EN
DE EN PL
Client area

WebsiteGarage

Privacy Policy

PRIVACY POLICY

DND Solutions / WebsiteGarage.de

Privacy information for website visitors, prospective customers, business customers and contacts

1. Scope

This Privacy Policy explains how personal data is processed in connection with WebsiteGarage.de. It applies in particular to visitors to the website and Newsroom, prospective customers, users of contact, quotation, project and account functions, as well as customers, their representatives, employees and contacts.

It describes processing for which DND Solutions itself is the controller within the meaning of the GDPR. Where DND Solutions processes personal data exclusively on behalf of a customer, that processing is governed by the applicable data processing agreement (AVV), the incorporated technical and organisational measures (TOM), and the Subprocessor Annex applicable to the engagement.

2. Controller

The controller within the meaning of the General Data Protection Regulation (GDPR) is:

Dagmara Brzezinska

trading under the business name DND Solutions

Fuchsbreite 39

37181 Hardegsen

Germany

Email: [email protected]

WebsiteGarage.de is an online service operated by DND Solutions.

3. Principles and legal bases

We process personal data only for specified purposes and only where there is a legal basis for doing so. Depending on the processing, the following legal bases may apply in particular:

  • Article 6(1)(a) GDPR where consent is given voluntarily.
  • Article 6(1)(b) GDPR for pre-contractual measures or the performance of a contract.
  • Article 6(1)(c) GDPR for compliance with legal obligations.
  • Article 6(1)(f) GDPR for the purposes of legitimate interests, provided that these are not overridden by the interests or fundamental rights of the data subject.

Where information is stored on or read from a terminal device, permissibility is additionally governed by Section 25 TDDDG. The specific legal basis is stated for the respective processing operations. Article 6(1)(b) GDPR is applied only where the data subject is itself a party to the contract or pre-contractual measures are taken at the data subject's request. For employees, representatives and other contacts of a business customer, we generally base processing for the initiation, performance and organisation of the business relationship on Article 6(1)(f) GDPR unless a more specific legal basis applies. Where processing is based on Article 6(1)(f) GDPR, our legitimate interests, depending on the operation, include in particular the secure and stable provision of our systems, protection of accounts and infrastructure, handling and documenting business communications, prevention of misuse and fraud, evidentiary purposes and legal defence, and proper and efficient business organisation. The interest relevant to the respective operation follows from the purpose described for that operation.

4. Visiting the website, Newsroom and technical provision

When WebsiteGarage.de is accessed, technically necessary connection and access data are processed, in particular IP address, date and time, requested URL or resource, referrer where transmitted, browser and operating system information, HTTP headers, connection data and security-relevant log data.

The processing serves technical provision, stability, error analysis, IT security and protection against abusive or automated access. The legal basis is Article 6(1)(f) GDPR.

The hosting provider is netcup GmbH. The production server location is Vienna, Austria. Server logs are normally stored for 14 days; security-relevant log data may be stored for up to 90 days. Longer storage may be necessary in the event of a specific security incident.

5. Backups and backup storage at Hetzner

To ensure availability and recoverability, we create backups and store them in the infrastructure of Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany. The backup storage used for WebsiteGarage.de is located in Germany.

Depending on the scope of the backup, website and application files, database backups, configuration data, customer account, order, contract and technical data may be included. The legal basis is Article 6(1)(f) GDPR. Backups are generally retained on a rolling basis for 30 days and are then overwritten or deleted unless a specific incident, recovery measure or legal obligation requires longer storage.

6. Cloudflare

WebsiteGarage.de uses Cloudflare as upstream network and security infrastructure. The provider is Cloudflare, Inc., 101 Townsend Street, San Francisco, CA 94107, USA.

Data processed may include in particular the IP address, requested URL or resource, date and time, HTTP headers, browser and device information, referrer, connection and TLS information, and security and event data. The purposes are the secure and performant delivery of the website and the prevention and analysis of attacks, overload, spam, bots and other misuse. The legal basis is Article 6(1)(f) GDPR.

Where individual security functions store information on or read information from a terminal device, this takes place without consent only if the specific function meets the requirements of Section 25(2) TDDDG.

