1 Data Controller

Nikolas Migut
c/o Neues Amt Altona
Neue Große Bergstraße 35
22767 Hamburg, Germany

kontakt@achterbahnleben.de

Link to the Legal Notice: https://achterbahnleben.de/en/imprint/

2 Your Rights

As the data controller, we grant you the following rights regarding your personal data:

2.1 General Rights Under Article 15 ff. of the GDPR

You have the right to access, rectification, erasure, restriction of processing, objection to processing, and data portability. To the extent that processing is based on your consent, you have the right to withdraw this consent with future effect.

2.2 Rights Regarding Data Processing Based on Legitimate Interests

Pursuant to Article 21(1) of the GDPR, you have the right to object at any time, on grounds relating to your particular situation, to the processing of your personal data that is carried out on the basis of Article 6(1)(e) of the GDPR (data processing in the public interest) or Article 6(1)(f) of the GDPR (data processing to the protection of a legitimate interest); this also applies to profiling based on this provision. If you object, we will no longer process your personal data unless we can demonstrate compelling legitimate grounds for the processing that override your interests, rights, and freedoms, or the processing is necessary for the establishment, exercise, or defense of legal claims.

2.3 Rights Regarding Direct Marketing

If we process your personal data for the purpose of direct marketing, you have the right, pursuant to Article 21(2) of the GDPR, to object at any time to the processing of your personal data for such marketing purposes; this also applies to profiling to the extent that it is related to such direct marketing. If you object to processing for the purpose of direct marketing, we will no longer process your personal data for these purposes in the future.

2.4 Right to File a Complaint with a Supervisory Authority

You also have the right to lodge a complaint with a competent data protection supervisory authority regarding our processing of your personal data. The supervisory authority responsible for us is:

The Hamburg Commissioner for Data Protection and Freedom of Information Klosterwall 6 (Block C) 20095 Hamburg Phone: 040 / 428 54 – 4040 Email: mailbox@datenschutz.hamburg.de

3 Collection of Access Data and Log Files

Every time you access our website, data is collected and processed to a certain extent. This is primarily to provide the website and its content. However, we or our hosting provider also collect data about every access to our server (so-called server log files) in order to ensure the security and stability of our services.

Our website is hosted by IONOS SE, Elgendorfer Straße 57, 56410 Montabaur, Germany.

Type of data processed: The IP address, date and time, browser user agent, referrer URL (the previously visited page), the requesting provider, and the amount of data transferred are collected and stored.

Purpose of processing: The collection of log files serves to log malicious or abusive website accesses, as well as to ensure the security and stability of our website.

Legal basis: Our legitimate interest in the security and stability of our online service, Art. 6(1)(f) GDPR. Data retention period: Log file information is stored for a maximum of 7 days for security reasons (e.g., to investigate cases of misuse or fraud) and is then deleted. Data that must be retained for evidentiary purposes is exempt from deletion until the respective incident has been fully resolved.

Right to object: To the extent that data is collected as described, this is strictly necessary for the security and operation of the website. Therefore, there is no right to object.

4 Contact

When you contact us—e.g., via email—we collect the personal data that you voluntarily provide to us. We use this data exclusively for the purpose for which you provided it to us when contacting us.

Providing such information when contacting us is voluntary and is always initiated by you. To the extent that this involves information regarding communication channels (e.g., email address, phone number), we use these channels to contact you in accordance with your request and to respond to any inquiries.

Purpose of processing: Processing and responding to your inquiry.

Legal basis: Art. 6(1)(f) GDPR (legitimate interest in processing your inquiry).

Data retention period: We will delete your contact information as soon as it is no longer needed to fulfill the purpose for which it was collected—typically when your inquiry has been fully processed and no further communication is required or desired.

Right to Object: You may contact us at any time via email to request the deletion of your data related to your inquiry. In such cases, we may no longer be able to process your inquiry.

5 Newsletter

On our website, we offer the option to subscribe to our newsletter, through which we inform you about solutions, events, publications, and news related to Achterbahnleben.

Service Provider Used: For registration and distribution, we use the Steady service provided by Steady Media GmbH, Wattstr. 11, 13355 Berlin, Germany. When you subscribe to the newsletter, Steady collects and processes your email address and, if applicable, your name on our behalf for the purpose of sending the newsletter. Registration takes place via the double opt-in process: After you sign up, you will receive a confirmation email; the newsletter will only be sent to you after you confirm your subscription.

Steady uses cookies on our website to detect your registration status and may also collect technical data (including IP address, date, time, browser, and operating system information). For more information, please refer to Steady’s privacy policy: https://steady.page/de/privacy

Measuring Success: When sending newsletters via Steady, we can analyze open and click-through rates to improve the newsletter’s content. We do not create individual profiles for individual readers.

Required Information: An email address and, if applicable, a name are required to receive the newsletter.

Legal basis: Your consent, Art. 6(1)(a) GDPR, and, with regard to cookies set by Steady, § 25(1) TDDDG. We have a data processing agreement with Steady in accordance with Art. 28 GDPR.

Transfers to Third Countries: Steady is a German company headquartered in Berlin. To the best of our current knowledge, there are no data transfers to third countries outside the EU/EEA.

Data Retention Period: Your data will be stored until you unsubscribe from the newsletter.

Right to Object: You may withdraw your consent at any time with future effect, e.g., via the unsubscribe link at the bottom of each newsletter email.

