Privacy

This is a non-binding translation. Only the German version of this page is legally binding.

The protection of personal data is important to us. This website is a lean pre-launch page and processes only a minimum of data. The following provides information pursuant to Art. 13 GDPR about this processing.

1. Controller

Represented by Creutzenberg Beteiligungs GmbH, which in turn is represented by managing directors Dominic Albers and Christian Deerberg. Further details in the legal notice.

2. Data protection officer

secom IT GmbH
Email: dsb.creutzenberg-norderney@secom-it.gmbh

3. Hosting and server log files

This website is hosted with Vercel Inc., 340 S Lemon Ave #4133, Walnut, CA 91789, USA. When the site is accessed, the server automatically processes technically necessary access data transmitted by the browser used (including IP address, date and time of access, file/URL retrieved, amount of data transferred, referrer, browser type and operating system). This data is used exclusively for the secure, stable operation and delivery of the website.

The legal basis is the legitimate interest in a secure and efficient provision of the website (Art. 6(1)(f) GDPR). A data processing agreement (Art. 28 GDPR) is in place with Vercel. As Vercel is a US company, processing may take place in the USA; the transfer is safeguarded by the EU Standard Contractual Clauses and/or certification under the EU-US Data Privacy Framework.

4. Cookies, consent & storage on the end device

This website does not use marketing or tracking cookies. Processing that is not technically necessary (see statistics under item 5) only takes place after prior consent.

On first visit, a consent dialog asks whether anonymous statistics may be collected. The decision made is stored, as technically necessary, in the browser (local storage, key “edda-consent-v1”); no personal data is transmitted in doing so. Likewise stored in the browser as technically necessary is which of two variants of the incentive text in the newsletter form is shown (key “edda-nl-variant”; value “A” or “B”, assigned at random), so that the same person consistently sees the same version on repeat visits – without statistics consent and without any personal reference. The legal basis for storing and reading information on the end device is Section 25 TDDDG (German Telecommunications and Digital Services Data Protection Act) – for the statistics function based on consent (Section 25(1) TDDDG), for storing the consent decision and the text variant based on technical necessity (Section 25(2) No. 2 TDDDG).

Any consent given can be withdrawn or adjusted at any time with effect for the future:

Change cookie settings

5. Reach measurement / statistics (only with consent)

With corresponding consent, Vercel Web Analytics and Vercel Speed Insights (provider: Vercel Inc., USA) are used for anonymous reach and performance measurement. These services operate cookie-free and do not recognise individuals across devices. Aggregated usage data is processed, such as pages visited, referrer, approximate region, device/browser type, and technical performance metrics (e.g. load times). No complete IP addresses are stored permanently.

In addition – likewise only with consent and without any personal reference – it is recorded which of the two text variants (see item 4) was shown in the newsletter form and whether a sign-up resulted from it. This internal A/B test serves exclusively to improve the wording and is not linked to individual persons.

The legal basis is consent (Art. 6(1)(a) GDPR in conjunction with Section 25(1) TDDDG). Without consent, these services are not loaded. The safeguards mentioned under item 3 apply to the data transfer to the USA.

In addition – again only with prior consent – Google Analytics 4 (measurement ID G-QK1EVJBFRN) is used, a web analytics service of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (“Google”). Google processes usage data such as pages visited, time spent, approximate region, device and browser information, as well as automatically recorded interaction events (including scrolling, clicks on external links) in order to provide anonymised statistics on website usage.

Google Analytics is configured in a privacy-friendly way: the IP address is shortened or anonymised by Google before storage; Google Signals (cross-device recognition) and ad personalisation are disabled. No linking with Google advertising networks takes place.

If previously given consent is withdrawn, the cookies set by Google Analytics (including “_ga”, “_ga_*”) are actively deleted from the browser. A data processing agreement based on Google's data processing terms (Art. 28 GDPR) is in place with Google. As processing may also be carried out by Google LLC, USA, the safeguards mentioned under item 3 apply accordingly.

Special features of automatic event collection (“Enhanced Measurement”):

• Website search: This website currently has no internal search function. Search terms are therefore not generated as URL parameters (e.g. “q”, “search”, “query”) and are not transmitted to Google. Should a search function be added in the future, it will be ensured that no personal search terms are transmitted to Google via the URL.
• Forms: For the newsletter sign-up (see item 6), Google Analytics automatically records only that a form was started or submitted – not the content entered. The email address is transmitted exclusively directly to our own server and is not passed on to Google.
• File downloads: No downloadable files (e.g. PDFs) are currently offered. Should documents be made available for download in the future, care will be taken that file names do not contain personal information, since Google Analytics automatically records file name and link.

