"Transparency Regarding Data Protection in Accordance With the GDPR."

Privacy Policy in Accordance With the GDPR

In accordance with the legal requirements of data protection law (in particular the German Federal Data Protection Act (BDSG nF) and the European General Data Protection Regulation (GDPR), I hereby inform you about the nature, scope, and purpose of the processing of personal data by my company. This privacy policy applies to my websites and social media profiles. For the definition of terms such as "personal data" or "processing," please refer to Article 4 of the GDPR.

Name and contact details of the responsible person(s)

The controller (hereinafter referred to as "controller") within the meaning of Article 4(7) GDPR is:

Pascal Hartmann-Boll

Achtermannstraße 23

D-48143 Münster

49 173 547 6637

info@hartmannboll.de

Types of data, purposes of processing and categories of data subjects

Below I will inform you about the type, scope and purpose of the collection, processing and use of personal data.

1. Types of data I process

Usage data (access times, websites visited, etc.), inventory data (name, address, etc.), contact data (telephone number, email, fax, etc.), payment data (bank details, account details, payment history, etc.), contract data (subject of the contract, term, etc.), content data (text entries, videos, photos, etc.), communication data (IP address, etc.).

2. Purposes of processing pursuant to Article 13(1)(c) GDPR

Contract processing, evidentiary purposes/preservation of evidence, technical and economic optimization of the website, facilitating easy access to the website, fulfillment of contractual obligations, contacting in the event of legal complaints by third parties, compliance with statutory retention obligations, optimization and statistical evaluation of my services, support for the commercial use of the website, improvement of user experience, user-friendly website design, efficient operation of advertising and the website, marketing/sales/advertising, creation of statistics, determination of the likelihood of text copying, prevention of spam and abuse, customer service and customer care, handling contact requests

to process, provide websites with functions and content, implement security measures, ensure uninterrupted, secure operation of a website,

3. Categories of data subjects pursuant to Article 13(1)(e) GDPR

Website visitors/users, customers, suppliers, prospective customers, employees,

The individuals affected are collectively referred to as "users".

Legal basis for the processing of personal data

Below I inform you about the legal basis for the processing of personal data:

1. If I have obtained your consent for the processing of personal data, the legal basis is Art. 6 para. 1 sentence 1 lit. a) GDPR.

2. If the processing is necessary for the performance of a contract or for taking steps at your request prior to entering into a contract, the legal basis is Art. 6 para. 1 sentence 1 lit. b) GDPR.

3. If processing is necessary for compliance with a legal obligation to which I am subject (e.g. statutory retention obligations), then Article 6(1)(c) GDPR is the legal basis.

4. If processing is necessary to protect the vital interests of the data subject or of another natural person, then Article 6(1)(d) GDPR is the legal basis.

5. If the processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, and your interests or fundamental rights and freedoms do not override those interests, then Art.

Article 6, paragraph 1, sentence 1, letter f) of the GDPR is the legal basis. Disclosure of personal data to third parties and processors. As a general rule, I do not disclose any data to third parties without your consent. Should this nevertheless occur, the disclosure will be based on the aforementioned legal bases, e.g., when disclosing data to online payment providers for contract fulfillment, or due to a court order or a legal obligation to disclose data for the purposes of law enforcement, prevention of danger, or enforcement of intellectual property rights. I also use processors (external service providers, e.g., for web hosting of my websites and databases) to process your data. If data is transferred to processors within the framework of a data processing agreement, this is always done in accordance with Article 28 of the GDPR. I carefully select my processors and monitor them regularly.

I have granted myself the right to issue instructions regarding the data. Furthermore, the data processors must have implemented suitable technical and organizational measures and comply with the data protection regulations according to the German Federal Data Protection Act (BDSG nF) and the General Data Protection Regulation (GDPR).

