Version: 11 August 2026

Privacy Policy

1. Controller

2. Accessing this website

When you access the website, the web server processes technical connection data, in particular your IP address, date and time, requested page, referrer, browser and operating system information. Processing is necessary to deliver the website, maintain security and investigate faults or attacks. The legal basis is Article 6(1)(f) GDPR. Our legitimate interests are secure and reliable operation of the website.

Server log data is deleted or anonymised when it is no longer needed for security and operational purposes, unless a security incident requires longer retention. Our technical hosting provider may receive this data as a processor.

3. Language and session cookies

We use only technically necessary cookies: a language cookie remembers the selected language for up to one year; a temporary session cookie protects forms and the administration area. The session cookie expires when the browser session ends. The legal basis is section 25(2) no. 2 TDDDG and, for subsequent processing, Article 6(1)(f) GDPR. We do not use analytics or advertising cookies.

4. Email updates

If you subscribe to updates about our new project, we process your email address, chosen language, the wording and version of your consent, subscription and confirmation times, a shortened user-agent string and a pseudonymous hash of your IP address. These details document consent and help prevent misuse.

The legal basis for sending updates is your consent under Article 6(1)(a) GDPR and section 7(2) no. 2 UWG. We use double opt-in: we send a confirmation link and only activate the address after it is clicked. Confirmation links expire after 48 hours; unconfirmed entries are deleted after seven days. We do not use opening or click tracking.

Emails are sent through the mail server configured for this website. Your email provider receives the messages as intended. We do not use the address for unrelated purposes and do not sell it.

5. Withdrawal and double opt-out

You may withdraw your consent at any time using the “Unsubscribe” link in the footer or a cancellation link in an email. We send a confirmation link to the subscribed address so that third parties cannot cancel it without access to the mailbox. The link expires after 24 hours. From the time cancellation is requested, the address is suppressed from update mailings. After confirmation, the address and its newsletter records are deleted. The lawfulness of processing before withdrawal remains unaffected.

6. Recipients and storage

Access to newsletter data is limited to authorised persons and service providers required for the secure operation and delivery of the emails. We store active subscription data until consent is withdrawn. Data used solely to protect the form from misuse is deleted after 24 hours.

7. Your rights

Subject to the legal requirements, you have rights of access, rectification, erasure, restriction, data portability and objection. Where processing is based on consent, you can withdraw it at any time. Contact us using the details above.

You also have the right to lodge a complaint with a data protection supervisory authority. Our competent authority is the Bavarian State Office for Data Protection Supervision (BayLDA), www.lda.bayern.de.

8. Security and changes

We use appropriate technical and organisational safeguards, including encrypted HTTPS transmission, access controls, hashed one-time tokens and storage outside the public web directory. We may update this policy when the website or legal requirements change.