Privacy Privacy

Privacy

This privacy notice explains how I process personal data when you visit aurelessence.com and contact me through this website.
1 Controller and contact details
The controller responsible for the processing described here is:
Aurel Katzer
Email: aurelkatzer@gmail.com
Phone: +49 152 03719408
You can also use these contact details to ask questions about data protection and exercise your data protection rights.
2 Providing and protecting the website
When you access the website, your IP address and technical connection data are processed so that the requested content can be transmitted to your browser. This includes, in particular, the requested address, the time of access, and technical information transmitted by your browser.
Where access and error logs are kept, they are used to detect technical issues and misuse and to restore reliable operation. The legal basis is Article 6(1)(f) GDPR. My legitimate interest is to provide a reliable website and protect it against unauthorized access.
Cloudflare
I use Cloudflare to deliver the website’s content. Cloudflare operates between your browser and the website infrastructure and processes, in particular, IP addresses and technical information about the requested content and its transmission. The publicly identified provider is Cloudflare, Inc., 101 Townsend Street, San Francisco, CA 94107, USA.
The legal basis stated above, Article 6(1)(f) GDPR, applies to the delivery and protection of the website through Cloudflare. Where processing takes place outside the European Economic Area, the requirements for international data transfers also apply.
Cloudflare Privacy Notice
3 Contact and project inquiries
When you use the contact form, your name and email address are required fields. Your company, phone number, requested services, and message are optional. If you contact me by email or phone, I process the contact details and information you provide to the extent necessary to handle your inquiry.
I use this information to identify and respond to your inquiry and, where appropriate, to prepare or carry out a project. If your inquiry relates to a contract with you or to pre-contractual steps taken at your request, the legal basis is Article 6(1)(b) GDPR. For other inquiries and when you act as a contact person for an organization, I rely on Article 6(1)(f) GDPR. My legitimate interest is to handle business inquiries and communicate with the relevant contact persons.
You are under no legal obligation to use the form or provide information. However, you cannot submit an inquiry through the form without completing the required fields. Without suitable contact details, I cannot reply to you; missing information about your inquiry may make it more difficult to handle. You can also contact me directly by email or phone.
Submitting the form through FormSubmit
When you submit the form, your browser transmits the information you have entered to the external service FormSubmit at formsubmit.co. Technical data, particularly your IP address, is also generated when the connection is established. FormSubmit processes the inquiry for forwarding to my email inbox at aurelkatzer@gmail.com. The service is publicly associated with the names FormSubmit and Devro LABS.
According to the published FormSubmit documentation, form submissions are also retained for 30 days in a retrievable archive. The provider describes this archive as a way to retrieve submissions even if the corresponding email has not arrived. This storage is separate from the subsequent storage in the email inbox. The legal bases stated above apply to the processing necessary to handle your inquiry.
FormSubmit Privacy Notice
Receiving and handling communications through Gmail
I use Gmail to receive and handle email communications. This involves processing message content, sender and recipient addresses, and technical sending and receiving data. For its services in the European Economic Area, Google generally identifies Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, as the responsible entity.
The information in Section 6 applies to my further retention and erasure of inquiry and communication data. Google’s privacy notice also applies to processing by Google; it does not replace my responsibility for selecting and integrating the service.
Google Privacy Notice
4 Fonts and display functions
The Inter font is delivered as a file through the website’s domain. No connection to Google Fonts is established for this font. The file is delivered through the technical infrastructure described in Section 2, including the service providers identified there.
For animations and appropriate display, the browser evaluates information including screen, pointer, and scrolling data, as well as settings for reduced motion. These functions operate within the page. When you access the domain without a language path, the language configured in your browser is evaluated: English leads to the English version, while other language settings lead to the German version. You can change your selection using the language links.
These functions support the requested display and operation of the website. Where information strictly necessary for these functions is stored on or accessed from your device, Section 25(2), no. 2 TDDDG applies. Where personal data is processed in this context, the legal basis is Article 6(1)(f) GDPR; my interest is to provide a functional and usable display. Separate consent is obtained for the optional YouTube player described below.
