Privacy policy

Controller

The controller for data processing on this website is GILDEPARTNER GmbH, Röntgenstrasse 53, 27798 Hude, Germany, phone +49 4408 809282, email info@gildepartner.com.

Under the applicable statutory requirements we are not obliged to appoint a data protection officer. For questions concerning data protection please use the contact details above.

Principle

We process personal data exclusively within the framework of the applicable law, in particular the General Data Protection Regulation (GDPR) and the German Federal Data Protection Act (BDSG). This website is available over an encrypted connection (TLS).

We collect only the data required to operate the website and to handle your enquiry. Data are not passed on for advertising purposes.

Visiting the website and server log files

When you visit this website, our hosting provider IONOS automatically stores information in server log files that your browser transmits. In particular:

• IP address of the requesting device, which according to IONOS is anonymised
• date and time of access
• name and URL of the file retrieved
• volume of data transferred and notification of successful retrieval
• browser type and operating system used
• referrer URL, where transmitted

The legal basis is article 6 (1) (f) GDPR. Our legitimate interest lies in providing the website free of technical faults and in its security. According to IONOS, the log files are deleted after eight weeks at the latest, unless they are required to investigate a specific security incident.

Visitor statistics (IONOS WebAnalytics)

To see how the website is used, we use the visitor statistics of our hosting provider IONOS. It evaluates exclusively the server log files described above and aggregates them into statistics, such as the number of visitors, page views, most visited pages, referring pages, and browsers and operating systems. No cookies are set for this, no script runs on our pages and your device is not accessed. According to IONOS, the IP address is anonymised as soon as it is collected. We only see the aggregated figures, not individual visits.

The legal basis is Art. 6 Abs. 1 lit. f GDPR; our legitimate interest lies in evaluating the use of the website and improving its content. You may object to this processing under Art. 21 GDPR. IONOS processes the data on our behalf (see Hosting and email).

Cookies and storage on your device

On the public pages of this website we set no cookies and use no comparable techniques such as your browser's local storage. There is no reach measurement using cookies, tracking pixels or scripts on these pages (for the visitor statistics based on server log files see Visitor statistics); no third-party content or services are embedded, and fonts and images are delivered from our own server. The German and the English version are separate pages; your choice of language is not stored there. If your browser's language setting suggests the other version, a short note points to it when you open a page. For this, a script on your device reads your browser's language setting and checks whether you came from another page of this website. The result stays in your browser; it is neither transmitted to us nor stored.

As with any website, your browser keeps files such as images, fonts and the stylesheet in its cache so that the pages load faster on your next visit. We tell it how long to keep them: stylesheet and script for one week, images, fonts and PDF files for up to one year; the pages themselves are requested afresh from our server each time. These files contain no personal data. The legal basis is § 25 Abs. 2 Nr. 2 TDDDG. You can clear the cache in your browser at any time.

The protected area is an exception. When you open that area, already on its sign-in page, a strictly necessary cookie is set there. It contains a randomly generated identifier and nothing else; the associated session data are held on our server. The cookie is only sent to the pages of that area. It is a session cookie without a fixed expiry date, which your browser normally deletes when you close it; independently of that, the sign-in becomes invalid after 60 minutes of inactivity and at the latest twelve hours after signing in. It keeps you signed in during the session and protects the forms in that area against misuse; without it, signing in is technically impossible. The legal basis for storing and reading it is § 25 Abs. 2 Nr. 2 TDDDG; no consent is required. How we process the related data is described in the section “Protected area”.

In addition, we make individual content available in advance to selected persons on password-protected preview pages. After successful sign-in, a strictly necessary session cookie is set on these pages, which serves solely to maintain the sign-in. It contains the user ID of the preview access, the times of sign-in and of the last activity, a randomly generated access value for the image and video files of the preview page, which changes every twelve hours, and a checksum to protect against manipulation; we do not store any information about your sign-in on our servers. The cookie is sent only to the preview page concerned and is normally deleted when you close your browser. Independently of that, the sign-in ends when you sign out, after 30 minutes of inactivity, and at the latest twelve hours after signing in. Without this cookie, signing in is technically impossible. The legal basis for storing and reading it is § 25 Abs. 2 Nr. 2 TDDDG; no consent is required for this. Insofar as personal data are processed in this context, this is done on the basis of Art. 6 Abs. 1 lit. f GDPR; our legitimate interest lies in protecting non-public content against unauthorised access.

Contact form, email and telephone

If you contact us via the contact form, by email or by telephone, we process the data you provide (name, company, email address, telephone number, subject and message text) in order to answer your enquiry.

The legal basis is article 6 (1) (b) GDPR where your enquiry serves the initiation or performance of a contract, and otherwise article 6 (1) (f) GDPR on the basis of our legitimate interest in answering enquiries.

We delete these data once the enquiry has been dealt with conclusively and no statutory retention periods stand in the way. Retention obligations under commercial and tax law remain unaffected.

In addition, we keep a copy of every enquiry sent through the contact form on our server, so that no enquiry is lost if an email is not delivered, and to detect spam. The copy contains the details you entered in the form, the time, the result of the automatic spam check, the result of sending, and a pseudonymised short code of your internet connection derived from your IP address. We delete it automatically after 90 days. To fend off mass submissions, we also count for ten minutes how often messages were sent from that short code. The legal basis is Art. 6 Abs. 1 lit. f GDPR; our legitimate interest lies in receiving enquiries reliably and in preventing misuse.