Data transfer to third countries

The adoption of the European General Data Protection Regulation (GDPR) created a uniform basis for data protection in Europe. Your data is therefore primarily processed by companies to which the GDPR applies. However, should processing by

If third-party services are used outside the European Union or the European Economic Area, they must meet the specific requirements of Articles 44 et seq. of the GDPR. This means that processing takes place on the basis of special safeguards, such as the EU Commission's officially recognized finding of an adequate level of data protection equivalent to that of the EU, or compliance with officially recognized specific contractual obligations, the so-called "standard contractual clauses." Insofar as I obtain your explicit consent for the transfer of data to the USA pursuant to Article 49(1)(a) of the GDPR due to the invalidity of the so-called "Privacy Shield," I would like to point out the risk of secret access by US authorities and the use of the data for surveillance purposes, possibly without legal recourse for EU citizens.

Data deletion and storage period

Unless expressly stated otherwise in this privacy policy, your personal data will be deleted or blocked as soon as you withdraw your consent to its processing, or the purpose for its storage no longer applies, or the data is no longer required for that purpose, unless its further retention is necessary for evidentiary purposes or is required by law. This includes, for example, the statutory retention periods for business correspondence under Section 257 Paragraph 1 of the German Commercial Code (HGB) (6 years) and the statutory retention periods for tax documents under Section 147 Paragraph 1 of the German Fiscal Code (AO) (10 years). Once the prescribed retention period expires, your data will be blocked or deleted, unless further storage is necessary for entering into or fulfilling a contract.

Existence of automated decision-making. I do not use automated decision-making or profiling.

Provision of my website and creation of log files

1. If you use my website for informational purposes only (i.e., without registering or otherwise submitting information), I only collect the personal data that your browser transmits to my server provider. If you wish to view my website, I collect...

I have the following data:

• IP address;

• User's Internet service provider;

• Date and time of retrieval;

• Browser type;

• Language and browser version;

• Content of the request;

• Time zone;

• Access status/HTTP status code;

• Data volume;

• Websites from which the request originates;

• Operating system.

This data will not be stored together with any other personal data of yours.

2. This data serves the purpose of delivering my website to you in a user-friendly, functional and secure manner with its features and content, as well as its optimization and statistical evaluation.

3. The legal basis for this is my legitimate interest in data processing, which is also reflected in the purposes stated above, pursuant to Art. 6 para. 1 sentence 1 lit. f) GDPR.

4. For security reasons, I store this data in server log files for a retention period of 30 days. After this period, it is automatically deleted, unless I need to retain it as evidence in the event of attacks on the server infrastructure or other legal violations.

Cookies

1. I use cookies when you visit my website. Cookies are small text files that your internet browser places and stores on your computer. When you visit my website again, these cookies provide information to automatically recognize you. Cookies also include so-called "user IDs," where user data is stored using pseudonymized profiles. When you visit my website, I inform you about the use of cookies for the aforementioned purposes and how you can object to this or prevent their storage ("opt-out") via a notice linking to my privacy policy. The following types of cookies are used:

• Necessary, essential cookies: Essential cookies are cookies that are absolutely necessary for the operation of the website in order to save certain functions of the website such as logins, shopping cart or user inputs e.g. regarding the language of the website.

• Session cookies: Session cookies are required to recognize repeated use of a service by the same user (e.g., to determine your login status after you have logged in). When you revisit my site, these cookies provide information to automatically recognize you. The information obtained in this way is used to optimize my services and make it easier for you to access my site. Session cookies are deleted when you close your browser or log out.

• Persistent cookies: These cookies remain stored even after the browser is closed. They are used to store login information, measure reach, and for marketing purposes. They are automatically deleted after a predetermined period, which varies depending on the cookie.

You can distinguish between them. You can delete cookies at any time in your browser's security settings.

• Third-party cookies (especially from advertisers): You can configure your browser settings according to your preferences and, for example, reject the acceptance of third-party cookies or all cookies. However, I would like to point out that

You may then not be able to use all the functions of this website. Read more about these cookies in the respective privacy policies of the third-party providers.

2. Data categories: User data, cookie, user ID (in particular the pages visited, device information, access times and IP addresses).

3. Purposes of processing: The information obtained in this way serves the purpose of technically and economically optimizing my web services and enabling you to have easier and more secure access to my website.

4. Legal basis: If we process your personal data using cookies based on your consent ("opt-in"), then Article 6(1)(a) GDPR is the legal basis. Otherwise, I have a legitimate interest in the effective functionality, improvement, and

The economic operation of the website is the legal basis, so in this case Article 6(1)(f) GDPR applies. Article 6(1)(b) GDPR also applies if the cookies are set for the purpose of initiating a contract, e.g., during the ordering process.

