Horváth Digital Solutions™ (owner Semjon Horváth), Eichborndamm 90B, 13403 Berlin, Germany. No data protection officer appointed — use the contact details in §2 or the contact form.
Operate and secure our websites and products; handle enquiries and abuse/security reports; manage portal accounts and billing; send HDS Broadcast™ (our newsletter) to subscribers who opt in; provide Verify, Sentinel, DNS, email, hosting and related services as controller or processor depending on the activity (§4). System journals are retained intentionally up to 365 days for security analysis and incident investigation.
Access, rectification, erasure, restriction, portability, objection (Art. 21), and withdrawal of consent where processing is based on consent — details in §6. You may also lodge a complaint with a supervisory authority (§7).
Mainly Hetzner (DE hosting). Also Mollie (independent PSP), Lexware Office (Art. 28; bank-transfer remittance data via Lexware — Art. 14), OAuth IdPs (may involve US processing), Let’s Encrypt for TLS, and DNS anycast partners (third-country PoPs where relevant) — see §5 and the subprocessors page.
Marketing websites do not set HTTP cookies. Language preference is stored in the browser’s localStorage under hds_lang; essential customer-portal cookies are described in §4 (Cookies and local storage).
1. What this notice covers
This privacy notice explains how Horváth Digital Solutions™ (“HDS”, “we”) processes personal data in connection with our online services, product offerings, and customer portal for the domains listed below (each including all subdomains).
We do not use analytics services, heatmaps, advertising trackers, or marketing cookies on our marketing websites. Web fonts are served from our own sites.
horvath-digital.solutions
hdsio.eu
hdsio.de
hds-ns.com
hds-dev.cloud
2. Controller and contact
The controller within the meaning of Art. 4(7) of Regulation (EU) 2016/679 (General Data Protection Regulation — GDPR) and the German Federal Data Protection Act (BDSG) is:
Horváth Digital Solutions™
Owner: Semjon Horváth
Eichborndamm 90B
13403 Berlin
Germany
HDS has not appointed a data protection officer. For privacy enquiries and rights requests (Art. 15–22 GDPR), you may also use our contact form.
3. Controller, processor, and Art. 28
We allocate controller and processor roles by purpose. Where we determine purposes and means independently — website and forms, account administration, billing, platform integrity, security, and abuse prevention — we act as controller. Where we process personal data on a customer’s documented instructions (for example customer mailbox or hosting content, customer Verify embeds, customer Sentinel monitors, or customer DNS zone records), we act as processor under Art. 4(8) GDPR.
Processor processing begins only after an Art. 28 GDPR data processing agreement (or other legally binding arrangement) has been agreed via the customer portal, DocuSeal, or the applicable contract. The standard Art. 28 text is on our data processing agreement; publishing that page does not by itself conclude Art. 28. That Art. 28 arrangement — together with the Terms and Conditions — governs instructions, confidentiality, security, subprocessors, assistance with data-subject rights, deletion or return at the end of the service, and audits. Our Acceptable use policy governs how Services may be used; it is not the Art. 28 vehicle. Service levels are in the Service Level Agreement. The right of withdrawal is in the right of withdrawal.
The customer’s role depends on the customer’s actual purposes and means for the relevant activity and may be controller or processor. Where we act as processor, this notice does not replace the customer’s Art. 13 and Art. 14 GDPR information duties toward their end users. Some products involve a dual role: we are processor for customer-instructed content and controller only for short-lived platform security and operations data — detail is in the activity blocks under §4.
We implement appropriate technical and organisational measures under Art. 32 GDPR (access control, TLS in transit, logging of privileged access to customer content, environment separation, backup/restore, and incident handling appropriate to the risk). Further security details for processor relationships are set out in the data processing agreement.
4. How we process personal data
The following blocks describe our main processing activities in a short Q&A form (data, purpose and legal basis, recipients, retention, and role where dual). Retention periods are maxima; earlier deletion may occur when processing is no longer necessary. Art. 6 GDPR legal bases apply only to HDS’s independent controller processing. Where HDS acts solely as processor, the customer determines the purposes and legal basis; Art. 28 GDPR frames the processor relationship and is not an Art. 6 legal basis. Where Art. 6(1)(f) is cited, the specific legitimate interest is stated in that activity.