5 YouTube videos
A showreel can be played on the website through YouTube. The provider for users in the European Economic Area is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. The preview is initially provided locally. The external player is loaded only when you expressly click “Load YouTube video” after viewing the privacy information displayed alongside the video.
Activating the player establishes a connection to Google. Google receives, in particular, your IP address, technical browser and device information, and information about the website from which the video is accessed and the video being played. Depending on your settings and the service’s functionality, cookies or similar storage technologies may be used and existing identifiers may be accessed. If you are signed in to Google, it may be possible to associate this information with your account.
The video is embedded using privacy-enhanced mode through youtube-nocookie.com. According to Google, this mode limits certain personalization purposes. However, it does not prevent all processing of data by Google.
The purpose of the integration is to play the video you have selected. The legal basis for the integration and data transmission initiated by me is your consent under Article 6(1)(a) GDPR. Where information is stored on or accessed from your device, this takes place on the basis of your consent under Section 25(1) TDDDG. Your use of the rest of the website does not depend on this consent.
Your permission to load the player applies to the current page view. You can remove the player by selecting “Disable YouTube.” The website will then display the local preview again and will load the player during that page view only if you give permission again. This allows you to withdraw your consent at any time with effect for the future. Withdrawal does not affect the lawfulness of processing carried out before withdrawal and does not automatically erase data already transmitted to Google.
Google also processes data outside the European Economic Area. For transfers covered by the EU-US Data Privacy Framework to Google LLC, which is certified under that framework, Google refers to this adequacy mechanism. In other applicable cases, it refers to appropriate safeguards, particularly standard contractual clauses. Details and information about these safeguards are available in the provider information below.
Google Privacy Notice
Google Information on Data Transfers
6 Retention and erasure
I erase data relating solely to inquiries once those inquiries have been handled and the data is no longer needed for further communication. If an inquiry results in a commission, the necessary information remains stored until that commission has been completed. After that, I retain only documents that remain subject to statutory obligations or are required for specific legal claims.
Where messages or attachments constitute business documents subject to statutory retention requirements, the applicable statutory periods apply. Where the statutory requirements are met, commercial and business correspondence must generally be retained for six years and accounting vouchers for eight years (Section 147 of the German Fiscal Code (AO); where applicable, also Section 257 of the German Commercial Code (HGB)). The retention period generally begins at the end of the calendar year in which the correspondence was received or sent, or the accounting voucher was created. Statutory extensions, for example because the statutory time limits for tax assessment have not yet expired, must also be taken into account.
Statutory retention takes place on the basis of Article 6(1)(c) GDPR. Where certain data remains necessary for the establishment, exercise, or defense of specific legal claims, Article 6(1)(f) GDPR applies. My legitimate interest is to protect my legal position. The data is erased once the relevant reason for retention no longer applies.
7 Your data protection rights
Subject to the statutory requirements, you may request access to the personal data processed about you and a copy of that data (Article 15 GDPR), have inaccurate data rectified (Article 16 GDPR), request erasure (Article 17 GDPR), or request restriction of processing (Article 18 GDPR).
Where processing is carried out by automated means and is based on consent or a contract, you may, under Article 20 GDPR, receive the data you have provided in a structured, commonly used, and machine-readable format and, where technically feasible, request that the data be transmitted to another controller. You may withdraw any consent you have given at any time with effect for the future.
You may lodge a complaint with a data protection supervisory authority, particularly in the Member State of your habitual residence, your place of work, or the place of the alleged infringement (Article 77 GDPR). You do not have to contact me first.
Your right to object
Where I process personal data on the basis of Article 6(1)(f) GDPR, you may object at any time on grounds relating to your particular situation. This also applies to profiling based on that provision. I will then no longer process the personal data concerned unless I can demonstrate compelling legitimate grounds for the processing that override your interests, rights, and freedoms, or the processing serves the establishment, exercise, or defense of legal claims.
You may submit your objection, in particular, by email to aurelkatzer@gmail.com.