6. Newsletter sign-up (double opt-in)

This website offers the option to sign up for the newsletter. This uses the so-called double opt-in procedure: after signing up, a confirmation email is sent to the email address provided. Only after the sign-up has been confirmed via the link contained in that email, which is valid for 30 days, is the address added to the distribution list for sending the newsletter. This ensures that the sign-up was actually made by the holder of the email address.

Before confirmation, the email address is not added to the actual newsletter distribution list. For internal tracking of the sign-up process (so it remains apparent which sign-ups have not yet been confirmed), the address is additionally added to an internal overview list with the status “pending”; upon confirmation, the status is automatically updated to “confirmed”. This overview list serves exclusively for internal process tracking, not for sending advertising prior to confirmation. If no confirmation takes place, the entry is deleted after 30 days at the latest; supplementary technical log data on the sign-up attempt and the confirmation email sent by the service provider used (see below) is automatically deleted after 24 months at the latest.

Data processed: As part of the sign-up, the following data is collected and processed: the email address (mandatory), optionally first and last name, the source of the sign-up, the version of the accepted consent text, the time of sign-up and confirmation, the internal confirmation status (“pending”/“confirmed”), and the text variant of the internal A/B test shown (see items 4 and 5). The IP address is not transmitted to the sending service provider; to protect against automated repeated requests, it is stored server-side for a duration of 60 seconds only (rate limiting) and is not used further afterwards.

Legal basis: The processing of data for sending the newsletter is based on consent pursuant to Art. 6(1)(a) GDPR. Consent can be withdrawn at any time with effect for the future – for example by unsubscribing from the newsletter via the unsubscribe link contained in every email, or by contacting us using the contact details given in the legal notice.

Service provider used: The email marketing service provider Brevo SA, 8 rue de Londres, 75009 Paris, France (“Brevo”), is used to send the newsletter and carry out the double opt-in procedure. The data collected as part of the newsletter sign-up is processed on Brevo's servers. A data processing agreement pursuant to Art. 28 GDPR is in place with Brevo, obliging Brevo to process the data exclusively according to our instructions and in compliance with the GDPR, and not to pass it on to third parties. Further information on data protection at Brevo can be found in Brevo's privacy policy.

Retention period: If the data subject does not confirm the sign-up, it is never added to the actual newsletter distribution list; the entry in the internal overview list (status “pending”) is deleted after 30 days at the latest. Supplementary technical log data (sign-up attempt, confirmation email sent) at the sending service provider is automatically deleted after 24 months at the latest. Once confirmed, the data is stored for as long as the newsletter subscription remains active. After unsubscribing from the newsletter or withdrawing consent, the core data is deleted or blocked, unless statutory retention obligations prevent this; proof of confirmation is retained separately for up to 24 months for legal defence purposes.

7. Fonts

The fonts used are delivered locally from our own server. When the page is accessed, no connection to third-party servers (such as Google Fonts) is established and no IP address is transmitted to third parties.

8. Link to Instagram

Our Instagram profile is linked in the footer area. This is a simple link; only after clicking does a redirection to Instagram (Meta Platforms Ireland Ltd.) take place, where Meta's privacy terms apply. Merely visiting this page does not transmit any data to Meta.

9. SSL/TLS encryption

For security reasons, this site uses SSL/TLS encryption. An encrypted connection can be recognised by “https://” in the browser's address bar.

10. Retention period

Personal data is only processed for as long as necessary for the purposes stated or as required by statutory retention periods. Server log files are deleted or anonymised after a short time. The consent decision remains stored until withdrawn or deleted in the browser.

11. Data subject rights

You have the rights to access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and objection (Art. 21). Consent given can be withdrawn at any time with effect for the future (Art. 7(3) GDPR).

You also have the right to lodge a complaint with a data protection supervisory authority, for example the competent authority: the State Commissioner for Data Protection of Lower Saxony (Die Landesbeauftragte für den Datenschutz Niedersachsen), Prinzenstraße 5, 30159 Hanover, Germany.

12. Changes

This privacy policy will be updated as soon as the functional scope of the website changes or legal requirements make this necessary. The version published here at any given time applies.