Cloudflare operates globally distributed infrastructure. Transfers to Cloudflare, Inc. in the USA are based on Article 45 GDPR where the requirements of the European Commission adequacy decision concerning the EU-U.S. Data Privacy Framework are met. Where no applicable adequacy decision exists, the Cloudflare Data Processing Addendum provides in particular for EU Standard Contractual Clauses and additional safeguards.

7. Forge12 Security

We use Forge12 Security to protect WebsiteGarage.de, customer accounts and the technical infrastructure. The processing serves in particular to detect and prevent attacks, limit abusive access and reconstruct security-relevant events. The legal basis is Article 6(1)(f) GDPR. Our legitimate interest lies in the secure, stable and available operation of our systems and in protecting accounts and personal data.

IP addresses are stored in the local Forge12 security tables exclusively as non-reversible hash values. Raw IP addresses are not stored there.

The security log may process, in addition to the IP hash, in particular the WordPress user ID for logged-in users, event type, severity, description, date and time. These data are automatically deleted after 90 days by scheduled tasks.

For IP blocks, data processed include in particular the IP hash, reason for the block, where applicable country code, and the time the block was set and expires. Temporary blocks are automatically deleted when they expire; manually set blocks remain until they are lifted.

The live-access display processes in particular IP hash, requested address, HTTP method, referrer, User-Agent, where applicable WordPress user ID, and country and, where enabled, city. These data are automatically deleted after 24 hours.

For request rate limiting, the IP hash, request counter and the associated time window are processed. The data are discarded when the relevant time window expires and are not retained beyond that point.

File and database checks store in particular technical results such as file paths, checksums and findings. These generally concern the system's own files and content. Where a database finding quotes an affected record and that record contains personal data, such data may exceptionally form part of the finding. Findings are removed once they are no longer detected by a subsequent check or after the affected file or record has been corrected.

The external SilentShield service is not activated in the current configuration. Accordingly, no transfer of personal data to Forge12 or to a subprocessor used for this purpose is currently triggered by SilentShield. Before any later activation, the data types, purposes, legal bases, recipients, any international data transfers and the information required under the GDPR and TDDDG will be reassessed; this Privacy Policy will be updated before activation where necessary.

 

8. Cookies, local storage technologies and consent management

WebsiteGarage.de distinguishes between technically necessary storage or access operations and optional functions. Where consent is required, the relevant function is activated only after valid consent has been obtained. Consent can be changed or withdrawn at any time with effect for the future.

We use our self-hosted Consent Hub to manage and document consent. The Consent Hub stores the information needed in the browser to remember and apply the user's choice. This includes the current decision and a pseudonymous identifier used to associate related consent events. If consent evidence cannot be sent to the Consent Hub immediately, it may be held temporarily in the browser until transmission succeeds.

 

For server-side consent documentation, we record in particular the pseudonymous consent identifier, the decision made and its timestamp, the language used, the applicable configuration and consent versions, the services selected, and evidence of which consent interface and information were shown. We do not store full IP addresses, User-Agent strings or data used to create a device fingerprint for this purpose. This processing is based on Article 6(1)(c) GDPR where it is necessary to meet statutory evidentiary and accountability obligations, and additionally on Article 6(1)(f) GDPR. Our legitimate interest is to maintain a reliable record of consent, refusals and withdrawals and to ensure that those choices are implemented correctly.

 

The consent decision is normally stored in the browser for 120 days. The pseudonymous consent identifier may remain in local browser storage until the user clears the website data stored for WebsiteGarage.de. Server-side consent documentation is currently not subject to automatic deletion after a fixed period; a defined retention and deletion policy is planned.

Google Analytics 4 runs in Basic Consent Mode and is technically blocked until valid consent has been obtained. Before consent is given, the Google Analytics tag is not loaded and no measurement data are sent to Google.

9. Google Analytics 4

WebsiteGarage.de uses Google Analytics 4 only after prior consent for voluntary reach and usage analysis. The provider for European users is in particular Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland; further processing may involve companies of the Google group, in particular Google LLC in the USA.