5. Storage period/deletion: The data will be deleted as soon as it is no longer required for the purpose for which it was collected. In the case of data collected for the provision of the website, this is the case when the respective session has ended. Otherwise, cookies are stored on your computer and transmitted from there to my site. Therefore, as a user, you have full control over the use of cookies. By changing the settings in your internet browser, you can deactivate or restrict the transmission of cookies. Cookies that have already been stored can be deleted at any time. This can also be done automatically. If cookies are deactivated for my website,

Some website functions may no longer be fully available. Here you can find information on deleting cookies for different browsers:

• Chrome: https://support.google.com/chrome/answer/95647

• Safari: https://support.apple.com/de-at/guide/safari/sfri11471/mac

• Firefox: https://support.mozilla.org/de/kb/cookies-und-website-daten-in-firefox-loschen

• Internet Explorer: https://support.microsoft.com/de-at/help/17442/windows-internet-explorer-delete-

manage-cookies

• Microsoft Edge: https://support.microsoft.com/de-at/help/4027947/windows-delete-cookies

6. Objection and "Opt-Out": You can generally prevent cookies from being stored on your hard drive, regardless of consent or legal permission, by selecting "do not accept cookies" in your browser settings. However, this may result in limited functionality of my services. You can object to the use of third-party cookies for advertising purposes via an "opt-out" on this American website.

You can object to this on the website (https://optout.aboutads.info) or this European website (http://www.youronlinechoices.com/de/praferenzmanagement/).

Contract handling

1. I process inventory data (e.g., company, title/academic degree, names and addresses as well as contact details of users, email), contract data (e.g., services used, names of contact persons) and payment data (e.g., bank details, payment history) for the purpose of fulfilling contractual obligations (knowing who the contractual partner is; establishing, defining the content of and processing the contract; checking the plausibility of the data) and providing services (e.g., customer service contact) in accordance with Art. 6 para. 1 sentence 1 lit. b) GDPR.

The information marked as mandatory in online forms is required for the conclusion of the contract.

2. As a general rule, this data will not be passed on to third parties, unless it is necessary for the enforcement of my claims (e.g. transfer to a lawyer for debt collection) or for the fulfillment of the contract (e.g. transfer of data to payment providers) or there is a legal obligation to do so pursuant to Art. 6 para. 1 sentence 1 lit. c) GDPR.

3. I may also process the data you provide to inform you about other interesting products from my portfolio or to send you emails with technical information.

4. The data will be deleted as soon as it is no longer required for the purpose for which it was collected. This is the case for inventory and contract data when the data is no longer required for the performance of the contract and no further claims arise from the contract.

Claims cannot be asserted because they are time-barred (warranty: two years / standard limitation period: three years). Due to commercial and tax law requirements, I am obligated to store your address, payment, and order data for a period of ten years. However...

Upon termination of the contract after three years, I will restrict the processing of your data, meaning it will only be used to comply with legal obligations. Information in your user account will remain until you delete it.

Contact us via contact form / email / fax / post

1. When you contact me via contact form, fax, post or e-mail, your information will be processed for the purpose of handling your contact request.

2. The legal basis for processing your data is, if you have given your consent, Article 6(1)(a) GDPR. The legal basis for processing data transmitted in the course of a contact request or via email, letter, or fax is Article 6(1)(f) GDPR.

GDPR. The controller has a legitimate interest in processing and storing the data in order to respond to user inquiries, for evidentiary purposes in case of liability claims, and to comply with any legal retention obligations for business correspondence. If the contact aims at concluding a contract, the additional legal basis for processing is Art. 6 para. 1 sentence 1 lit. b) GDPR.

3. I may store your details and contact request in my Customer Relationship Management System ("CRM System") or a comparable system.

4. The data will be deleted as soon as it is no longer required for the purpose for which it was collected. For personal data from the contact form and data transmitted by email, this is the case when the respective conversation with you has ended. A conversation is considered ended when it is clear from the circumstances that the matter in question has been resolved. Inquiries from users who have an account or contract with me are stored for up to two years after the contract ends. In the case of statutory archiving obligations, deletion occurs after their expiry: the end of the commercial (6 years) and tax-related (10 years) retention periods.

