Legal
Privacy notice
Information under Articles 13 and 14 GDPR. This page is written so that you can find the purpose, legal basis, retention period and recipients of any processing on a single line.
Last updated:
Controller
Article 4(7) GDPR
The controller within the meaning of Article 4(7) GDPR is:
Musterreinigung Berlin GmbHMusterstraße 110115 Berlinhallo@musterreinigung-berlin.de030 1208 4990No data protection officer has been appointed. Under § 38 (1) of the German Federal Data Protection Act there is no obligation to appoint one as long as fewer than 20 people are permanently engaged in the automated processing of personal data. Please send any data protection enquiry to the address above.
What we process, and why
Article 13 GDPR
One row per processing activity. Unless stated otherwise, the retention periods are the ones our daily deletion job actually runs.
| Purpose | Data | Legal basis | Retention | Recipients |
|---|---|---|---|---|
| Serving the website, defending against attacks, diagnosing faults | IP address, timestamp, address requested, browser and device identifier | Article 6(1)(f) GDPR (legitimate interest) | Short-term at the host; never combined with other data | Vercel Inc. |
| Handling your enquiry and preparing a quotation | Name, company, email, telephone, role, site details, your message | Article 6(1)(b) GDPR (contract and pre-contractual steps) | 12 months after the enquiry closes, if no contract results | Supabase, Vercel Inc., Resend |
| Performing the contract and meeting commercial and tax retention obligations | Contract data and the enquiry data the contract grew out of | Article 6(1)(c) GDPR (legal obligation) | Duration of the contract plus 3 years; reviewed by a person | Supabase |
| Running the price estimator and improving its ranges | Your entries for area, frequency and services — no name, no contact details | Article 6(1)(f) GDPR (legitimate interest) | 24 months | Supabase |
| Protecting the forms against automated submissions | A verification token from Cloudflare Turnstile, hashed IP address, browser identifier | Article 6(1)(f) GDPR (legitimate interest) | Counters for 24 hours; the hashed IP address is deleted after 6 months | Cloudflare, Supabase |
| Proving your consent, as Article 7(1) GDPR requires us to be able to do | The verbatim consent text you were shown, timestamp, hashed IP address, language | Article 6(1)(c) GDPR (legal obligation) | Duration of the matter plus 3 years | Supabase |
| Confirmations, appointment proposals and replies to your enquiry | Email address, name, reference number, delivery and open status | Article 6(1)(b) GDPR (contract and pre-contractual steps) | 12 months | Resend, Supabase |
| Sending the newsletter after confirmed sign-up (double opt-in) | Email address, time of sign-up and of confirmation | Article 6(1)(a) GDPR (consent) | Until you withdraw; every email carries an unsubscribe link | Resend, Supabase |
| Providing requested documents such as the specification template or the compliance dossier | Email address, document requested, timestamp | Article 6(1)(a) GDPR (consent) | 12 months | Supabase, Resend |
| Reach measurement: which pages are read and where enquiries originate | Pseudonymous identifier, pages viewed, events, coarse location | Article 6(1)(a) GDPR (consent) | Up to 7 years at PostHog; with no linking identifier; only with your consent | PostHog Ltd. |
| Detecting and fixing technical faults in your browser | Error message, page address, technical context data; form contents are removed before transmission | Article 6(1)(a) GDPR (consent) | 90 days; only with your consent | PostHog Ltd. |
| Detecting and fixing technical faults on our servers | Error message, affected route, technical context data; neither form contents nor your IP address | Article 6(1)(f) GDPR (legitimate interest) | 90 days | PostHog Ltd., Vercel Inc. |
Processors
Article 28 GDPR
These providers process data on our behalf and solely on our instructions (Article 28 GDPR).
| Provider | For what | Processing location | Third-country transfer | Processing agreement |
|---|---|---|---|---|
| Vercel Inc., 340 S Lemon Ave #4133, Walnut, CA 91789, USA | Hosting the website and running its server functions | Frankfurt (fra1) | EU standard contractual clauses | Being prepared |
| Supabase, Inc., 970 Toa Payoh North, Singapore 318992 | Database and file storage for enquiries, attachments and consent records | Frankfurt (eu-central-1) | EU standard contractual clauses | Being prepared |
| Resend, Inc., 2261 Market Street, San Francisco, CA 94114, USA | Sending every email to you and to us | Irland (eu-west-1) | EU standard contractual clauses | Being prepared |
| PostHog Ltd., 30 Stamford Street, London SE1 9LQ, Vereinigtes Königreich (Muttergesellschaft: PostHog, Inc., San Francisco, USA) | Reach measurement and error diagnostics — only with consent | Frankfurt (EU Cloud) | Adequacy decision (United Kingdom) | Being prepared |
| Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107, USA | Spam protection on the forms, using Turnstile | Global (Anycast) | EU standard contractual clauses | Being prepared |
Transfers to third countries
Articles 44-49 GDPR
Your data is processed in the European Union. Some of the providers named above are based in the USA and may access data there in individual cases, for example for maintenance and support. The basis for this is the EU Commission’s standard contractual clauses under Art. 46(2)(c) GDPR. For PostHog, the EU Commission’s adequacy decision on the United Kingdom under Art. 45 GDPR applies in addition; the processing itself takes place in Frankfurt. A residual risk cannot be entirely ruled out: US authorities can demand access under certain conditions, and you have no legal remedy against this equivalent to those available in Europe.
Cookies and similar technologies
§ 25 TDDDG
Without your consent we store only what is necessary to operate the website: your language choice, your decision about the cookie notice, and the intermediate steps of the price calculator. Everything else — PostHog in particular — is loaded only after your consent. You can change this decision at any time via “Cookie settings” in the footer; a withdrawal takes effect for the future.
Security of processing
Article 32 GDPR
The site is served over an encrypted connection (TLS) only. Your browser has no access to our database: forms are processed on the server, and the database key never leaves it. IP addresses are stored only as a hash, which is deleted after six months. Fonts and images are served from our own origin, so simply opening a page sends no data to third parties.
Your rights
Articles 15-21 GDPR
An informal message to the address above is enough for any of these. We reply within one month.
- Access (Article 15)
- You can ask whether and what data we process about you, and receive a copy of it.
- Rectification (Article 16)
- You can ask us to correct inaccurate data and to complete incomplete data.
- Erasure (Article 17)
- You can ask us to erase your data, unless a statutory retention obligation prevents it.
- Restriction (Article 18)
- You can ask us to restrict processing instead of erasing the data — for instance while its accuracy is being checked.
- Portability (Article 20)
- You can receive the data you gave us in a common, machine-readable format, or have it transmitted to another provider.
- Objection (Article 21)
- You can object to processing we base on a legitimate interest. We will then stop, unless we can demonstrate compelling legitimate grounds.
- Withdrawal of consent (Article 7(3))
- You can withdraw any consent at any time. Processing carried out before the withdrawal remains lawful.
- Complaint to a supervisory authority (Article 77)
- You can lodge a complaint with a supervisory authority, whether or not you have contacted us first.
Competent supervisory authority
Article 77 GDPR
The authority competent for us is the Berlin Commissioner for Data Protection and Freedom of Information, Alt-Moabit 59–61, 10555 Berlin. You may also contact the authority where you live.
Changes to this notice
Article 13(3) GDPR
We update this notice when the processing changes — for example when a provider is added. The version published here, bearing the date above, is the one that applies.