Privacy

This is a non-binding translation. Only the German version of this page is legally binding.

The protection of personal data is important to us. This website is a lean pre-launch page and processes only a minimum of data. The following provides information pursuant to Art. 13 GDPR about this processing.

1. Controller

Represented by Creutzenberg Beteiligungs GmbH, which in turn is represented by managing directors Dominic Albers and Christian Deerberg. Further details in the legal notice.

2. Data protection officer

secom IT GmbH
Email: dsb.creutzenberg-norderney@secom-it.gmbh

3. Hosting and server log files

This website is hosted with Vercel Inc., 340 S Lemon Ave #4133, Walnut, CA 91789, USA. When the site is accessed, the server automatically processes technically necessary access data transmitted by the browser used (including IP address, date and time of access, file/URL retrieved, amount of data transferred, referrer, browser type and operating system). This data is used exclusively for the secure, stable operation and delivery of the website.

The legal basis is the legitimate interest in a secure and efficient provision of the website (Art. 6(1)(f) GDPR). A data processing agreement (Art. 28 GDPR) is in place with Vercel. As Vercel is a US company, processing may take place in the USA; the transfer is safeguarded by the EU Standard Contractual Clauses and/or certification under the EU-US Data Privacy Framework.

4. Cookies, consent & storage on your device

Without consent, only information required to operate the website is stored on your device. Cookies for statistics or advertising are only set after explicit consent. The two purposes can be enabled separately in the consent dialogue and withdrawn at any time.

On your first visit, a dialogue asks which categories you allow. The following is stored:

• edda_consent (cookie, one year): the decision made for each category, with a timestamp. Required so that your choice is respected on every subsequent visit.
• edda-nl-variant (local storage): which of two versions of the incentive text is shown in the newsletter form (value “A” or “B”, assigned at random), so that the same person sees the same version on repeat visits. No personal reference.
• edda-nl-confirmed-sent (session storage, for the duration of the session only): prevents a reload of the confirmation page from being counted as a second sign-up. Contains only a yes value, no email address.
• edda-click-params (session storage, for the duration of the session only and only with consent to marketing): campaign parameters from the address you called up – “gclid”, “gbraid”, “wbraid”, “fbclid” and the “utm_*” values – as well as the time, landing page and referring page. They serve to trace which advertisement led to a newsletter sign-up. Without this consent, nothing is stored. If the form is submitted while the parameters are still in the address, they are transmitted for this attribution only – which is not storage on your device. The values go solely to our own server, not to Google.
• After consent to statistics, the Google Analytics cookies (“_ga”, “_ga_*”) are added; after consent to marketing, those of Google Ads (“_gcl*”) and of the Meta pixel (“_fbp”, “_fbc”). See section 5.

The legal basis for storing and reading information on your device is § 25 TDDDG: consent (§ 25(1) TDDDG) for statistics, marketing and the campaign parameters; technical necessity (§ 25(2) no. 2 TDDDG) for storing the consent decision itself, the display variant and the session marker of the confirmation page. Consent given can be withdrawn or adjusted at any time with effect for the future; the campaign parameters are deleted upon withdrawal:

Change cookie settings

5. Reach measurement and advertising (only with consent)

With your consent, Vercel Web Analytics and Vercel Speed Insights (provider: Vercel Inc., USA) are used for anonymous reach and performance measurement. These services work without cookies and do not recognise individuals across devices. Aggregated usage data is processed, such as pages visited, referrer, approximate region, device/browser type and technical performance metrics (e.g. load times). No complete IP addresses are stored permanently.

In addition – likewise only with consent and without personal reference – it is recorded which of the two text variants (see section 4) was shown in the newsletter form and whether a sign-up followed. This internal A/B test serves solely to improve the wording and is not linked to individuals.

The legal basis is consent (Art. 6(1)(a) GDPR in conjunction with § 25(1) TDDDG). Without consent these services are not loaded. The safeguards named in section 3 apply to data transfers to the USA.

Google Tag Manager (Google Ireland Limited) is used to integrate the Google services named below. It serves only to manage these services technically and does not itself collect personal data. The container used is shared across the group's properties; data collected on this website is processed separately by domain. Tag Manager is only loaded after consent has been given – without consent, no connection to Google is established.

With consent to the “Statistics” category, Google Analytics 4 (measurement ID G-QK1EVJBFRN) is used, a web analytics service provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (“Google”). Google processes usage data such as pages visited, time on page, approximate region, device and browser information, and automatically recorded interaction events (including scrolling and clicks on external links) in order to provide anonymised statistics on site usage.

Google Analytics is configured with privacy in mind: Google truncates or anonymises the IP address before storage, and Google Signals (cross-device recognition) is disabled. Whether data may be used for advertising purposes depends solely on separate consent to the “Marketing” category (see below). If it is not given, no link to Google advertising networks takes place.

If consent already given is withdrawn, the cookies set by Google are actively deleted from the browser – separately by category, i.e. “_ga” and “_ga_*” when statistics is withdrawn, “_gcl*” when marketing is withdrawn. A data processing agreement with Google is in place on the basis of the Google data processing terms (Art. 28 GDPR). As processing may also be carried out by Google LLC, USA, the safeguards named in section 3 apply accordingly.

Particularities of automatic event collection (“Enhanced Measurement”):

• Site search: This website currently has no internal search function. Search terms are therefore not generated as URL parameters (e.g. “q”, “search”, “query”) and not transmitted to Google. Should a search function be added in future, it will be ensured that no personal search terms are transmitted to Google via the URL.
• Forms: For the newsletter sign-up (see section 6), Google Analytics automatically records only that a form was started or submitted – not the content entered. The email address is transmitted solely to our own server and is not passed on to Google.
• File downloads: No downloadable files (e.g. PDFs) are currently offered. Should documents be made available for download in future, care will be taken that file names contain no personal details, as Google Analytics automatically records file name and link.