Personal data are obtained from you directly, collected automatically when you use our online services, or received from identity providers (GitHub or Google) when you sign in with OAuth. Account data from GitHub/Google is covered by this notice and by our first account communication (Art. 14 timing; Art. 14(5)(a) may apply where you already have the information). Where customers pay HDS by bank transfer, related remittance and transaction details on our business account may be obtained via Lexware’s bank connection (payer name, IBAN, amounts, dates, remittance text as shown on the account — most customers pay via Mollie). We provide the Art. 14 information through this notice under the dual Art. 14(3) triggers: (a) within one month of obtaining the data; and (b) at the time of the first communication if we use the data to contact you. Where we hold only bank remittance data without further contact details, individual information may be limited under Art. 14(5) if disproportionate. Detail: Accounting (Lexware). We do not systematically obtain personal data from publicly accessible sources for profiling or scraping.
For our own controller activities we do not intentionally collect special categories of personal data (Art. 9 GDPR) through ordinary forms and services. Please do not submit such data unless necessary. Where we act as processor, customer content may contain special-category data depending on the customer’s use; the customer determines the Art. 9 basis.
Commercial and tax retention under German law (§ 257 HGB; § 147 AO), as applicable from 1 January 2025: typically 10 years for trading books, inventories, opening balance sheets, annual accounts and related organisational documents; 8 years for booking vouchers; and 6 years for commercial correspondence. Periods generally begin at the end of the calendar year in which the document was created, received or sent. Where personal data in our records fall under those duties, the statutory period applies and may extend the product-specific periods below.
Data: IP address, timestamp, requested resource, referrer, user agent, and error metadata in server and application logs on Hetzner servers in Germany that we configure and operate. Rate limiting may use IP addresses and short-lived technical signals (typically minutes-scale or less).
Purpose and legal basis: Provide and secure the website, diagnose faults, and defend against abuse — Art. 6(1)(f) (providing a secure, functional website and defending it against abuse); Art. 6(1)(b) where pre-contractual steps apply. Rate limiting: Art. 6(1)(f) (protecting infrastructure from overload and automated abuse).
Recipients: Hetzner (Germany).
Retention: Web access/error logs max. 14 days; syslog-class max. 28 days; system journal (IP, request data, timestamps only) up to 365 days as an intentional maximum for security analysis, incident investigation, and operational understanding, with earlier deletion when no longer needed. Rate-limit signals: short-lived (minutes-scale or less).
Role: Controller.
Marketing websites: we do not use or set HTTP cookies. Language preference is stored in the browser’s localStorage under the key hds_lang (values de or en). Our sites write this preference automatically when you visit a locale-prefixed page or switch language. This storage is strictly necessary to provide the telecommunications service / end-user device function you requested under § 25 TDDDG (and corresponding ePrivacy rules). We do not use a consent banner for hds_lang. The preference remains on your device, is not transmitted to HDS for analytics, and is not used for advertising.
The customer portal uses only the essential cookies and local storage listed below for authentication/session, CSRF protection, and UI language — not for advertising or analytics. Mollie may use cookies or similar technologies for payment sessions, fraud prevention, and security under Mollie’s own privacy information (https://www.mollie.com/legal/privacy). HDS Verify™ embed.js does not set cookies and does not use browser local storage.
Purpose and legal basis: Provide and secure the service you requested — Art. 6(1)(b) for portal session/security storage; § 25 TDDDG for strictly necessary hds_lang / essential portal storage.
Recipients: Stored on your device; portal session data processed on Hetzner (Germany). Mollie as independent PSP where you pay online.
Retention: As in the table below; portal tokens rotated or revoked when no longer needed.
Role: Controller (HDS storage). Mollie is an independent controller for its own payment technologies.
Cookies and local storage
Name
Purpose
Duration
Storage
Flags
hds_accessToken
Session / keep logged in
1 hour
HTTP cookie
HttpOnly, Secure, SameSite=Strict
hds_refreshToken
Renew session
7 days
HTTP cookie
HttpOnly, Secure, SameSite=Strict
hds_csrfToken
CSRF protection (double-submit; portal JavaScript must read the value)
1 hour (aligned with access token)
HTTP cookie
Secure, SameSite=Strict — not HttpOnly (JS-readable for double-submit)
hds_lang
UI language preference (marketing sites and portal)
Until cleared or changed
localStorage
Strictly necessary under § 25 TDDDG; not an HTTP cookie
Data: Name, email, optional phone, subject, message, Verify tokens where used, and technical anti-abuse measures.
