Privacy Policy

The following privacy policy provides you with information on the nature, extent, purpose and duration of the processing of personal data and your rights as a data subject.
Processing takes place within the framework of the applicable data protection regulations.

1. Responsible parties (controller):

Andre Vieth Fewo Marketing GmbH
c/o Mindspace
Münzstraße 12
10178 Berlin

Managing Director:
Andre Vieth

Telephone:
0172 6022473

E-Mail Address:
[email protected]

Register court:
Amtsgericht Charlottenburg

Registration number:
HRB 195538

In the following, the controller will also be called operator.

2. Types of processed data

2.1. Device data and usage data

When accessing the website of the operator, the following data is automatically transmitted to our server by your browser:

• Date and time of access
• URL of the referring website
• Requested website
• Size of the data sent
• Browser type and browser version
• Operating system
• Your IP address at the time of access
• Cookies

For a server to be able to deliver data to a recipient, it needs the IP address of the recipient. An IP address is a unique address on a network and is assigned to devices attached to the network. It makes the devices of the receiver addressable and therefore accessible.

The operator uses cookies. Cookies are textual information that can be stored and read on your computer. Cookies may be set by the operator himself or, if third-party services are involved, also by these third-party services. As part of a cookie, not only data but also unique identifiers of a user can be stored (cookie IDs). In this way, cookies and thus also the storing devices can be clearly identified.

You can prevent the setting of cookies by configuring your Internet browser accordingly. If the blocking of cookies results in restrictions of certain features, it will be outlined under the respective processing purposes below. In addition, you can delete previously set cookies in your Internet browser or as part of separate software solutions.

3. Purposes of processing

3.1. Statistics and analysis of user behavior (internal processing)

The device and usage data (2.1) is processed for statistical purposes and the analysis of user behavior according to the following principles:

• As part of the processing, the IP address is shortened and thus anonymized. Identification of the user via the IP address is therefore no longer possible.
• The shortened IP addresses are needed to provide statistics on the geographic origin of Web page accesses.
• The data is processed separately from personal data that is collected elsewhere (eg data from contact forms or data that become known after login with username and password).
• As part of the processing, a cookie with a unique identifier is set. The identifier differs from identifiers that can be associated with personal data (eg the id assigned to you when logging in with username and password).

Legal basis of processing
There is a legitimate interest within the meaning of Art. 6 (1) lit. f GDPR.
In particular, the collection of data for statistical purposes and for user behavior analysis is needed to improve the quality of the service.

Balance of interests
The anonymization of IP addresses and the separate processing of personal data that is collected elsewhere make it impossible to assign personal data to specific users.

Opt-Out
You can suppress the storage of cookies or delete cookies later (see 2.1.).

3.2. Statistics and analysis of user behavior by Google Analytics 4 (GA4)

This website uses Google Analytics 4 (GA4), a web analytics service provided by Google LLC.

Google Analytics generates statistics and user behavior reports for the operator of this site. This helps us understand how our website is used, which pages are visited, and how we can improve our services.

Strict Privacy Configuration (Consent Mode v2 Basic)
This website employs a strict "Basic Consent Mode" configuration. By default, upon your first visit, Google Analytics is set to a "denied" state. No behavioral analytics data, advertising data, or diagnostic data is transmitted to Google unless you explicitly grant consent via our privacy banner.

For maximum privacy, the service is configured as follows:

• Google Signals is deactivated: It is NOT possible to assign data, sessions, and interactions across multiple devices to a logged-in Google account. We do not use cross-device tracking or profiling.
• Data Minimization (Location & Device): Granular location and device data collection is disabled. Your location is only registered at the country level; specific city-level tracking is blocked.
• No User-Provided Data: The collection of user-provided data capabilities (such as hashed emails from forms) is turned completely off.
• IP Anonymization: IP anonymization is active by default in GA4. Your full IP address is never logged or stored by Google.
• Strict Data Governance: Data is never automatically marked as consented. Analytics data is only collected if the explicit consent signal is received from our Consent Management Platform.

More information about Google Analytics can be found at https://marketingplatform.google.com/about/analytics/terms/us/

The Google Privacy Policy can be found at https://policies.google.com/privacy?hl=en

Purpose of processing
The purpose of processing is to analyze user behavior for individual anonymized users or as part of aggregated user data, as well as to measure success in the form of statistics on the number of users and the intensity of use over time.

