period cannot be technically guaranteed, as this would require the hard drives to be physically destroyed at considerable expense.

Booking appointments

Appointment bookings are made via our servers using self-hosted software. Processing on the servers of the booking tool provider therefore does not take place.

Appointments are primarily communicated by e-mail. The e-mail transmission takes place via Google servers, whereby the notes mentioned in the following section apply.

E-mail correspondence

When exchanging e-mails and contacting us via the contact form, your data may be processed on cloud servers of Google as a third-party provider. This concerns not only usage and metadata, which inevitably arise and are processed, among other things, to secure servers, but also other data such as your e-mail address and name as well as exchanged media.

In this case, it should be noted that the servers may be located outside the EU, so that compliance with a level of data protection required by the GDPR and the enforcement of your rights may not be possible or may be difficult. This also applies to the servers of Microsoft if we cooperate via OneDrive (see privacy notices of the service providers mentioned below for more information).

The legal basis for this processing is your consent pursuant to Art. 6 (1) lit. a GDPR by ticking the checkbox when sending your request, the purpose of fulfilling the contract and processing pre-contractual requests pursuant to Art. 6 (1) lit. b GDPR and our legitimate interest pursuant to Art. 6 (1) lit. f GDPR to offer you a reliable and fast contact option with reasonable effort.

When booking appointments, we cannot exclude that your contact data is stored on our work devices and/or in our Google calendars and thus processed on Google servers, including your phone number. You can also optionally save the booked appointment in your Google calendar. In both cases, Google’s privacy notices apply.

Service provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland.
Parent company: Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA
Website: https://workspace.google.com/
Privacy Policy: https://policies.google.com/privacy

SMS and messenger services

SMS is exchanged (encrypted if desired) via Signal. Signal or Telegram can be used as messengers. Both enable end-to-end encryption of messages with the corresponding settings.

Signal

Service provider: Privacy Signal Messenger, LLC 650 Castro Street, Suite 120-223 Mountain View, CA 94041, USA
Website: https://signal.org/de
Privacy Policy: https://signal.org/legal/

Service Provider: Telegram, Dubai
Website: https://telegram.org/
Privacy Policy: https://telegram.org/privacy

Cloud Services

Google Cloud

Service Provider: Google Ireland Limited, Gordon House, Barrow Street, Du lin 4, Irland
Parent Company: Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA
Website: https://cloud.google.com/
Privacy Policy: https://www.google.com/policies/privacy

Microsoft OneDrive

Service Provider: Microsoft Corporation, One Microsoft Way, Redmond, WA 98052-6399 USA
Website: https://www.microsoft.com/de-de/microsoft-365/onedrive/online-cloud-storage
Privacy Policy: https://privacy.microsoft.com/de-de/privacystatement

Online meetings, video conferencing and screen sharing

We use third-party offerings to facilitate online meetings, conference calls via video and/or audio circuit, and online seminars among employees and with prospects or customers. If you communicate with us via such a service, the data collected in this communication process will be processed both by us and by the third-party provider. The data that may be generated in such a communication process includes, in particular, your login and contact information, posts in the chat window, your video and audio posts, and shared screen content. The data processed by the third-party provider we use primarily includes user data as well as metadata (e.g., IP address, computer system information). As a rule, the third-party providers process this data in order to check and ensure the security of the service. In addition, findings from the data processing are to be used to optimize the third-party provider’s offer and to carry out corresponding marketing measures. Please refer to the data protection information of the third-party provider in this regard.

Data concerned:

Inventory data (e.g. names, addresses)
Contact information (e.g., email address, phone number)
Shared content (e.g. photos, videos, texts, audio recordings)
User data (e.g. times of access, web pages visited, interest in content)
Meta and communication data (e.g. IP address, computer system information).

Data subjects: Interested parties, customers, communication partners

Purpose of processing: processing of contact requests, internal and external communication with employees as well as interested parties and customers, fulfillment of our contractual services, service offer

Legal basis: consent, Art. 6 para. 1 lit. a GDPR, contract performance and pre-contractual inquiries, Art. 6 para. 1 lit. b GDPR, legitimate interest, Art. 6 para. 1 lit. f GDPR.