Purpose and legal basis: Respond to enquiries and take pre-contractual steps — Art. 6(1)(f) (responding to general enquiries and organising follow-up); Art. 6(1)(b) where clearly pre-contractual; Art. 6(1)(a) if optional consent is used.
Recipients: Hetzner (Germany). Forms may be protected by HDS Verify™.
Retention: Ordinary enquiries max. 30 days after fulfilment, then deleted, unless abuse/security or legal-claims retention applies. Statutory HGB/AO periods apply separately where records fall under commercial or tax retention.
Role: Controller.
Data: Email, optional name, report content, URLs/IPs you supply, evidence files (OpenPGP-encrypted payload), Verify tokens; a short plain envelope (subject/email/locale) may remain unencrypted for routing. Description and evidence files are encrypted with OpenPGP in your browser before upload.
Purpose and legal basis: Handle abuse reports and vulnerability disclosures; defend systems and legal claims — Art. 6(1)(f) (protecting systems, customers and legal claims, and processing security disclosures); Art. 6(1)(c) where retention is legally required; Art. 6(1)(a) if optional consent is used.
Recipients: Hetzner (Germany).
Retention: Normally deleted when no longer required; up to 2 years where reasonably necessary for investigation, documentation, prevention, correlation, or security follow-up; longer only for legal claims or statutory retention.
Role: Controller.
Data: SiteKey configuration; Redis challenge/PoW/token lifecycle; IP in rate-limit counters; optional request-time attestation evaluated in the request and not stored as a fingerprint. HDS does not receive passwords or other login credentials through Verify. embed.js sets neither cookies nor browser local storage.
Purpose and legal basis: Bot protection for forms, APIs and sign-in; operate Verify. Controller processing: Art. 6(1)(f) (protecting forms, APIs and sign-in against bots and automated abuse); Art. 6(1)(b) where Verify is a contractual service. Processor processing: customer determines purposes and legal basis; HDS processes on documented instructions under Art. 28.
Recipients: Hetzner Germany (operated by HDS). No verification-outcome reuse, fingerprinting, cross-customer reuse, advertising, or profiling.
Retention: Challenge ~5 min; PoW ~2 min; one-time tokens ~10 min (deleted on use); IP rate-limit counters ~1 min; SiteKey while configured.
Role: Controller when Verify protects HDS sites; processor when a customer embeds Verify for their bot protection (Art. 28 arrangement before processing). Controller processing is limited to short-lived IP-based rate-limit counters and ordinary infrastructure security/operations data.
Data: Monitor targets, check results, alert recipient emails; status-page operation. Public status pages do not set cookies for ordinary viewing; visitor IPs are not persisted for normal status-page views.
Purpose and legal basis: Uptime monitoring and status pages. Controller processing for platform security/ops: Art. 6(1)(b); Art. 6(1)(f) (securing and operating the monitoring/status platform). Processor processing for customer monitors and alert lists: customer determines purposes and legal basis under Art. 28.
Recipients: Hetzner Germany (operated by HDS). No advertising or profiling of customer monitor data.
Retention: Check history max. 365 days per configuration.
Role: Processor for customer monitors and alert lists; controller for status-platform security and operations only (short-lived IP/rate-limit signals and service-security events).
Data: Customer zone file content (processor); short-lived source-IP / operational security data on Hetzner / HDS systems where processed (controller); aggregated non-identifying capacity statistics (controller where genuinely anonymised/aggregated).
Purpose and legal basis: Authoritative zone serving on instructions; HDS infrastructure security and genuinely anonymised/aggregated capacity statistics. Controller processing: Art. 6(1)(f) (securing DNS infrastructure and operating genuinely anonymised/aggregated capacity statistics). Processor processing for zone content: customer determines purposes and legal basis under Art. 28.
Recipients: Primary on Hetzner (Germany). Zone file content only is synced to Vultr/iFog anycast PoPs for edge serving — no querier IPs in zone sync, no queried names transferred back to HDS. Countries and transfer tools: see our subprocessors page.
Retention: Ops/security data on Hetzner / HDS systems as for website logs; zone data for the contract duration. No advertising or analytics reuse of DNS data.
Role: Processor for customer zone records; controller for short-lived security/ops metadata and genuinely anonymised/aggregated capacity statistics.