Legal basis of processing
The processing of your data through Google Analytics only takes place if you have given your explicit prior consent. The legal basis is Art. 6 (1) lit. a GDPR.

Recipients or categories of recipients
Google LLC
1600 Amphitheater Parkway
Mountain View, CA 94043
USA

Transmission to non-EU-foreign countries
If consent is given, the anonymized information generated about your use of this website is transmitted to a Google server in the USA and stored there. A commissioned-processing contract (Data Processing Agreement) has been closed with Google.

Storage duration or its criteria
Due to the lack of unique cross-site user IDs and the strict anonymization measures in place, data cannot be assigned to specific, identifiable users.

Withdrawal of Consent / Opt-Out

• You can withdraw your consent at any time, with effect for the future, by opening the "Privacy & Messaging" / "Cookie Settings" link at the bottom of our website and adjusting your preferences.
• Alternatively, you can prevent Google Analytics from using your data by installing the browser add-on available at https://tools.google.com/dlpage/gaoptout.

The deactivation of tracking has no negative effect on the functionality of the website.

Automated decision-making and profiling
Automated decision-making or profiling is not employed.

3.3. Google AdSense

This website uses Google AdSense to deliver ads to its users. Google AdSense is a service of Google LLC.

We utilize the Google AdSense Consent Management Platform (CMP) to ensure strict compliance with international privacy regulations, including the GDPR (Europe) and state-level privacy laws in the United States.

European Economic Area (EEA) and UK Users:

• Strict Prior Consent (Consent Mode v2): The Google AdSense service is completely blocked and will not load personalized or non-personalized tracking cookies until you provide explicit consent via our privacy banner (Art. 6 para. 1 lit. a GDPR).
• Transparency and Control: We utilize Google's In-Ad transparency controls, allowing you to see why specific ads are shown. All third-party creatives are strictly checked for consent compliance.
• Legitimate Interest Controls: Essential, non-cookie functions (such as fraud prevention and invalid click detection) are active to ensure the security and integrity of the ad network.

United States Users (State Regulations Strategy):

• Restricted Data Processing (RDP): For users in applicable US states, we have automatically enabled Account-Level Restricted Data Processing. This restricts how Google uses personal data and prevents the "sale" or "sharing" of personal information for cross-context behavioral advertising.
• Global Privacy Control (GPC): Our systems automatically detect and respect "Global Privacy Control" signals sent from your web browser. If you have GPC enabled, you will automatically be opted out of personalized advertising.

Recipients or categories of recipients
Google LLC
1600 Amphitheater Parkway
Mountain View, CA 94043
United States

Withdrawal of Consent / Opt-Out
You can manage your advertising preferences or withdraw your consent at any time by:

• Clicking the "Privacy Options", "Cookie Consent", or "Do Not Sell or Share My Personal Information" link located in the footer of this website to adjust your banner settings.
• Adjusting the corresponding settings in your browser (e.g., enabling Global Privacy Control).
• Opting out of interest-based ads directly via Google at https://www.google.com/settings/ads.
• Opting out of interest-based ads from participating vendors via the About Ads self-regulatory campaign at https://www.aboutads.info/choices.

4. Disclosure of data to third parties

4.1. Web Hosting and Infrastructure (AWS)

Our website and services are hosted on the infrastructure of Amazon Web Services (AWS).

• Provider: Amazon Data Services Inc., 410 Terry Avenue North, Seattle, WA 98109, USA.
• Location of Processing: Data is processed in the AWS Region US-West (Northern California).
• Purpose: Provision of web server capacity (EC2), load balancing, and storage to ensure the functionality, performance, and availability of our online services for our primary user base.
• Legal Basis: There is a legitimate interest within the meaning of Art. 6 (1) lit. f GDPR. Our interest lies in the use of a high-performance, scalable, and secure infrastructure that provides optimal low-latency access for our users in the United States.
• Data Transfer to Third Countries: Personal data is transferred to the USA. This transfer is legally secured by the following mechanisms:
  • EU-U.S. Data Privacy Framework: Amazon is certified under this framework, which establishes an adequate level of data protection as recognized by the European Commission.
  • Standard Contractual Clauses (SCCs): These are included in the AWS Data Processing Addendum (DPA) as a secondary safety mechanism to ensure protection in accordance with European standards.
• Security Measures: We have configured our AWS environment with advanced technical measures, including encryption in transit (via TLS/SSL) and encryption at rest, to ensure a high level of data security.