Protected area

For clients and business partners we operate a non-public area in which we provide documents on individual projects. Accounts are set up by invitation only; there is no self-registration. Sign-in works without a password, using the email address and a code that we send by email for each sign-in.

In doing so we process:

• name, email address, chosen language, and the role and project access of the account, in order to set up the account, assign the documents intended for you, and send you the invitation and sign-in codes
• the six-digit sign-in code, exclusively as a hash value; we delete it as soon as it has been used, after five incorrect entries or after ten minutes
• the time the account was set up, the time of the invitation and the time of the last sign-in, in order to identify accounts that are no longer used. If an invitation is not used for 30 days, we block the account automatically.
• a log of sign-ins, downloads and changes with the time, the email address of the account acting or affected, the type of event, where applicable the project and file name, and a pseudonymised short code of your internet connection derived from your IP address. It serves to detect and prevent unauthorised access and to keep track of who had access to which documents. We do not store the IP address itself in this log. If a code is requested for an address for which no account exists, we log only that event, not the address entered.
• a temporary block to prevent misuse: if too many codes are requested or entered incorrectly for an email address or from an internet connection, sign-in is blocked for 15 minutes. For that period we store a hash value of the email address or the short code of the connection together with the time.
• session data on our server while you are signed in (see Cookies)
• the documents provided in this area, insofar as they contain personal data. We upload documents ourselves; depending on their role, parties outside GILDEPARTNER, such as owners or advisers, may also upload documents. The documents of a project can be seen by our staff and by all accounts the project has been shared with.

The legal basis for setting up and operating the account is Art. 6 Abs. 1 lit. b GDPR (performance of the client or contractual relationship and pre-contractual measures). The legal basis for the log and the block is Art. 6 Abs. 1 lit. f GDPR; our legitimate interest lies in protecting confidential documents against unauthorised access. You may object to this processing under Art. 21 GDPR.

We delete the account and the related data as soon as it is no longer needed for our cooperation, at the latest when you ask us to. We delete documents provided as soon as they are no longer needed for the project concerned. Log entries are deleted automatically after twelve months, session data one hour after the last activity, and block entries after 15 minutes. Statutory retention obligations, for example under §§ 147 AO, 257 HGB or § 8 GwG, remain unaffected where they apply in the individual case.

The area is operated on our web space at IONOS; invitations and sign-in codes are sent through the IONOS mail server. See the section Hosting and email.

Without the data listed we cannot set up an account. There is no statutory or contractual obligation to provide these data to us.

Fonts and external content

The fonts used on this website are served locally from our own server. No connection to Google servers is established.

All images and the script of the website are likewise served from our own server. No content delivery network or other external service is embedded.

Hosting and email

This website and the protected area are hosted on the web space of IONOS SE, Elgendorfer Str. 57, 56410 Montabaur, Germany. The website also sends emails through the IONOS mail server: enquiries from the contact form to us, and invitations and sign-in codes for the protected area. IONOS processes the data on our behalf under a data processing agreement (Art. 28 GDPR) and within the European Union. IONOS backs up the web space daily; deleted data may remain in these backups for up to 14 days. To check the publicly accessible pages daily from the outside for malware, IONOS uses the service provider SiteLock LLC in the USA; this transfer is based on the European Commission's standard contractual clauses (Art. 46 Abs. 2 lit. c GDPR). Visitor data and data from the protected area are not subject to this check.

Our mailboxes at @gildepartner.com are operated by Microsoft Ireland Operations Limited, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, D18 P521, Ireland (Microsoft 365, Exchange Online). Emails you send us arrive there, including enquiries from the contact form. Microsoft processes the data on our behalf under the Microsoft Products and Services Data Protection Addendum (Art. 28 GDPR). A transfer of personal data to the USA cannot be ruled out, for example for support, security and operation of the service. Microsoft Corporation is certified under the EU-U.S. Data Privacy Framework; these transfers are therefore covered by an adequacy decision of the European Commission (Art. 45 GDPR). In addition, the European Commission's standard contractual clauses apply (Art. 46 Abs. 2 lit. c GDPR).

Recipients and processing on our behalf

Your data are transferred to third parties only where this is necessary to handle your enquiry, where you have consented or where we are legally obliged to do so. Where service providers process data on our behalf, in particular those named in the section Hosting and email, data processing agreements under article 28 GDPR are in place.

Your rights

You have the following rights with regard to your personal data:

• access under article 15 GDPR
• rectification under article 16 GDPR
• erasure under article 17 GDPR
• restriction of processing under article 18 GDPR
• data portability under article 20 GDPR
• objection to processing based on legitimate interests under article 21 GDPR
• withdrawal of consent with effect for the future under article 7 (3) GDPR

An informal message to the contact details given above is sufficient to exercise these rights.

Right to lodge a complaint

You have the right to lodge a complaint with a data protection supervisory authority. The authority responsible for our company is the State Commissioner for Data Protection of Lower Saxony, Prinzenstrasse 5, 30159 Hanover, Germany.

Changes to this policy

We adapt this privacy policy whenever changes to the website or to the legal situation make this necessary. The version available on this page applies in each case.