Data: Mailbox content, mailbox user data, and account administration metadata.
Purpose and legal basis: Provide professional email; secure the mail platform. Controller processing for account/billing/platform security: Art. 6(1)(b); Art. 6(1)(f) (securing the mail platform and preventing abuse). Processor processing for mailbox content: customer determines purposes and legal basis under Art. 28.
Recipients: Hetzner Germany. Staff access to mailbox content is restricted, logged, and permitted only under documented customer instructions / the Art. 28 arrangement (or mandatory law).
Retention: Mail backups max. 7 days, then deleted. Account data for the contract duration plus applicable HGB/AO periods.
Role: Processor for mailbox content; controller for account administration, billing, and platform security.
Data: Website/app content, databases, end-user data in customer systems, and administration metadata.
Purpose and legal basis: Host customer workloads; secure infrastructure. Controller processing for accounts/billing/platform security: Art. 6(1)(b); Art. 6(1)(c) where legal obligations apply; Art. 6(1)(f) (securing hosted infrastructure and defending against abuse). Processor processing for customer content: customer determines purposes and legal basis under Art. 28.
Recipients: Hetzner Germany. Staff access is restricted, logged, and instruction-bound as for email presence.
Retention: Database backups are plan-dependent; where included, retained up to 14 days, then deleted. Account data for the contract duration plus applicable HGB/AO periods.
Role: Processor for customer content; controller for platform accounts, billing, and infrastructure security.
Data: Company/legal name, contacts, tax identifiers, and account/invoice references linked to the portal; OAuth email and provider user id (GitHub/Google), refresh tokens only where required to maintain a session, TOTP secrets/state where 2FA is enabled, and customer-configured CIDR allowlists. Essential portal cookies/storage: see Cookies and local storage.
Purpose and legal basis: Manage products and the contractual relationship; authenticate and secure portal accounts — Art. 6(1)(b); Art. 6(1)(c); Art. 6(1)(f) (securing portal accounts; strengthening account security; restricting portal access to customer-approved networks).
OAuth (GitHub / Google): Used to authenticate, create or link the account, and maintain the session. Account data from GitHub/Google is covered by this notice and by our first account communication (Art. 14 timing; Art. 14(5)(a) may apply where you already have the information). GitHub/Google act as authentication providers for their own sign-in flows and may involve processing in the United States; DPF only where the relevant entity/processing is certified and our subprocessors page expressly states DPF, otherwise Art. 46 (e.g. EU SCCs). Tokens are rotated or revoked when no longer needed; account data remains on Hetzner Germany.
Recipients: Hetzner Germany; GitHub/Google as OAuth IdPs; Let’s Encrypt / ISRG for TLS domain/ACME data only.
Retention: Account data for the contract duration plus applicable HGB/AO periods. OAuth tokens while the account exists (rotated/revoked when unused). 2FA and CIDR data while enabled/configured.
Role: Controller for portal accounts and authentication. Customer content in hosted products linked from the portal: processor as in the relevant activity blocks. Payments, Lexware accounting, and DocuSeal: see the separate activities below.
Data: Payment status, transaction identifiers, payment method information, and reconciliation fields exchanged with Mollie (no card PAN or Mollie payment IBANs on HDS portal systems).
Purpose and legal basis: Collect and reconcile card and online payments for the contractual relationship — Art. 6(1)(b); Art. 6(1)(c); Art. 6(1)(f) (preventing payment fraud).
Payments (Mollie): Mollie B.V. (Netherlands) is an independent licensed PSP/controller for card and online payments — not an HDS subprocessor. Mollie’s own privacy information applies (https://www.mollie.com/legal/privacy). HDS does not store card PAN or Mollie payment IBANs on HDS systems; bank-transfer IBANs via Lexware are described under Accounting (Lexware).
Recipients: Mollie (independent PSP); Hetzner Germany for HDS-side reconciliation metadata.
Retention: Payment and reconciliation records for the contract duration plus applicable HGB/AO periods.
Role: Mollie is an independent controller for payment-instrument processing. HDS is controller for HDS-side invoice and reconciliation metadata.
Data: Customer administration, invoicing/quotations, accounting records; where customers pay by bank transfer — transaction history on our business account via Lexware’s bank connection (payer name, IBAN, amounts, dates, remittance text and similar details as shown on the account; most customers pay via Mollie).