4.2. Cloudflare (CDN, Firewall, and Bot Detection)

We use the services of Cloudflare Inc. (101 Townsend St., San Francisco, CA 94107, USA) to secure our website and optimize loading times (Content Delivery Network - CDN).

Nature and Scope of Processing
Cloudflare operates a reverse proxy. Consequently, all traffic to and from our website is routed through Cloudflare's infrastructure. In this process, the following data is collected:

• Your IP address
• System configuration information
• Information about traffic to and from our website (Log data)

Cloudflare uses this data to identify and block malicious traffic (Web Application Firewall - WAF), detect automated "bot" attacks, and mitigate Distributed Denial of Service (DDoS) attacks. To recognize legitimate users and distinguish them from malicious bots, Cloudflare may place a necessary cookie (e.g., __cf_bm or _cfuvid) on your device. These cookies are used solely for security and performance purposes and do not track user behavior for marketing.

Purpose and Legal Basis
The use of Cloudflare is based on our legitimate interest in providing a secure and error-free website and defending against cyberattacks (Art. 6 para. 1 lit. f GDPR).

Data Processing Agreement & International Transfer
We have entered into a Data Processing Agreement (DPA) with Cloudflare based on the EU Standard Contractual Clauses (SCCs). While Cloudflare is a US-based provider, it routes European traffic through regional data centers whenever possible. Cloudflare is certified under the EU-U.S. Data Privacy Framework, ensuring an adequate level of data protection.

For more information, please see the Cloudflare Privacy Policy.

5. Additional Information for United States Residents (CCPA/CPRA)

If you are a resident of the United States (specifically California, Virginia, Colorado, Connecticut, or Utah), the following additional disclosures apply:

• No Sale or Sharing: We do not "sell" your personal information or "share" it for cross-context behavioral advertising as defined by the CCPA/CPRA.
• Service Providers: We use Cloudflare and AWS as "Service Providers" to maintain our website security and operations. They are contractually prohibited from using your data for any other purpose.
• Your Rights: You have the right to request access to, deletion of, and correction of your personal data. You may exercise these rights by contacting us at [email protected].
• Global Privacy Control (GPC): Our website is configured to detect and honor GPC signals from your browser to automatically opt you out of non-essential tracking.

6. Rights of the persons concerned

You have the following rights under the General Data Protection Regulation:

Right of access by the data subject in accordance with Art. 15 GDPR
You have the right to request confirmation from us as to whether personal data relating to you is being processed and to information on the nature, extent, purpose and duration of the processing and the disclosure of the data to third parties.

Right to rectification according to Art. 16 GDPR
You have the right to demand immediate correction of incorrect personal data concerning you.

Right to erasure according to Art. 17 GDPR
You have the right to demand that personal data relating to you be deleted without delay, inter alia, if the processing is no longer necessary for the intended purpose or if you revoke a previously granted consent and if so there is no other legal basis for storage.

Right to restriction of processing according to Art. 18 GDPR
You have the right to ask us to restrict the processing, especially if a deletion is not possible for legal reasons.

Right to data portability According to Art. 20 GDPR
You have the right to receive the personal data that you have provided to us in a structured, common and machine-readable format and to transmit the data to third parties.

Right to object according to Art. 21 GDPR
You have the right to object to the processing of personal data relating to you on the basis of your particular situation at any time, in accordance with Article 6 (1) (e) or (f); this also applies to profiling based on these provisions.

Automated individual decision-making, including profiling according to Art. 22 GDPR
You have the right not to be subjected to a decision based solely on automated processing, which will have a legal effect on you or significantly affects you in a similar manner.

Withdrawal of consent according to Art. 7 Abs. 3 GDPR
If the processing of your data is based on a consent, you have the right to revoke your consent at any time.

Right to lodge a complaint with a supervisory authority according to Art. 77 GDPR
Without prejudice to any other administrative or judicial remedy, every data subject shall have the right to lodge a complaint with a supervisory authority, in particular in the Member State of his or her habitual residence, place of work or place of the alleged infringement if the data subject considers that the processing of personal data relating to him or her infringes this Regulation.