5. You have the right to withdraw your consent to the processing of your personal data at any time, in accordance with Article 6(1)(a) of the GDPR. If you contact me by email, you can object to the storage of your personal data at any time.

Contact via telephone

1. When you contact me by phone, your phone number will be processed for handling your contact request and temporarily stored or displayed in the RAM/cache of your phone/display. This storage is for liability and security reasons.

For security reasons, to provide proof of the call, and for business reasons, to enable a callback. In the case of unsolicited advertising calls, I block the phone numbers.

2. The legal basis for processing the telephone number is Article 6(1)(f) GDPR. If the contact aims at concluding a contract, the additional legal basis for processing is Article 6(1)(b) GDPR.

3. The device cache stores call logs for 30 days and successively overwrites or deletes older data. When the device is disposed of, all data is deleted and the storage medium may be physically destroyed. Blocked phone numbers are reviewed annually to determine if the block is still necessary.

4. You can prevent your phone number from being displayed by calling with a blocked number.

Rights of the data subject

1. Objection or Withdrawal of Consent to the Processing of Your Data If the processing is based on your consent pursuant to Art. 6 para. 1 sentence 1 lit. a), Art. 7 GDPR, you have the right to withdraw your consent at any time. The lawfulness of the processing carried out on the basis of the consent until its withdrawal remains unaffected. If I base the processing of your personal data on the balancing of interests pursuant to Art. 6 para. 1 sentence 1 lit. f) GDPR, you can object to the processing. This is the case, in particular, if the processing is not necessary for the performance of a contract to which you are a party or in order to take steps at your request prior to entering into a contract.

This is necessary for the performance of a contract with you, which I will explain in the following descriptions of the functions. If you exercise your right to object, please state the reasons why I should not process your personal data as I have described. In the event of a justified objection, I will review the situation and either cease or adjust the data processing, or

I will explain my compelling legitimate grounds for continuing the processing of your data. You can object to the processing of your personal data for advertising and data analysis purposes at any time. You can exercise your right to object free of charge. You can inform me of your objection to advertising using the following contact details:

Pascal Hartmann-Boll

Achtermannstraße 23

D-48143 Münster

49 173 547 6637

info@hartmannboll.de

2. Right to information

You have the right to information about your personal data stored by me in accordance with Article 15 of the GDPR. This includes, in particular, information about the purposes of processing, the categories of personal data, and the categories of recipients to whom your data is disclosed.

The data that has been or will be disclosed, the planned storage period, and the origin of your data, unless it was collected directly from you.

3. Right to rectification

You have the right to rectification of inaccurate data or to completion of inaccurate data according to Art. 16 GDPR.

4. Right to erasure

You have the right to have your data stored by me deleted in accordance with Article 17 GDPR, unless statutory or contractual retention periods or other legal obligations or rights to further storage preclude this.

5. Right to restriction

You have the right to request a restriction on the processing of your personal data if one of the conditions in Art. 18 para. 1 lit. a) to d) GDPR is met:

• If you contest the accuracy of the personal data concerning you for a period enabling the controller to verify the accuracy of the personal data;

• the processing is unlawful and you object to the erasure of the personal data and instead request the restriction of its use;

• the controller no longer needs the personal data for the purposes of processing, but you require it for the establishment, exercise or defense of legal claims, or

• if you have objected to the processing pursuant to Art. 21 para. 1 GDPR and it is not yet clear whether the legitimate grounds of the controller override your grounds.

6. Right to data portability

You have a right to data portability under Article 20 GDPR, which means that you can receive the personal data stored about you by me in a structured, commonly used and machine-readable format or request its transmission to another controller.

7. Right to appeal

You have the right to lodge a complaint with a supervisory authority. Generally, you can contact the supervisory authority in the Member State of your residence, your place of work, or the place of the alleged infringement.

Data security

To protect all personal data transmitted to me and to ensure that data protection regulations are observed by me and my external service providers, I have implemented appropriate technical and organizational security measures. Therefore, among other things, all data between your browser and my server is transmitted via a secure SSL connection.

As of October 28, 2025

Source: www.juraforum.de