Purpose and legal basis: HDS administration, invoicing, accounting, and matching bank-transfer payments — Art. 6(1)(b); Art. 6(1)(c); Art. 6(1)(f) (reconciling payments and preventing payment fraud).
Lexware Office (bank transfer & accounting): Haufe Service Center GmbH, Munzinger Straße 9, 79111 Freiburg, as our processor under Art. 28. Lexware Office core hosting is in Germany. Lexware’s approved further processors for supplemental features may process outside the EEA under adequacy and/or SCCs (Art. 45/46) as set out in Lexware’s privacy notice (https://datenschutz.lexware.de/lexware-office) and Art. 28 DPA (https://avv.lexware.de/lexware-office). Lexware is listed on our subprocessors page as an HDS-admin Art. 28 recipient, not as product-hosting infrastructure for customer workloads.
Art. 14 (bank-transfer data obtained other than from you): We provide the required information through this notice under the dual Art. 14(3) triggers: (a) within one month of obtaining the data; and (b) at the time of the first communication if we use the data to contact you. Where we hold only bank remittance data without further contact details beyond the payment, individual information may be limited as permitted by Art. 14(5) if it would involve a disproportionate effort.
Recipients: Lexware Office / Haufe (Art. 28); Hetzner Germany for HDS-side records.
Retention: Billing and accounting records for the contract duration plus applicable HGB/AO periods.
Role: Controller (HDS); Lexware acts as Art. 28 processor for HDS administration and accounting.
Data: Signer name, email, signature image, signed PDF, IP, browser user agent, signing-event timestamps, and related audit-log metadata.
Purpose and legal basis: Conclude and evidence contracts between HDS and customers (or authorised signatories) — Art. 6(1)(b); Art. 6(1)(f) (establishing evidentiary integrity of signed contracts and defending related claims); Art. 6(1)(c) where HGB/AO retention applies.
Electronic contract signing (DocuSeal): Self-hosted DocuSeal on Hetzner Germany, operated by HDS. Customers do not use DocuSeal through HDS for their end users. DocuSeal is not a third-party SaaS subprocessor.
Recipients: Hetzner Germany (self-hosted under HDS control).
Retention: Until the related contract ends + 2 years for legal/evidentiary and abuse/security proof; longer where HGB/AO requires it.
Role: Controller for DocuSeal HDS↔customer signing.
Data: Email address from subscribers who opt in via the website newsletter sign-up with double opt-in (DOI); delivery metadata as needed to send the message.
Purpose and legal basis: HDS Broadcast™ is HDS’s own newsletter to subscribers (customers and website visitors who opt in). It is not a product that customers use to send their own newsletters. Sending is based on Art. 6(1)(a) (consent via double opt-in). After unsubscribe or withdrawal of consent we do not send further marketing newsletters. Keeping DOI/consent evidence and a suppression/blocklist so the address is not mailed again is based on Art. 6(1)(f) (accountability and demonstrating lawful sending; establishing, exercising or defending advertising and data-protection claims, and preventing further sending). Unsubscribe is available at any time via the unsubscribe link in the footer of each newsletter email; objection under Art. 21 is also available (see §6).
Recipients: Hetzner Germany mail stack.
Retention: While subscribed, we keep subscriber data including DOI/consent evidence in order to send the newsletter. On unsubscribe or withdrawal, the address is removed from the active mailing list and placed on a suppression/blocklist so we do not send again. Consent and unsubscribe evidence is retained for three years after unsubscribe (limitation periods under §§ 195, 199 BGB) and then deleted. The email address remains on the suppression/blocklist permanently so we do not mail that address again.
Role: Controller.
5. Recipients and international transfers
Where we act as processor for a customer, we engage infrastructure subprocessors as needed to deliver the contracted service. The current list — including locations and transfer tools — is on our subprocessors page. HDS notifies the Customer of intended additions or replacements at least 14 days before the change takes effect, unless a shorter period is required for urgent security, legal, or operational need. Those notices are sent from legal@horvath-digital.solutions. The Customer may object by reply to that address, as provided in the Art. 28 arrangement.
