PRIVACY POLICY
Clear information about what this website processes, what it deliberately does not track, and what happens when you contact the mission.
1. CONTROLLER
Kirsten Seidel
Thomas-Mann-Straße 34
01219 Dresden
Germany
For privacy questions or to exercise your rights, use the Contact form. An email address is available through the protected SHOW EMAIL control in the Legal Notice / Imprint.
2. WEBSITE DELIVERY, HOSTING AND SERVER LOGS
Opening a page sends connection and request information to the website’s hosting infrastructure, including your IP address, the requested resource and browser information. Depending on the server configuration, logs may also record the request time, referrer where transmitted, HTTP status and transferred data volume.
This processing supports website delivery, technical stability, security, abuse prevention and troubleshooting. The legal basis is Article 6(1)(f) GDPR: the legitimate interest in operating a secure and reliable website. The exact hosting log fields and deletion schedule are controlled at hosting level and were not available in the WordPress audit.
3. WORDPRESS AND TECHNICALLY NECESSARY FUNCTIONS
The site uses WordPress and Elementor to deliver pages and the contact form. The current public site does not offer user accounts, a shop, active payment processing or a newsletter signup. WordPress authentication cookies concern logged-in administration rather than ordinary public browsing.
No HTTP Set-Cookie header was observed on the public pages checked on 3 October 2026. This does not exclude storage created by JavaScript or an activated external video. WordPress includes an emoji compatibility test that can save its result in session storage. This technical result is not a visitor analytics identifier. Elementor’s frontend code also contains local- and session-storage functions for technical feature state; a complete runtime storage inventory was not available in the audit.
Technical processing necessary for delivery and security is based on Article 6(1)(f) GDPR. Non-essential storage or access on your device requires consent where applicable under § 25 TDDDG; the exceptions for communication and strictly necessary requested functions remain applicable. Optional analytics and marketing scripts are disabled in the audited configuration.
4. CONTACT FORM AND EMAIL COMMUNICATION
The contact form collects your name, email address, inquiry type, subject and message, together with acknowledgement of the privacy notice. Required fields are marked. Please avoid including unnecessary medical, financial or identity information.
The information is used to handle and answer your inquiry. Article 6(1)(b) GDPR applies where the inquiry concerns pre-contractual or contractual steps; otherwise Article 6(1)(f) GDPR applies, based on the legitimate interest in answering genuine inquiries. Providing the information is voluntary, but an inquiry cannot be processed through the form without its required fields.
The form is configured to send messages by email to a Google-managed mailbox. Google’s email infrastructure can process message content and metadata. Elementor’s separate Collect Submissions action is not enabled; the form is not configured to create an Elementor submission record. The same purposes and legal bases apply if you contact the operator directly by email.
5. ANTI-SPAM / FORM SECURITY
The form uses server-side validation and a hidden honeypot field to reduce automated spam. These technical checks support secure communication under Article 6(1)(f) GDPR. No Google reCAPTCHA or other third-party CAPTCHA integration was found in the audited form.
6. ANALYTICS AND ADMINISTRATIVE SERVICES
Metricool: the administrative integration remains installed, but its public tracking script is disabled.
Google Site Kit: the plugin remains installed for administrative services. Only the PageSpeed Insights module is active in the audited settings. The Google Analytics 4 frontend snippet is disabled and the Analytics module is inactive. No Google Tag Manager, Google Ads or AdSense script was found on the checked public pages.
The current HTML includes a DNS-prefetch hint for www.googletagmanager.com. A browser may resolve that domain in advance; the hint is not itself an Analytics or Tag Manager script. No visitor-side analytics or marketing script was found in the reviewed public frontend.
7. YOUTUBE / THIRD-PARTY MEDIA
The website uses a click-to-load YouTube integration. No YouTube player is loaded when the page first opens. A locally hosted preview is displayed instead. Only after you actively select the video is an embedded player loaded from YouTube’s privacy-enhanced domain (youtube-nocookie.com). Your browser can then connect to Google/YouTube, which may process your IP address, browser information and video interactions, and may access or store information on your device. Privacy-enhanced mode does not guarantee anonymity or data-free playback.
The preview explains the external connection before activation. Selecting Play authorizes loading the external player; this optional activation relies on consent under Article 6(1)(a) GDPR and, where applicable, § 25 TDDDG. The video is not activated automatically. Use Stop video and disconnect to remove the player, or leave or reload the page. Removing the player does not undo processing already performed by the provider.
For Google’s processing, see Google’s Privacy Policy. Other external links connect you to their destination only when you follow them.
8. FONTS AND EXTERNAL ASSETS
Direct requests to Google Fonts were disabled in the audited configuration. The public pages reviewed did not include Google Fonts stylesheets. Fonts and ordinary page assets are served locally or use system fallbacks. The DNS-prefetch hint described above and the optional YouTube player are distinct from local font delivery.
9. RECIPIENTS AND INTERNATIONAL DATA TRANSFERS
Relevant recipients are the website’s hosting infrastructure, Google’s email infrastructure for contact communication, and Google/YouTube after you activate a video. Data is otherwise disclosed only where necessary for the stated purposes or to meet a legal obligation.
Google services may process information outside the European Economic Area, including in the United States. Depending on the service, recipient and contractual arrangement, an applicable adequacy decision or other safeguards such as standard contractual clauses may be relevant. The website audit did not verify the operator’s provider contracts or the transfer mechanism for this particular mailbox. You can request information about applicable safeguards through the contact pathway above.
10. RETENTION
Contact messages: retained only as long as necessary to handle the inquiry and related legal or administrative follow-up, unless statutory retention obligations require longer storage.
Hosting logs: the retention criterion is the period necessary for delivery, security and troubleshooting, subject to any legal obligation. No exact host-side deletion period was verified in this audit.
Technical browser storage: session storage concerns the browser session. Data processed or stored by Google/YouTube after activation follows the provider’s applicable retention arrangements; removing the player does not delete information already held by that provider.
11. YOUR RIGHTS
Subject to the GDPR’s conditions, you have rights of access, rectification, erasure, restriction, data portability and objection. In particular, you may object to processing based on legitimate interests for reasons relating to your situation. Where processing relies on consent, you may withdraw it for the future without affecting earlier lawful processing.
Use the contact pathway in section 1 to exercise your rights. You may also lodge a complaint with a competent data protection supervisory authority. The website does not use automated decision-making, including profiling, that produces legal or similarly significant effects within the meaning of Article 22 GDPR.
12. CHANGES TO THIS POLICY
This policy reflects the public website and WordPress configuration reviewed on 3 October 2026. It must be updated before or when actual data flows materially change, including the introduction of tracking, newsletter, payment or public account functions.
Last updated: 3 October 2026