6 Cookies

Cookies are data stored on your device by a website you visit, often in the form of small text files. They store information such as your login status, language settings, or approximate location and are transmitted back to the website when you visit it again.

A distinction is made between session cookies (which are deleted when you close your browser) and persistent cookies (which remain stored for a predefined period of time), as well as between first-party and third-party cookies.

Legal basis: Access to and storage of information on your device is governed by Section 25 of the TDDDG (Telecommunications and Digital Services Data Protection Act). We are permitted to set technically necessary cookies without your consent pursuant to Section 25(2) of the TDDDG. For all cookies that are not technically necessary (e.g., analytics or newsletter cookies), we obtain your prior consent in accordance with Section 25(1) of the TDDDG in conjunction with Article 6(1), sentence 1, letter a) of the GDPR. You can find more information about the cookies used on this website in our Cookie Consent Tool (Change Privacy Settings).

7 Analysis Tool - Visitors

This website uses the “Visitors” visitor and page view counter by Glen Langer (BugBuster). Visitors is an extension for the Contao content management system (CMS).

Unlike most other visitor statistics tools, Visitors does not store raw data and analyze it later. The necessary analyses are performed immediately. Therefore, only the final statistical data is stored, with the exception of the IP address; see the notes below for more information. This ensures that the goals of data avoidance and data minimization are achieved to the greatest extent possible.

Data Collection

IP Address

To identify unique visitors, only the IP address is used—no JavaScript, no cookies.

Browser Agent and Referrer

For additional statistics, the browser agent is recorded, as well as the referrer if available. Both are stored separately from the IP address and therefore cannot be linked to it (pure counting).

Data Storage

IP Address

The visitor’s IP address is not stored. With the exception of identifying bots, crawlers, and spiders, the IP address is not used for any other analytical purposes.

A pseudonym in the form of a hash value is generated from the IP address and other internal data. Reverse engineering is theoretically possible, but only with considerable effort. The hash value is not linked to any other statistical analysis.

Browser Agent and Referrer

For the browser agent, the combinations of browser, language, and OS are stored along with a count; the complete agent string is not stored.

For the referrer, the URL is stored along with a count and the timestamp of the last occurrence, without any link to the IP address or browser agent.

Data Retention

The hash values used to identify unique visitors are checked with each page view; expired values are deleted. The retention period corresponds to the block time; the default value is 1,800 seconds, i.e., 30 minutes.

The number of visitors/hits per day is permanently stored; this data is used to generate further statistics. This data can be deleted via the Contao backend; the counter then resets to 0.

For more information, visit the Visitors developer’s website: https://docs.contao.ninja/de/visitors.html

8 Hosting

This website is hosted by IONOS SE, Elgendorfer Straße 57, 56410 Montabaur, Germany. The personal data collected on this website is stored on their servers. This may include IP addresses, contact requests, metadata and communication data, names, website visits, and other data generated through the website.

Legal basis: Art. 6(1)(f) GDPR (interest in the secure, fast, and efficient provision of our online services by a professional provider); to the extent that IONOS acts in the context of contract performance, Art. 6(1)(b) GDPR.

We have a data processing agreement with IONOS in accordance with Art. 28 GDPR. IONOS processes your data only to the extent necessary to fulfill its service obligations and follows our instructions regarding this data. We are not aware of any transfers to third countries, as IONOS is headquartered in Germany and its servers are located there.

9 Provision of Contractual Services

We process the data of customers, clients, interested parties, or other individuals in accordance with Article 6(1)(b) of the GDPR, provided that we offer them contractual services (e.g., keynote speeches, workshops, consulting services, book or product orders) or act within the scope of an existing business relationship. Where applicable, we process data of data subjects pursuant to Article 6(1)(f) of the GDPR based on our legitimate interests, e.g., for administrative tasks.

The data processed, as well as the nature, scope, and purpose of its processing, are determined by the underlying contractual relationship. This generally includes inventory and master data (e.g., name, address), contact information (e.g., email address, phone number), contract data (e.g., services utilized), and, if we offer services subject to payment, payment data. We delete data that is no longer necessary for the provision of our services. The necessity of retention is reviewed on a regular basis; otherwise, statutory retention obligations apply.

10 External Payment Service Providers

Whenever payments are processed through our website (e.g., donations or participation fees for our participatory art projects), we may use external payment service providers through whose platforms payment transactions can be made, each with a link to their privacy policy: Paypal (https://www.paypal.com/us/webapps/mpp/ua/privacy-full), Visa (https://corporate.visa.com/en/legal/global-privacy-notice.html), Mastercard (https://www.mastercard.com/us/en/global-privacy-notice.html), American Express (https://www.americanexpress.com/us/privacy-center/), Stripe (https://stripe.com/privacy).

Legal basis: For the performance of a contract, Article 6(1)(b) of the GDPR; otherwise, our legitimate interest pursuant to Article 6(1)(f) of the GDPR in providing an effective and secure payment option for our users.

The data processed by the payment service providers includes master data (e.g., name, address), bank details (e.g., account numbers), as well as information related to the contract, payment amounts, and recipients. This data is processed and stored exclusively by the payment service providers; we receive only a confirmation or notification that the payment was not processed. The terms and conditions and privacy policies of the respective payment service providers also apply to payment transactions.