After consent, data processed may include in particular page views, URL and page title, interactions and events, time and duration, referrer, browser and device information, language and approximate location information. The purposes are reach measurement and the improvement of structure, content and user guidance. The legal bases are Section 25(1) TDDDG and Article 6(1)(a) GDPR.

WebsiteGarage.de uses Basic Consent Mode. Google Analytics tags are not loaded before consent is given. Advertising features, Google Signals, User-ID and user-provided data are not used in the current configuration. Retention is set to 14 months for user-level data and 2 months for event data. According to Google, these settings apply to user-level and event-level retention respectively; standard aggregated reports are not affected.

Where data are processed outside the EEA, Articles 44 et seq. GDPR apply. Google LLC declares its participation in the EU-U.S. Data Privacy Framework; where it applies, a transfer may be based on it, otherwise the applicable contractual transfer mechanisms apply.

10. Contact, email and business communication

If you contact us via a contact form, by email or through another communication channel we provide, we process the data submitted in order to handle and respond to the matter and, where applicable, to prepare or perform a contractual relationship.

Data processed may include in particular name, email address, company or organisational affiliation, subject, message content, attachments and technical communication and delivery information. Content submitted through the contact form is sent to our email system and is not additionally stored as a form message in the WordPress database.

The legal basis is Article 6(1)(b) GDPR where the data subject is itself a party to the contract or pre-contractual measures are taken at the data subject's request. For employees, representatives and other contacts of a business customer, as well as for other business communications, processing is generally based on Article 6(1)(f) GDPR. Enquiries without a contractual connection are generally deleted six months after the communication has ended unless longer retention is necessary for evidentiary purposes or legal defence.

11. Email communication using Google Workspace

We use Google Workspace with Gmail for business email communication. Where the billing address is in Germany, the contracting party for Google Workspace is Google Cloud EMEA Limited, 70 Sir John Rogerson’s Quay, Dublin 2, Ireland.

Data processed may include in particular sender and recipient addresses, subject, message content, attachments and technical delivery and communication data. The legal basis is Article 6(1)(b) GDPR where the data subject is itself a party to the contract or pre-contractual measures are taken at the data subject's request. For employees, representatives and other contacts of a business customer, as well as for other business communications, processing is generally based on Article 6(1)(f) GDPR. Article 6(1)(c) GDPR applies where statutory retention or evidentiary obligations exist.

For primary Gmail data at rest covered by the Google Workspace data regions policy, the region is set to “Europe”. This setting does not mean that all data types and processing operations take place exclusively within the EU. Any third-country processing is subject to the applicable provisions of the Google Data Processing Addendum and Articles 44 et seq. GDPR.

12. Live chat with Crisp

WebsiteGarage.de uses Crisp live chat in Total Privacy Mode. The chat session is initialised only when the user opens the chatbox and actively starts a conversation.

The provider is Crisp IM SAS, 2 Boulevard de Launay, 44100 Nantes, France. Depending on use, data processed may include in particular IP address, browser and device information, time, page visited, chat content, name and email address where provided, transmitted files and technical communication data.

The purposes are provision of the actively used chat, handling enquiries, communication, protection against misuse and spam, and technical stability. The legal basis is Article 6(1)(b) GDPR where the data subject is itself a party to the contract or pre-contractual measures are taken at the data subject's request. For employees, representatives and other contacts of a business customer, as well as for other communications, processing is generally based on Article 6(1)(f) GDPR. Where technically necessary information is stored on or read from the terminal device after the chat is actively opened, this is done to the necessary extent under Section 25(2) TDDDG.

Crisp states that it stores core data in the EU; according to its own documentation, relay servers in the United States, the United Kingdom and Singapore may process technical connection logs such as IP address, connection time, User-Agent and source website. To the extent that this involves a transfer to a third country, the Standard Contractual Clauses provided for in Crisp's contractual documentation apply where applicable. Pure chat enquiries without a contractual connection are generally deleted six months after the communication has ended. Contract-related chat content and associated contact information are retained only for as long as necessary for contract performance, documentation, statutory retention obligations, or the establishment, exercise or defence of legal claims. Files, attachments and contact profiles that are no longer required are deleted according to the same principles.