Services we use for video conferencing with screen sharing, voice conferencing and chats

Zoom

Service Provider: Zoom Video Communications, Inc, 55 Almaden Boulevard, 6th Floor, San Jose, CA 95113, USA.
Website: https://zoom.us/de-de/meetings.html
Privacy Policy: https://zoom.us/de-de/privacy.html

Jitsi

As a more privacy-friendly alternative on servers in Germany without IP logging, we also use Jitsi on the server of IT security lecturer Tobias Scheible at Hetzner:

Service Provider: Tobias Scheible
Website: https://meet.scheible.it/
Privacy Policy: https://scheible.it/datenschutzhinweis/

Jitsi is a trademark of 8×8, Inc.

Service Provider: 8×8, Inc., 675 Creekside Way, Campbell, CA 95008, USA
Website: https://meet.jit.si/
Privacy Policy: https://jitsi.org/meet-jit-si-privacy/

Payments

For payment processing, banks, credit institutions and other payment service providers process personal data, which, in addition to inventory data such as name and address, includes in particular payment data/banking data, e.g. account/credit card number, password, TAN, check digit as well as information on the concluded contract and payee.

The data collected in this context is necessary to enable the payment service provider to process the payment. At no time do we receive information about your account or credit card details. We are informed by the payment service provider whether or not our clients’ payment has been received.

It is possible that our payment service providers forward my clients’ data to credit information files in order to be able to check the identity as well as the creditworthiness of the payer. Details on this can be found in the privacy policy and the general terms and conditions (GTC) of the payment service providers. For further information and for the assertion of your rights regarding revocation and information, we refer to the provisions of the respective service provider.

Data concerned:

Inventory data (e.g. name, address),
Usage data (e.g. Internet pages visited, interest in certain topics, times of access),
Payment data (e.g. bank details, invoices, payment history),
Business transaction data (e.g. term, customer category, subject of contract),
communication and metadata (e.g. IP address, information about the device or computer system).

Purpose of processing: effective, secure and customer-oriented payment offers (service) as well as processing of payments according to contractual agreement

Legal basis: contract performance and fulfillment of pre-contractual requests (Art. 6 para. 1 lit. b GDPR), legitimate interest (Art. 6 para. 1 lit. f GDPR).

Revocation options: You can revoke your consent to the use of personal data at any time vis-à-vis the respective payment service provider. Despite revocation, the payment service provider may still be entitled to process, use and transmit the personal data that is absolutely necessary for the contractual processing of payments. With regard to the storage and timely deletion of personal data, we refer to the respective data protection provisions of the payment service provider.

In addition to our house bank, a savings bank, we use the following payment service providers to enable fast digital payment processing:

PayPal

Service Provider: PayPal (Europe) S.à.r.l. et Cie, S.C.A., 22-24 Boulevard Royal, 2449 Luxembourg.
Website: https://www.paypal.com/de/webapps/mpp/home
Privacy Policy: https://www.paypal.com/de/webapps/mpp/ua/privacy-full#

Stripe

Service Provider: Stripe Inc, 510 Townsend Street, San Francisco, CA 94103, USA
Website: https://stripe.com/de
Privacy Policy: https://stripe.com/de/privacy

Ratings

Ratings and reviews are an integral part of our communication with prospective customers and customers. The rating platform used by us processes in particular the IP address and your e-mail address specified in the rating for the purpose of verifying your rating. For the processing of further data, we refer to the privacy policy of the provider ProvenExpert.

Service provider: Expert Systems AG, Quedlinburger Straße 1, 10589 Berlin, Germany.
Website: https://www.provenexpert.com/de-de/
Privacy policy: https://www.provenexpert.com/de-de/datenschutzbestimmungen/

Actuality and change

This data protection notice is currently valid (as of July 2022).

Due to changes in legal or regulatory requirements or due to the further development of our offers, it may become necessary to adapt this data protection notice.

This privacy policy was created with the help of the data protection generator of SOS Recht and adapted by us. SOS Recht is a service of Mueller.legal Rechtsanwälte Partnerschaft, based in Berlin.

This is a translation as a courtesy to our English-speaking customers. In case of doubt, the original document in German shall prevail.