Privacy policy

Privacy Policy

Preamble

With the following privacy policy, we would like to inform you about the types of your personal data (hereinafter also referred to as "data") we process, for what purposes, and to what extent. This privacy policy applies to all processing of personal data carried out by us, both in the context of providing our services and in particular on our websites, in mobile applications, and within external online presences, such as our social media profiles (hereinafter collectively referred to as the "online offering").

The terms used are not gender-specific.

Last updated: 8 July 2026

Table of Contents

  • Preamble
  • Controller
  • Overview of Processing Activities
  • Relevant Legal Bases
  • Security Measures
  • Transmission of Personal Data
  • International Data Transfers
  • General Information on Data Storage and Deletion
  • Rights of Data Subjects
  • Provision of the Online Offering and Web Hosting
  • Use of Cookies
  • Contact and Inquiry Management
  • Changes and Updates
  • Definitions

Controller

Maximilian Braun Alte-Jakobstraße 167 10969 Berlin Email: hallo@cloudsofa.de

Overview of Processing Activities

The following overview summarises the types of data processed and the purposes of their processing, and refers to the data subjects concerned.

Types of data processed

  • Contact data
  • Content data
  • Usage data
  • Meta, communication and procedural data
  • Log data

Categories of data subjects

  • Communication partners
  • Users

Purposes of processing

  • Communication
  • Security measures
  • Organisational and administrative procedures
  • Feedback
  • Provision of our online offering and user experience
  • IT infrastructure

Relevant Legal Bases

Relevant legal bases under the GDPR: Below you will find an overview of the legal bases of the GDPR on which we process personal data. Please note that in addition to the provisions of the GDPR, national data protection regulations may apply in your or our country of residence or establishment.

  • Consent (Art. 6(1)(a) GDPR) — The data subject has given consent to the processing of their personal data for one or more specific purposes.
  • Performance of a contract and pre-contractual enquiries (Art. 6(1)(b) GDPR) — Processing is necessary for the performance of a contract to which the data subject is party, or in order to take steps at the request of the data subject prior to entering into a contract.
  • Legitimate interests (Art. 6(1)(f) GDPR) — Processing is necessary for the purposes of the legitimate interests pursued by the controller or a third party, provided that such interests are not overridden by the interests or fundamental rights and freedoms of the data subject.

National data protection provisions: In the country where the controller is established, national data protection regulations apply in addition to the GDPR.

Security Measures

We implement appropriate technical and organisational measures in accordance with legal requirements, taking into account the state of the art, implementation costs, and the nature, scope, circumstances and purposes of the processing, as well as the varying likelihood and severity of the risk to the rights and freedoms of natural persons, in order to ensure a level of protection appropriate to the risk.

These measures include in particular safeguarding the confidentiality, integrity and availability of data by controlling physical and electronic access to the data, as well as access, input, disclosure, ensuring availability and separation of the data. We have also established procedures to ensure the exercise of data subject rights, the deletion of data, and responses to data security threats. Furthermore, we take the protection of personal data into account from the outset in the development and selection of hardware, software and processes, in accordance with the principle of privacy by design and privacy by default.

TLS/SSL encryption (HTTPS): To protect the data of users transmitted via our online services from unauthorised access, we use TLS/SSL encryption technology.

Transmission of Personal Data

In the course of processing personal data, it may be transmitted to or disclosed to other bodies, companies, legally independent organisational units or persons. Recipients of such data may include, for example, service providers entrusted with IT tasks, or providers of services and content integrated into a website. In such cases, we comply with legal requirements and in particular conclude appropriate contracts or agreements with the recipients of your data to protect your data.

International Data Transfers

Data processing in third countries: Where we transfer data to a third country (i.e. outside the European Union (EU) or the European Economic Area (EEA)), or where this occurs in the context of using third-party services or disclosing or transferring data to other persons, bodies or companies, this is always done in accordance with legal requirements.

For data transfers to the USA, we rely primarily on the Data Privacy Framework (DPF), which was recognised as a secure legal framework by an adequacy decision of the EU Commission on 10 July 2023.