With consent to the “Marketing” category, Google Ads (Google Ireland Limited) and the Meta pixel (Meta Platforms Ireland Limited) are additionally used:

• Conversion measurement: It is measured whether a session started via a Google ad led to a confirmed newsletter sign-up (see section 6). What is transmitted is the event itself together with a randomly generated transaction number – no email address, no name, not even in encrypted form.
• Remarketing: Google can recognise visitors to this website in order to show them advertisements for EDDA on other websites. Google sets cookies (“_gcl*”) on the device for this purpose.
• Meta pixel: A counting pixel from Meta records the visit to this page so that advertisements on Facebook and Instagram can be evaluated and visitors can be shown relevant advertisements for EDDA there. What is transmitted is the page view; Meta sets the cookies “_fbp” and “_fbc” for this. No email address and no name are transmitted, not even in encrypted form. Meta processes the data as an independent controller; the safeguards named in section 3 apply to processing by Meta Platforms Inc. in the USA.

The legal basis is consent (Art. 6(1)(a) GDPR in conjunction with § 25(1) TDDDG). Without this consent, no cookie is set and no event transmitted for either Google Ads or the Meta pixel; the services are not loaded at all. Withdrawal is possible at any time via the link at the end of this page, takes effect independently of consent to statistics, and deletes the cookies named. The safeguards named in section 3 apply to data transfers to the USA.

6. Newsletter sign-up (double opt-in)

You can sign up for the newsletter on this website. The double opt-in procedure is used for this: after signing up, a confirmation email is sent to the email address provided. Only after the sign-up has been confirmed via the link contained in that email, valid for 30 days, is the address added to the newsletter distribution list. This ensures that the sign-up was actually made by the owner of the email address.

The procedure in detail: when the form is submitted, the email address is transmitted to the service provider named below and stored there, initially without being added to any distribution list. The provider then sends the confirmation email. Only the click on the confirmation link causes the contact to be added to the newsletter list; you are then redirected to a confirmation page on this website. If the link is not clicked, no addition to the distribution list takes place and no further emails are sent; the entry is deleted after 30 days at the latest. Technical log data on the sign-up attempt and the confirmation email sent is deleted automatically at the provider after 24 months at the latest.

Data processed: The following data is collected and processed as part of the sign-up: the email address (mandatory), optionally first and last name, the source of the sign-up, the version of the consent text accepted, the time of sign-up and confirmation, the text variant shown in the internal A/B test (see sections 4 and 5), the consents given at the time of sign-up and – if the visit came via an advertisement – the campaign parameters named in section 4 together with a randomly generated transaction number. The IP address is not transmitted to the sending service provider; to protect against automated repeat requests it is cached on the server for 60 seconds only (rate limiting) and not used further afterwards.

Legal basis: Processing of the data for sending the newsletter is based on consent pursuant to Art. 6(1)(a) GDPR. Consent can be withdrawn at any time with effect for the future – for example by unsubscribing via the link contained in every email or by contacting us using the details in the legal notice.

Service provider used: The email marketing provider Brevo SA, 8 rue de Londres, 75009 Paris, France (“Brevo”) is used to send the newsletter and carry out the double opt-in procedure. The data collected during newsletter sign-up is processed on Brevo's servers. A data processing agreement pursuant to Art. 28 GDPR is in place with Brevo, obliging Brevo to process the data solely according to our instructions and in accordance with the GDPR and not to pass it on to third parties. Further information on data protection at Brevo can be found in Brevo's privacy policy.

Storage period: Without confirmation there is no addition to the newsletter distribution list; the entry is deleted after 30 days at the latest. Supplementary technical log data (sign-up attempt, confirmation email sent) is deleted automatically after 24 months at the latest. Once confirmed, the data is stored for as long as the newsletter is subscribed to. After unsubscribing or withdrawing consent, the master data is deleted or blocked, unless statutory retention obligations apply; proof of confirmation is retained separately for up to 24 months for legal defence purposes.

7. Fonts

The fonts used are delivered locally from our own server. When the page is accessed, no connection to third-party servers (such as Google Fonts) is established and no IP address is transmitted to third parties.

8. Link to Instagram

Our Instagram profile is linked in the footer area. This is a simple link; only after clicking does a redirection to Instagram (Meta Platforms Ireland Ltd.) take place, where Meta's privacy terms apply. Merely visiting this page does not transmit any data to Meta.

9. SSL/TLS encryption

For security reasons, this site uses SSL/TLS encryption. An encrypted connection can be recognised by “https://” in the browser's address bar.

10. Storage period

Personal data is only processed for as long as is necessary for the purposes stated or as statutory retention periods require. Server log files are deleted or anonymised after a short time. The entries on your device remain stored for the periods named in section 4, at most until withdrawal or until they are deleted in the browser. The periods for the newsletter sign-up are named in section 6.

11. Data subject rights

You have the rights to access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and objection (Art. 21). Consent given can be withdrawn at any time with effect for the future (Art. 7(3) GDPR).

You also have the right to lodge a complaint with a data protection supervisory authority, for example the competent authority: the State Commissioner for Data Protection of Lower Saxony (Die Landesbeauftragte für den Datenschutz Niedersachsen), Prinzenstraße 5, 30159 Hanover, Germany.

12. Changes

This privacy policy will be updated as soon as the functional scope of the website changes or legal requirements make this necessary. The version published here at any given time applies.