Privacy Policy

1. Introduction

Below we inform you about the processing of personal data when using

• our website www.diabelly.de
• our social media profiles.

Personal data means all data that can be related to a specific natural person, e.g. their name or IP address.

1.1 Contact details

The controller pursuant to Art. 4(7) of the EU General Data Protection Regulation (GDPR) is DiaBelly, Am Ring 17, Wardenburg, Germany, e-mail: support@diabelly.de. We are legally represented by Bero Klahr.

Our data protection officer can be reached via heyData GmbH, Schützenstraße 5, 10117 Berlin, www.heydata.eu, e-mail: datenschutz@heydata.eu.

1.2 Scope of data processing, processing purposes and legal bases

We explain the scope of data processing, processing purposes and legal bases in detail below. In principle, the following may serve as the legal basis for data processing:

• Art. 6(1)(a) GDPR serves as the legal basis for processing operations for which we obtain consent.
• Art. 6(1)(b) GDPR is the legal basis where the processing of personal data is necessary for the performance of a contract, e.g. when a website visitor purchases a product from us or we perform a service for them. This legal basis also applies to processing that is necessary for pre-contractual measures, such as enquiries about our products or services.
• Art. 6(1)(c) GDPR applies where processing of personal data is necessary to fulfil a legal obligation, e.g. under tax law.
• Art. 6(1)(f) GDPR serves as the legal basis where we can rely on legitimate interests to process personal data, e.g. for the technical operation of our website.

1.3 Data processing outside the EEA

Where we transfer data to service providers or other third parties outside the EEA, adequacy decisions by the EU Commission pursuant to Art. 45(3) GDPR guarantee the security of the data during transfer, where these exist, e.g. for the United Kingdom, Canada and Israel.

Where data is transferred to service providers in the USA, the legal basis for the transfer is an adequacy decision by the EU Commission, provided the service provider has additionally certified under the EU-US Data Privacy Framework.

In other cases (e.g. where no adequacy decision exists), the legal basis for the data transfer is, as a rule, i.e. unless we indicate otherwise, standard contractual clauses. These are a set of rules adopted by the EU Commission and form part of the contract with the respective third party. Pursuant to Art. 46(2)(b) GDPR, they guarantee the security of the data transfer. Many providers have given contractual guarantees beyond the standard contractual clauses that protect the data beyond these clauses, e.g. guarantees regarding the encryption of data or a duty on the third party to notify data subjects if law enforcement authorities wish to access data.

1.4 Storage duration

Unless expressly stated in this privacy policy, the data stored by us will be deleted as soon as it is no longer required for its intended purpose and there are no statutory retention obligations preventing deletion. If the data is not deleted because it is required for other legally permissible purposes, its processing will be restricted, i.e. the data will be blocked and not processed for other purposes. This applies, for example, to data that we must retain for commercial or tax law reasons.

1.5 Rights of data subjects

Data subjects have the following rights with respect to their personal data:

• Right of access,
• Right to rectification or erasure,
• Right to restriction of processing,
• Right to object to processing,
• Right to data portability,
• Right to withdraw consent at any time.

Data subjects also have the right to lodge a complaint with a supervisory authority regarding the processing of their personal data. Contact details of data protection supervisory authorities are available at https://www.bfdi.bund.de/DE/Service/Anschriften/Laender/Laender-node.html.

1.6 Obligation to provide data

Customers, interested parties or third parties are only required to provide us with the personal data that is necessary for the establishment, performance and termination of the business relationship or other relationship, or that we are legally obliged to collect. Without this data, we will generally have to refuse to conclude a contract or provide a service, or will no longer be able to perform an existing contract or other relationship.

Mandatory information is marked as such.

1.7 No automated decision-making in individual cases

We do not in principle use fully automated decision-making pursuant to Article 22 GDPR to establish and perform a business relationship or other relationship. Should we use such procedures in individual cases, we will inform you separately if required by law.

1.8 Contact

When you contact us, e.g. by e-mail, telephone or messenger service, we store the data provided to us (e.g. names and e-mail addresses) in order to respond to queries. The legal basis for the processing is our legitimate interest (Art. 6(1)(f) GDPR) in responding to enquiries directed to us. We delete the data arising in this context once storage is no longer necessary, or restrict processing if statutory retention obligations exist.

2. Newsletter

We reserve the right to inform customers who have already used our services or purchased goods from time to time by e-mail or other means about our offers, provided they have not objected. The legal basis for this data processing is Art. 6(1)(f) GDPR. Our legitimate interest lies in direct marketing (recital 47 GDPR). Customers may object to the use of their e-mail address for marketing purposes at any time without additional cost, for example via the link at the end of each e-mail or by e-mail to our address stated above.

Interested parties have the option of subscribing to a free newsletter. We process the data provided at registration solely for sending the newsletter. Registration is completed by selecting the relevant field on our website, ticking the relevant field in a paper document or by another unambiguous action, whereby interested parties express their consent to the processing of their data, so that the legal basis is Art. 6(1)(a) GDPR. Consent may be withdrawn at any time, e.g. by clicking the corresponding link in the newsletter or by notifying us at our e-mail address above. The processing of data until withdrawal remains lawful even after withdrawal.