General Information on Data Storage and Deletion

We delete personal data that we process in accordance with legal requirements as soon as the underlying consents are revoked or no further legal basis for processing exists.

Data that must be retained for commercial or tax law reasons, or whose storage is necessary for the pursuit of legal claims or the protection of the rights of other natural or legal persons, must be archived accordingly.

Our privacy notices contain additional information on the retention and deletion of data that apply specifically to certain processing activities.

Where multiple retention periods or deletion deadlines are specified for a piece of data, the longest period shall always apply.

Rights of Data Subjects

Rights of data subjects under the GDPR: As a data subject, you have various rights under the GDPR, arising in particular from Articles 15 to 21 GDPR:

  • Right to object: You have the right to object at any time, on grounds relating to your particular situation, to the processing of personal data concerning you which is carried out on the basis of Art. 6(1)(e) or (f) GDPR.
  • Right to withdraw consent: You have the right to withdraw consent given at any time.
  • Right of access: You have the right to request confirmation as to whether data concerning you is being processed, and to obtain information about such data as well as further information and a copy of the data in accordance with legal requirements.
  • Right to rectification: You have the right, in accordance with legal requirements, to request the completion or correction of inaccurate data concerning you.
  • Right to erasure and restriction of processing:You have the right, in accordance with legal requirements, to request that data concerning you be deleted without undue delay.
  • Right to data portability: You have the right to receive data concerning you that you have provided to us, in a structured, commonly used and machine-readable format, in accordance with legal requirements.
  • Right to lodge a complaint with a supervisory authority: You have the right to lodge a complaint with a supervisory authority, in particular in the Member State of your habitual residence, place of work, or place of the alleged infringement.

Provision of the Online Offering and Web Hosting

We process users' data in order to provide them with our online services. For this purpose, we process the user's IP address, which is necessary to transmit the content and functions of our online services to the user's browser or device.

  • Types of data processed: Usage data; meta, communication and procedural data; log data.
  • Data subjects: Users.
  • Purposes of processing: Provision of our online offering and user experience; IT infrastructure; security measures.
  • Legal basis: Legitimate interests (Art. 6(1)(f) GDPR).

Further notes on processing activities:

  • Provision of the online offering on rented server space.
  • Collection of access data and log files: Log file information is stored for a maximum of 30 days and then deleted or anonymised.

Use of Cookies

The term "cookies" refers to functions that store and retrieve information on users' devices. We use cookies in accordance with legal requirements.

  • Types of data processed: Meta, communication and procedural data.
  • Data subjects: Users.
  • Legal bases: Legitimate interests (Art. 6(1)(f) GDPR). Consent (Art. 6(1)(a) GDPR).

Contact and Inquiry Management

When you contact us, and in the context of existing user and business relationships, we process the information provided by the enquiring parties to the extent necessary to respond to contact enquiries and any requested measures.

  • Types of data processed: Contact data; content data; meta, communication and procedural data.
  • Data subjects: Communication partners.
  • Purposes of processing: Communication; organisational and administrative procedures; feedback; provision of our online offering.
  • Legal bases: Legitimate interests (Art. 6(1)(f) GDPR). Performance of a contract and pre-contractual enquiries (Art. 6(1)(b) GDPR).

Changes and Updates

We ask you to regularly inform yourself about the content of our privacy policy. We update the privacy policy as soon as changes to the data processing activities we carry out make this necessary.

Definitions

This section provides an overview of the terms used in this privacy policy.

  • Content data: Information generated in the course of creating, editing and publishing content of all kinds.
  • Contact data: Essential information that enables communication with persons or organisations.
  • Meta, communication and procedural data:Categories containing information about the manner in which data is processed, transmitted and managed.
  • Usage data: Information that records how users interact with digital products, services or platforms.
  • Personal data: Any information relating to an identified or identifiable natural person.
  • Log data: Information about events or activities recorded in a system or network.
  • Controller: The natural or legal person who alone or jointly with others determines the purposes and means of the processing of personal data.
  • Processing: Any operation or set of operations performed on personal data, whether or not by automated means.

Created with the free privacy policy generator by Dr. Thomas Schwenke.