Privacy-critical hosting and mail workloads, as well as Verify and Sentinel, are designed to remain in Germany / the EU/EEA on Hetzner servers we operate. Card and online payments are processed by Mollie B.V. as an independent licensed PSP/controller (not an HDS subprocessor); see Mollie’s privacy notice: https://www.mollie.com/legal/privacy. Lexware Office (Haufe Service Center GmbH, Munzinger Straße 9, 79111 Freiburg) is our Art. 28 processor for HDS administration, invoicing and accounting, including bank-transfer remittance data where applicable — see Accounting (Lexware); Lexware is listed on our subprocessors page as an HDS-admin Art. 28 recipient, not as product-hosting infrastructure for customer workloads.
Let’s Encrypt / ISRG is a technical certificate authority for TLS on HDS and customer hosting/mail domains we operate: it receives domain names and ACME validation data only; we do not transmit mailbox or hosted application content. For customer domains, ACME runs under the customer’s documented instructions / contracted hosting-mail setup (HDS as processor). DocuSeal for HDS↔customer contract signing is self-hosted software on Hetzner under our control and is not a third-party SaaS subprocessor. For DNS anycast zone sync and OAuth identity providers, countries and transfer tools are stated on our subprocessors page. Information about safeguards for a third-country transfer may be requested from info@horvath-digital.solutions.
6. Your rights
Under the GDPR you may, subject to the statutory conditions, exercise the rights below free of charge. For manifestly unfounded or excessive requests we may charge a reasonable fee and/or refuse as permitted under Art. 12(5) GDPR. To exercise your rights, email info@horvath-digital.solutions or use the contact details in §2. We may ask for information reasonably needed to verify your identity. We respond without undue delay and within one month, subject to Art. 12(3) GDPR. Our services are aimed at businesses and adults; they are not directed at children.
You have the right to object, on grounds relating to your particular situation, at any time to processing based on Art. 6(1)(f) GDPR, including profiling based on those provisions (Art. 21(1)). We will then no longer process the data unless we demonstrate compelling legitimate grounds that override your interests, rights and freedoms, or for the establishment, exercise or defence of legal claims. Where personal data are processed for direct marketing, you may object at any time; the data will then no longer be processed for those purposes (Art. 21(2)–(3)). For HDS Broadcast™ (HDS’s own newsletter to subscribers), you can unsubscribe at any time via the unsubscribe link in the footer of each newsletter email; you may also object under Art. 21 via info@horvath-digital.solutions.
We do not make decisions based solely on automated processing that produce legal effects concerning you or similarly significantly affect you within the meaning of Art. 22 GDPR. Technical controls may rate-limit, challenge, or block traffic for infrastructure security; they are not used to decide eligibility, creditworthiness, or employment.
Access — confirmation and a copy of personal data we process about you (Art. 15).
Rectification — correction of inaccurate personal data (Art. 16).
Erasure — deletion in the cases set out in Art. 17.
Restriction — limitation of processing in the cases set out in Art. 18.
Portability — receive data you provided in a structured, commonly used format where Art. 20 applies.
Objection — object to Art. 6(1)(f) processing and to direct marketing (Art. 21), as described above.
Withdraw consent — at any time with effect for the future (Art. 7(3)), without affecting prior lawful processing.
7. Supervisory authority
You have the right to lodge a complaint with a supervisory authority under Art. 77 GDPR, in particular in the Member State of your habitual residence, place of work, or place of the alleged infringement.
You are not legally obliged to provide personal data when merely browsing our public websites. Certain technical access data are processed automatically when you use the services.
If you wish to conclude a contract, create an account, submit a form, or use a product that requires identification, required data are necessary for us to perform the contract or handle your request. Without that data we may be unable to provide the service, respond, or complete the transaction.
9. Changes to this notice
We may update this notice to reflect changes in our processing, products, or legal requirements. The latest revision date is shown at the top of this page. For material changes, HDS notifies registered Customers at least 14 days before the change takes effect, via a notice in the customer portal and by email from legal@horvath-digital.solutions. The Customer may object or raise questions by reply to that address.
If we intend to process personal data for a purpose other than that for which they were collected, we inform you before that further processing begins (Art. 13(3) GDPR). Registered Customers are notified via a notice in the customer portal and by email from legal@horvath-digital.solutions before the new purpose starts — the same channel as for material changes to this notice. Other data subjects are informed through the contact channel we reasonably have (for example email).
This notice is provided in German and English. In case of conflict or ambiguity, the German text prevails. The English text is a convenience translation.