• We send newsletters using the Resend tool of the provider Plus Five Five, Inc., 2261 Market Street #5039, San Francisco, CA 94114, USA. The provider processes content, usage, meta/communication data and contact data in the USA. Further information is available in the provider's privacy policy at https://resend.com/legal/privacy-policy.

3. Data processing on our website

3.1 Notice for website visitors from Germany

Our website sets only the technically necessary cookie diabelly_language, which saves your language preference (duration: 1 year; SameSite=Lax). Under § 25(2)(2) TDDDG (German Telecommunications-Digital-Services Data Protection Act) no consent is required, as this is a strictly necessary technical cookie serving exclusively the service explicitly requested by visitors (language selection). No tracking or analytics cookies are set; no consent banner is therefore required.

The subsequent data processing is carried out in accordance with the following sections and on the basis of the GDPR.

3.2 Informational use of the website

When the website is used for informational purposes, i.e. when website visitors do not separately transmit information to us, we collect the personal data that the browser transmits to our server in order to ensure the stability and security of our website. This is our legitimate interest, so the legal basis is Art. 6(1)(f) GDPR.

This data includes:

• IP address
• Date and time of the request
• Time zone difference from Greenwich Mean Time (GMT)
• Content of the request (specific page)
• Access status / HTTP status code
• Amount of data transferred
• Website from which the request originates
• Browser
• Operating system and its interface
• Language and version of the browser software.

This data is also stored in log files. It is deleted when storage is no longer necessary, and at the latest after 14 days.

Anonymous, cookie-free reach measurement

To understand which content is helpful, we count page views in fully anonymous form. No cookies are set, no IP addresses are stored and no fingerprinting is used. Only the following are recorded: the page visited, the time, the approximate time spent and a broad browser category (e.g. 'Firefox') to distinguish automated access (bots) from human visits. It is not possible to identify individual persons; no personal data is processed.

3.3 Web hosting and provision of the website

Our website is hosted by Replit. The provider is Replit, Inc., 767 Bryant St. #203, San Francisco, CA 94107, USA. The website is hosted on servers in a data centre in the European Union (Google Cloud, EU region). The provider processes the personal data transmitted via the website, essentially the technical data and IP addresses in server log files mentioned under section 3.2.

As Replit is a provider based in the USA, a transfer of personal data to the USA cannot be excluded. The data transfer is safeguarded by the guarantees described under section 1.3 (adequacy decision by the EU Commission in conjunction with the EU-US Data Privacy Framework and/or EU standard contractual clauses). A data processing agreement has been concluded with the provider. Further information can be found in the provider's privacy policy at https://replit.com/site/privacy.

It is our legitimate interest to provide a website securely and reliably, so the legal basis for the data processing described is Art. 6(1)(f) GDPR.

The domain www.diabelly.de is managed by ALL-INKL.COM. The provider is René Münnich (“ALL-INKL.COM – Neue Medien Münnich”), Hauptstraße 68, 02742 Friedersdorf. The provider provides domain and DNS management only; the website content is not hosted there. Further information can be found in the provider's privacy policy at https://all-inkl.com/datenschutzinformationen/.

3.4 Payment service providers

For processing payments we use payment processors who are themselves data controllers within the meaning of Art. 4(7) GDPR. Where they receive data entered by us during the ordering process and payment data, we thereby fulfil the contract concluded with our customers (Art. 6(1)(b) GDPR).

• Stripe Payments Europe, Ltd., Ireland

4. Data processing on social media platforms

We have a presence on social media networks in order to present our organisation and services. The operators of these networks regularly process their users' data for advertising purposes. Among other things, they create user profiles from their online behaviour, which are used, for example, to display advertising on the networks' pages and elsewhere on the internet that corresponds to users' interests. To do so, the network operators store information about usage behaviour in cookies on users' computers. It cannot be excluded that the operators combine this information with other data. Further information and guidance on how users can object to processing by the network operators can be found in the privacy policies of the respective operators listed below. It is also possible that the operators or their servers are located in non-EU countries, meaning they process data there. This may result in risks for users, e.g. because enforcement of their rights is made more difficult or government authorities access the data.

When network users contact us via our profiles, we process the data communicated to us in order to respond to the enquiries. This is our legitimate interest, so the legal basis is Art. 6(1)(f) GDPR.

4.1 Facebook

We maintain a profile on Facebook. The operator is Meta Platforms Ireland Ltd., 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland. The privacy policy is available here: https://www.facebook.com/policy.php. An option to object to data processing is available via the ad settings: https://www.facebook.com/settings?tab=ads. On the basis of an agreement we are jointly responsible with Facebook within the meaning of Art. 26 GDPR for processing data of visitors to our profile. Facebook explains what data is processed in detail at https://www.facebook.com/legal/terms/information_about_page_insights_data. Data subjects may exercise their rights both against us and against Facebook. Under our agreement with Facebook, however, we are required to forward requests to Facebook. Data subjects will therefore receive a faster response if they contact Facebook directly.

4.2 Instagram

We maintain a profile on Instagram. The operator is Meta Platforms Ireland Ltd., 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland. The privacy policy is available here: https://help.instagram.com/519522125107875.

5. Amendments to this privacy policy

We reserve the right to amend this privacy policy with effect for the future. An up-to-date version is available here at all times.

6. Questions and comments

For questions or comments regarding this privacy policy, please contact us using the contact details above.