13. Customer account, login and protected functions

A customer account may be required for certain functions, in particular for saved quotations or projects, briefings, orders, contract documents and protected project-related functions.

Data processed may include in particular identification and contact data, email address, technical account ID, authentication data in protected form, login and session data, security and log data, and project, briefing, order and contract data assigned to the account.

The purposes are provision and security of the account, authentication, assignment of saved processes, protection against unauthorised access and communication. The legal basis is Article 6(1)(b) GDPR where the account holder is itself a party to the contract or pre-contractual measures are taken at the account holder's request. For accounts of employees, representatives or other contacts of a business customer, processing for account provision, security and assignment is generally based on Article 6(1)(f) GDPR. Account data are generally stored for the lifetime of the account; contract, billing and evidentiary data required by law or objectively necessary may be retained for longer.

14. Quotations, project briefing, order and legal interactions

Before and during an order, we process information relating to the configuration of a service, preparation of a project briefing, technical qualification or preparation of a quotation. This may include in particular account and contact data, company and project data, briefing content, technical information about the website or system environment, service/package, qualification responses, and price, configuration and order data.

To make legally relevant processes traceable, WebsiteGarage may document which version of a legal document applied to a specific process and when required declarations, acceptances, change notifications or objections were submitted or sent. The absence of an objection is not treated as consent or acceptance where the specific process merely provides information together with an opportunity to object.

The purposes are quotation preparation, qualification, order and contract processing, evidence and legal defence. Article 6(1)(b) GDPR applies where the data subject is itself a party to the contract or pre-contractual measures are taken at the data subject's request. For employees, representatives or other contacts of a business customer, processing is carried out in particular on the basis of Article 6(1)(f) GDPR for the initiation, performance, organisation and documentation of the business relationship. Article 6(1)(c) GDPR applies where legal obligations exist. Uncompleted configuration and briefing drafts are generally deleted or anonymised 30 days after the last activity unless an ongoing process or another retention ground exists.

15. Privacy information for business customers, prospective customers and contacts

This information applies to natural persons whose personal data are processed in the context of an existing or prospective business relationship with DND Solutions, in particular sole traders, managing directors, employees, authorised representatives, project participants and other contacts.

Where data are collected directly from the data subject, the information required under Article 13 GDPR is provided at the time of collection. Where business contact details are obtained from a business customer, another contact at the same company or a publicly accessible business source, data processed may include in particular identification data, business contact details, company affiliation, function or position, and information relating to communication, a project or a contract.

Where data are not obtained directly, we provide the information required under Article 14 GDPR within a reasonable period, no later than one month after obtaining the data. Where the data are used for communication, the information is provided no later than the first communication; where disclosure is intended, no later than the first disclosure, unless an exception under Article 14(5) GDPR applies.

Article 6(1)(b) GDPR applies where the data subject is itself a party to the contract or pre-contractual measures are taken at that person's request. For contacts, employees or representatives of a business customer, processing is carried out in particular on the basis of Article 6(1)(f) GDPR for the proper initiation, performance, organisation and documentation of the business relationship. Legal obligations are based on Article 6(1)(c) GDPR.

16. Requirement to provide information and manual qualification

Information provided in contact, project and order functions is generally voluntary unless marked as required. Depending on the process, information marked as required may be required by law, required by contract, or necessary for entering into or performing a contract. Where there is a statutory obligation to provide information, in particular information relevant to tax or invoicing, this is indicated in the respective process. Without required information, the relevant function, qualification, quotation preparation, order or contractual service may not be possible.

Technical qualification is not currently determined solely by automated means. For services requiring qualification, in particular the website URL and the assigned quotation or package are submitted to DND Solutions for manual review. The reviewer may approve the service, approve it with required additional scope, request further information or reject the standard service; the system then implements that result technically.

Under the current design, no solely automated decision within the meaning of Article 22 GDPR takes place that produces legal effects concerning the data subject or similarly significantly affects that person.

