Privacy

Marc Trinklein
Am Wasen 10
97318 Kitzingen, Germany
Email address: social@zodrik.de

The following overview summarises the types of data processed and the purposes of processing, and refers to the persons concerned.

Types of data processed

• Contact data.
• Content data.
• Meta, communication and procedural data.
• Log data.

Categories of data subjects

• Communication partners.
• Users.

Purposes of processing

• Communication.
• Security measures.
• Feedback.
• Provision of our online services and user-friendliness.
• Information technology infrastructure.

Relevant legal bases under the GDPR: Below is an overview of the legal bases of the GDPR on which we process personal data. Please note that, in addition to the provisions of the GDPR, national data protection rules may apply in your or our country of residence or establishment. Should more specific legal bases be relevant in individual cases, we will inform you of them in this privacy policy.

• Performance of a contract and pre-contractual requests (Art. 6(1)(1)(b) GDPR) – Processing is necessary for the performance of a contract to which the data subject is party, or in order to take steps at the request of the data subject prior to entering into a contract.
• Legal obligation (Art. 6(1)(1)(c) GDPR) – Processing is necessary for compliance with a legal obligation to which the controller is subject.
• Legitimate interests (Art. 6(1)(1)(f) GDPR) – Processing is necessary for the purposes of the legitimate interests of the controller or a third party, provided that these are not overridden by the interests, fundamental rights and freedoms of the data subject which require protection of personal data.

National data protection rules in Germany: In addition to the data protection rules of the GDPR, national data protection rules apply in Germany. These include in particular the Federal Data Protection Act (BDSG). The BDSG contains in particular special provisions on the right of access, the right to erasure, the right to object, the processing of special categories of personal data, processing for other purposes, and transfers and automated individual decision-making including profiling. The data protection acts of the individual German federal states may also apply.

In accordance with the statutory requirements, and taking into account the state of the art, the costs of implementation, the nature, scope, context and purposes of processing, and the varying likelihood and severity of the risk to the rights and freedoms of natural persons, we take appropriate technical and organisational measures to ensure a level of protection appropriate to the risk.

These measures include in particular safeguarding the confidentiality, integrity and availability of data by controlling physical and electronic access to the data, as well as access to, input, transfer, securing of availability and separation of the data. We have also established procedures to ensure that data subjects can exercise their rights, that data are erased, and that we respond to threats to the data. We further take the protection of personal data into account when developing or selecting hardware, software and procedures, in line with the principles of data protection by design and by default.

Shortening of the IP address: The server logs store the IP address in shortened form (also known as “IP masking”): 11.22.33.44 becomes 11.22.0.0. The shortening is intended to prevent, or make substantially more difficult, the identification of a person by means of their IP address.

Securing online connections with TLS/SSL encryption (HTTPS): To protect users' data transmitted via our online services from unauthorised access, we use TLS/SSL encryption technology. It encrypts the information transmitted between the website and the user's browser. When a website is secured by an SSL/TLS certificate, this is indicated by HTTPS in the URL.

We erase the personal data we process in accordance with the statutory provisions as soon as there is no further legal basis for processing. This applies where the original purpose of processing no longer exists or the data are no longer needed. Exceptions apply where statutory obligations or special interests require longer retention or archiving of the data.

In particular, data that must be retained for reasons of commercial or tax law, or whose storage is necessary for the pursuit of legal claims or to protect the rights of other natural or legal persons, must be archived accordingly.

Our privacy notices contain additional information on the retention and erasure of data that applies specifically to certain processing operations.

Where several retention periods or erasure deadlines are stated for an item of data, the longest period always applies. Data that are no longer retained for their original purpose but because of statutory requirements or other reasons are processed exclusively for the reasons that justify their retention.

Retention and erasure of data: The following general periods apply to retention and archiving under German law:

• 10 years – Retention period for books and records, annual financial statements, inventories, management reports, opening balance sheets and the working instructions and other organisational documents required to understand them (§ 147(1) no. 1 in conjunction with (3) AO, § 257(1) no. 1 in conjunction with (4) HGB).
• 8 years – Accounting vouchers, such as invoices and expense receipts (§ 147(1) nos. 4 and 4a in conjunction with (3) sentence 1 AO, § 14b(1) UStG and § 257(1) no. 4 in conjunction with (4) HGB).
• 6 years – Other business documents: commercial or business letters received, copies of commercial or business letters sent, and other documents insofar as they are relevant for taxation (§ 147(1) nos. 2, 3, 5 in conjunction with (3) AO, § 257(1) nos. 2 and 3 in conjunction with (4) HGB).
• 3 years – Data required to take account of potential warranty and damages claims or similar contractual claims and rights, and to process related enquiries, are stored for the regular statutory limitation period of three years (§§ 195, 199 BGB).

Periods beginning at the end of the year: If a period does not expressly begin on a specific date and is at least one year long, it starts automatically at the end of the calendar year in which the event triggering the period occurred.

Rights of data subjects under the GDPR: As a data subject you have various rights under the GDPR, arising in particular from Art. 15 to 21 GDPR:

• Right to object: You have the right to object at any time, on grounds relating to your particular situation, to the processing of personal data concerning you that is based on Art. 6(1)(e) or (f) GDPR; this also applies to profiling based on these provisions. If personal data concerning you are processed for direct marketing purposes, you have the right to object at any time to the processing of personal data concerning you for such marketing; this also applies to profiling insofar as it is related to such direct marketing.
• Right of access: You have the right to obtain confirmation as to whether data concerning you are being processed, and to access to those data as well as further information and a copy of the data in accordance with the statutory requirements.
• Right to rectification: In accordance with the statutory requirements, you have the right to have data concerning you completed or inaccurate data concerning you rectified.
• Right to erasure and restriction of processing: In accordance with the statutory requirements, you have the right to demand that data concerning you be erased without delay or, alternatively, that processing of the data be restricted.
• Right to data portability: In accordance with the statutory requirements, you have the right to receive data concerning you that you have provided to us in a structured, commonly used and machine-readable format, or to request their transmission to another controller.
• Complaint to a supervisory authority: Without prejudice to any other administrative or judicial remedy, you have the right to lodge a complaint with a data protection supervisory authority if you consider that the processing of your personal data infringes the GDPR. The complaint may be lodged in particular with a supervisory authority in the Member State of your habitual residence, your place of work or the place of the alleged infringement. The authority responsible for us is the Bavarian State Office for Data Protection Supervision (Bayerisches Landesamt für Datenschutzaufsicht).