17. Verification of the VAT identification number via VIES

For cross-border B2B transactions within the EU, a VAT identification number provided may be checked through VIES in order to determine the required VAT treatment and to document the verification in a traceable manner.

Data transmitted include in particular the VAT identification number, the associated Member State or country prefix and the information required for the check. Data stored include in particular the VAT identification number checked, verification status, time, country checked and, where provided by the service, a request or reference identifier; the complete raw response is not stored permanently.

If the number is invalid, does not match the country specified, or VIES is temporarily unavailable in a sufficiently reliable manner, the automated checkout is not released for the relevant tax treatment and the process is reviewed manually. Article 6(1)(b) GDPR applies where the data subject is itself a party to the contract or pre-contractual measures are taken at the data subject's request; Article 6(1)(c) GDPR applies to tax-law obligations and Article 6(1)(f) GDPR to traceable verification and prevention of misuse where applicable. Stored verification records are retained together with the related order, contract and tax documents in accordance with the retention periods applicable to those documents.

18. Payment processing with Stripe

We use Stripe for online payments. Data processed may include in particular name, business contact and billing data, payment amount, currency, order and transaction data, technical metadata and, depending on the payment method and integration, payment instrument data.

Where the integration provides for this, sensitive payment instrument data are collected directly by Stripe; DND Solutions receives in particular payment status, transaction references and information relevant to billing. The purposes are payment processing, refunds, prevention of fraud and misuse, chargebacks and legal obligations. Article 6(1)(b) GDPR applies where the data subject is itself a party to the contract; for employees, representatives or other contacts of a business customer, the necessary assignment and payment processing are generally based on Article 6(1)(f) GDPR unless a more specific legal basis applies. Article 6(1)(c) GDPR applies to statutory payment, bookkeeping or evidentiary obligations.

For the Stripe account operated by DND Solutions in Germany, Stripe Payments Europe, Limited, Ireland, is the contracting party to the Data Processing Addendum under the current Stripe DPA. Depending on the specific service used, Stripe processes personal data partly as a processor and partly as an independent controller; for certain services for which Stripe is responsible, Stripe entities may also be involved as joint controllers. The role applicable in each case depends on the specific payment service and Stripe documentation. Articles 44 et seq. GDPR apply to third-country transfers; Stripe participates in the EU-U.S. Data Privacy Framework and also provides for Standard Contractual Clauses and other transfer mechanisms where applicable. Payment, transaction and billing information received by DND Solutions is retained in accordance with the contract, accounting and evidentiary periods described in Section 21; where Stripe acts as an independent controller, retention by Stripe is additionally governed by Stripe's own legal and regulatory obligations.

19. Accounting, invoicing and statutory documentation

For bookkeeping, invoicing, allocation of payments and compliance with tax or commercial-law obligations, we process the necessary customer, contract, invoice and payment data. The legal basis is in particular Article 6(1)(c) GDPR and, additionally, Article 6(1)(f) GDPR.

We use Lexware Office for accounting and invoicing. Under the agreement currently provided, the processor is Haufe Service Center GmbH, Munzinger Straße 9, 79111 Freiburg, Germany. Further recipients may include in particular tax advisers, banks and competent authorities where necessary.

20. Recipients, service providers and international data transfers

Personal data are made accessible to recipients only to the extent necessary for the respective purpose or where another legal basis permits this. Categories of recipients may include in particular hosting, infrastructure, security, IT, payment, banking, email, communications, accounting and administrative service providers, professional advisers and competent authorities.

Where personal data are transferred outside the EU or EEA or processed there, this takes place only in compliance with Articles 44 et seq. GDPR. Depending on the case, relevant safeguards may include in particular European Commission adequacy decisions, the EU-U.S. Data Privacy Framework or Standard Contractual Clauses, where necessary supplemented by additional safeguards. Information on the safeguards applicable to the relevant transfer and, where applicable, a copy of the relevant safeguards can be requested at [email protected].

The list of subprocessors used by DND Solutions when processing on behalf of a customer forms part of the relevant AVV relationship and is provided separately.