We process users' data in order to provide our online services to them. For this purpose we process the user's IP address, which is necessary to deliver the content and functions of our online services to the user's browser or device.

• Types of data processed: Meta, communication and procedural data (IP addresses, time data); log data (log files on data retrieval and access times).
• Data subjects: Users (website visitors).
• Purposes of processing and legitimate interests: Provision of our online services and user-friendliness; information technology infrastructure; security measures.
• Retention and erasure: Server logs are erased after 7 days (see below).
• Legal bases: Legitimate interests (Art. 6(1)(1)(f) GDPR).

Further information on processing operations, procedures and services

• Provision of online services on rented storage space: To provide our online services, we use storage space, computing capacity and software rented from a web hosting provider; legal bases: legitimate interests (Art. 6(1)(1)(f) GDPR).
• Collection of access data and log files: Access to our online services is recorded in so-called “server log files”. These include the shortened IP address, the date and time of access, the file retrieved, the status code, the amount of data transferred, the previously visited page (referrer URL), and the browser and operating system. The log files serve the secure and stable operation of the website. From them the host also compiles a summarised access statistic that only we can view; legal bases: legitimate interests (Art. 6(1)(1)(f) GDPR). Erasure of data: The log files are erased after 7 days.
• Email sending and hosting: The web hosting services we use also include the sending, receipt and storage of emails. For these purposes, the addresses of recipients and senders, further information relating to the sending of emails (e.g. the providers involved) and the content of the respective emails are processed. The aforementioned data may also be processed to detect spam. Emails are generally encrypted in transit, but (unless end-to-end encryption is used) not on the servers from which they are sent and received. We therefore cannot accept responsibility for the transmission path of emails between the sender and receipt on our server; legal bases: legitimate interests (Art. 6(1)(1)(f) GDPR).
• ALL-INKL: Services in the field of providing information technology infrastructure and related services (e.g. storage space and/or computing capacity); service provider: ALL-INKL.COM – Neue Medien Münnich, owner: René Münnich, Hauptstraße 68, 02742 Friedersdorf, Germany; legal bases: legitimate interests (Art. 6(1)(1)(f) GDPR); website: all-inkl.com; privacy policy. A data processing agreement is in place.

When you contact us (by contact form or email), the details of the person making the enquiry are processed to the extent necessary to answer the enquiry and any measures requested.

• Types of data processed: Contact data (name, email address); content data (your message); meta, communication and procedural data (time data).
• Data subjects: Communication partners.
• Purposes of processing and legitimate interests: Communication; feedback.
• Retention and erasure: The email is deleted as soon as the enquiry has been dealt with and no statutory retention obligations stand in the way.
• Legal bases: Legitimate interests (Art. 6(1)(1)(f) GDPR); performance of a contract and pre-contractual requests (Art. 6(1)(1)(b) GDPR).

Contact form: The details from the form are sent to us by email. The website itself does not store them. To protect against misuse, only an anonymous daily counter is kept, which limits the number of messages. We use the data exclusively for the stated purpose of contact and communication.

This website does not set cookies and does not use tracking or analytics services or advertising.

Reading progress of the sample: The reading sample remembers your reading progress and the “Just read” and “Sound” settings in your browser's local storage, so that you can continue later from the same place. This information stays on your device and is not transmitted to us or to third parties. You can delete it at any time using “Start from the beginning” or in your browser's settings. The legal basis for storage on your device is § 25(2) no. 2 TDDDG, as it is necessary for the sample function you are using.

Fonts, images and music are loaded from our own server. No third-party services are embedded.

Suno: The “Music” page contains links to our profile and our songs on Suno. Only when you click one of these links do you leave our website, and the provider of that site then processes your data under its own responsibility. Playing the music on our website does not transmit any data to Suno.

Please check the content of our privacy policy regularly. We adapt the privacy policy as soon as changes to the data processing we carry out make this necessary. We will inform you as soon as the changes require action on your part (e.g. consent) or other individual notification.

Where we state addresses and contact information of companies and organisations in this privacy policy, please note that the addresses may change over time, and please check the details before making contact.

This section provides an overview of the terms used in this privacy policy. Where terms are defined by law, their statutory definitions apply. The following explanations are primarily intended to aid understanding.

• Content data: Content data comprise information generated in the course of creating, editing and publishing content of any kind, here in particular the text of your message.
• Contact data: Contact data are information that enables communication with persons or organisations, for example names and email addresses.
• Meta, communication and procedural data: This is information about the way data are processed, transmitted and managed, for example IP addresses and time data.
• Personal data: “Personal data” means any information relating to an identified or identifiable natural person (“data subject”); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person.
• Log data: Log data are information about events or activities recorded in a system or network, typically time stamps, IP addresses and other details about the use or operation of a system.
• Controller: “Controller” means the natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of the processing of personal data.
• Processing: “Processing” means any operation or set of operations performed on personal data, whether or not by automated means. The term is broad and covers practically any handling of data, whether collecting, analysing, storing, transmitting or erasing.