21. Retention period, retention obligations and deletion periods

We store personal data only for as long as necessary for the respective purpose or as long as statutory, contractual or objectively necessary reasons justify further storage. In particular, the following periods apply to the processing operations currently used:

  • Enquiries without a contractual connection: generally 6 months after the communication has ended.
  • Uncompleted quotation configurations and project briefings: generally 30 days after the last activity.
  • Customer account data: generally for the lifetime of the account; contract, order, billing and evidentiary data may be retained for longer in accordance with the relevant retention ground.
  • Contract- and project-related data: for the duration of the contractual or project relationship and thereafter to the extent required by statutory retention obligations or legal claims.
  • Invoices and other accounting records: generally 8 years where the statutory retention obligations under Section 147(3) AO or Section 14b UStG apply.
  • Books, records, inventories, annual financial statements and comparable documents: 10 years where required by law.
  • Commercial and business correspondence, including corresponding business emails: generally 6 years where a statutory retention obligation exists.
  • Server logs: normally 14 days.
  • Security-relevant server log data: up to 90 days; longer where necessary in the event of a specific security incident.
  • Forge12 security log: 90 days.
  • Forge12 IP blocks: temporary blocks until expiry; manually set blocks until they are lifted.
  • Forge12 live access data: 24 hours.
  • Forge12 request rate limiting: only until the relevant time window expires.
  • Forge12 check and finding data: until the finding is no longer detected by a subsequent check or the affected file or record has been corrected.
  • Google Analytics 4: user-level data 14 months; event data 2 months. According to Google, standard aggregated reports are not affected by these settings.
  • Consent documentation in the Consent Hub: no automatic deletion after a fixed period is currently configured; a defined retention and deletion policy is planned.
  • Pure Crisp chat enquiries without a contractual connection: generally 6 months after the communication has ended; contract-related or evidentiary content in accordance with the applicable retention ground.
  • VIES verification records: together with the related order, contract and tax documents in accordance with the retention periods applicable to those documents.
  • Payment, transaction and billing information held by DND Solutions: in accordance with the applicable contract, accounting and evidentiary retention periods.
  • Backups: generally 30 days on a rolling basis.

During any further retention required by law or objectively necessary, processing is restricted to the remaining purpose to the extent possible and necessary.

22. Rights of data subjects

Subject to the statutory requirements, data subjects have in particular the right of access under Article 15 GDPR, rectification under Article 16 GDPR, erasure under Article 17 GDPR, restriction of processing under Article 18 GDPR, data portability under Article 20 GDPR and the right to object under Article 21 GDPR.

Consent that has been given may be withdrawn at any time with effect for the future in accordance with Article 7(3) GDPR. Withdrawal does not affect the lawfulness of processing carried out before withdrawal. Data subjects also have the right to lodge a complaint with a data protection supervisory authority.

Special notice concerning the right to object

Where we process personal data on the basis of Article 6(1)(f) GDPR, data subjects have the right to object to such processing at any time on grounds relating to their particular situation. We will then no longer process the personal data concerned unless we can demonstrate compelling legitimate grounds for the processing that override the interests, rights and freedoms of the data subject, or the processing serves the establishment, exercise or defence of legal claims.

The competent authority for DND Solutions is in particular:

Der Landesbeauftragte für den Datenschutz Niedersachsen

Prinzenstraße 5

30159 Hannover

Germany

Email: [email protected]

23. External links and online presences

WebsiteGarage.de may link to external websites or online presences. Merely displaying an ordinary link does not transfer data to the linked provider; only when the link is opened does the external provider process data under its own responsibility.

In the current configuration, we do not use externally embedded social media feeds, video, map or comparable third-party content that establishes a connection to the external provider when the page is loaded. Any sharing function offered uses the browser's or operating system's native Web Share function.

24. Changes to this Privacy Policy

We update this Privacy Policy when the legal situation, services used, actual processing operations or technical configurations change. The version published at the relevant time is authoritative. If we intend to further process personal data for a purpose other than that for which they were collected, we will inform the data subject before that further processing about the new purpose and the further information relevant to it.

A change to this Privacy Policy is not treated as consent to new processing. If new or modified processing requires consent or another separate declaration, it will be obtained independently of merely publishing a new version.