Privacy Policy
Welcome to our website.
When you visit our website and view its content, your personal data is processed. The General Data Protection Regulation (GDPR), which applies to us, sets out certain requirements for this processing. We are therefore required to inform you about specific aspects of the processing of your personal data at the time it is collected. This is the purpose of this Privacy Policy.
Personal data is any information that can be used to identify you personally. In the following sections, we explain which data we collect, how and why we process it, and what it is used for.
Please note that data transmission over the internet (for example, communication by email) may be subject to security vulnerabilities. Complete protection of data against access by third parties cannot be guaranteed.
1. Data Controller
The data controller is the natural or legal person who, alone or jointly with others, determines the purposes and means of processing personal data (such as first and last names, email addresses or postal addresses).
Dr. Gudrun Henne
Kurfürstendamm 5710707 Berlin
Germany
Phone: +49 30 95998535-0
Email: post@gudrunhenne.de2. Collection and Transmission of Data
Some of your data is collected when you provide it to us directly. This may include, for example, information you enter into our contact form.
Other data is collected automatically by our IT systems when you visit the website. This primarily includes technical data, such as your internet browser, operating system or the time at which a page is accessed. This data is collected automatically as soon as you enter our website.
3. Purpose of Data Collection
Some data is collected to ensure that the website functions correctly. Other data may be used to analyse your behaviour as a user.
4. Service Providers
To ensure that personal data is processed in compliance with data protection regulations, we have concluded data processing agreements with all service providers for whom such agreements are required under the GDPR.
5. Hosting and Server Logs
External Hosting
Our website is hosted by an external service provider (hosting provider). Personal data collected through our website is stored on the hosting provider's servers. This may include IP addresses, contact enquiries, metadata and communication data, contractual data, contact details, names, website access data and other information generated through the use of a website.
We use this hosting provider to fulfil our contractual obligations towards prospective and existing customers (Art. 6(1)(b) GDPR) and in our legitimate interest in providing a secure, fast and efficient online service through a professional provider (Art. 6(1)(f) GDPR).
Our hosting provider will process your data only to the extent necessary to fulfil its contractual obligations and will follow our instructions regarding the processing of this data.
We use the following hosting provider:
Mittwald CM Service GmbH & Co. KG
Königsberger Straße 6
32339 Espelkamp
Germany
Server Log Files
The website provider automatically collects and stores information in server log files, which your browser automatically transmits to us. This information includes:
- Browser type and version
- Operating system used
- Referrer URL
- Hostname of the accessing computer
- Time of the server request
- IP address
This data is not combined with information from other sources.
Legal basis: Art. 6(1)(f) GDPR (legitimate interest in maintaining the functionality of the website).
Retention period: The data is automatically deleted after 7 days.
6. SSL Encryption
This website uses SSL or TLS encryption to protect the transmission of confidential information, such as contact enquiries or job applications that you send to us as the website operator. You can recognise an encrypted connection when the browser's address bar changes from "http://" to "https://" and a padlock symbol appears in the browser bar. When SSL or TLS encryption is enabled, the data you transmit to us cannot be read by third parties.
7. Data Processing by Kirby CMS
Panel Access (Backend)
Our content management system, Kirby, stores the following information when administrators access the backend:
Stored data:
- Username and encrypted password
- Time of last login
- Session data used for authentication
Purpose: Management of website content and security of the backend area.
Legal basis: Art. 6(1)(f) GDPR (legitimate interest in website administration).
Retention period: Sessions are automatically deleted after 24 hours of inactivity.
Cache Files
Kirby creates cache files to optimise website loading times. These files do not contain personal data.
8. Cookies
This website uses cookies in certain areas. Cookies do not cause any damage to your computer and do not contain viruses. They help make our website more user-friendly, effective and secure. Cookies are small text files that are stored on your computer and saved by your browser.
Most of the cookies we use are so-called "session cookies". They are automatically deleted at the end of your visit. Other cookies remain stored on your device until you delete them. These cookies enable us to recognise your browser when you visit our website again.
You can configure your browser to notify you when cookies are set, to allow cookies only in individual cases, to reject cookies in certain cases or generally, and to automatically delete cookies when you close your browser. Disabling cookies may limit the functionality of our website.
Technically Necessary Cookies
Session Cookie:
- Name: kirby_session
- Purpose: Maintaining the user session
- Retention period: Until the browser is closed
- Legal basis: Art. 6(1)(f) GDPR
Cookies required to carry out electronic communication or provide certain functions requested by you are stored on the basis of Art. 6(1)(f) GDPR. The website operator has a legitimate interest in storing cookies to ensure the technically correct and optimised provision of its services.
9. Map Service (OpenFreeMap)
Integration of the Map Function
Our website uses the free mapping service OpenFreeMap, based on OpenStreetMap data, to display map information. The software used to display the maps (MapLibre GL JS) is stored locally on our server. A connection to OpenFreeMap is established only to retrieve the map tiles.
Provider:
Hyperknot Software Kft.
Petőfi Sándor utca 48.
2724 Ujlengyel
Hungary
When you access the map view, technically necessary data (browser type, operating system and the map section requested) is transmitted to OpenFreeMap's servers. IP addresses are not stored by default. No user profiles are created, and no cookies are set.
Legal basis: Art. 6(1)(f) GDPR (legitimate interest in presenting our location information in a clear and accessible manner).
Transfers to third countries: The provider is based in Hungary (EU). No data is transferred to a third country.
10. Web Fonts (Locally Hosted)
This website uses web fonts to ensure the consistent display of typefaces. These fonts are stored locally on our server, so no connection to external servers is established.
Purpose: Consistent and visually appealing presentation of the website.
Legal basis: Art. 6(1)(f) GDPR (legitimate interest in an appealing website presentation).
Data transmission: No data is transmitted to third parties because the fonts are hosted locally.
11. Contact Form
If you use our contact form, the information you enter will be processed.
Data processed:
- Name
- Email address
- Message content
- Time of submission
Purpose: Processing your contact enquiry.
Legal basis: Art. 6(1)(f) GDPR (legitimate interest in communication).
Retention period: The data will be deleted as soon as it is no longer required for the purpose for which it was collected, and no later than after 2 years.
12. Job Applications via the Website
We offer you the opportunity to submit job applications through our website. When you apply digitally, we collect and process your personal information and application documents electronically for the purpose of managing the recruitment process.
Legal basis: Section 26(1), sentence 1 of the German Federal Data Protection Act (BDSG), in conjunction with Art. 88(1) GDPR.
Successful Applications
If an employment contract is concluded following the application process, we will store the information you submitted with your application in your personnel file for standard organisational and administrative purposes, while complying with any additional legal obligations.
Legal basis: Section 26(1), sentence 1 BDSG, in conjunction with Art. 88(1) GDPR.
Rejected Applications
If your application is rejected, we will automatically delete the data you submitted two months after notifying you of the rejection. However, the data will not be deleted if legal provisions require longer retention, for example, due to obligations to provide evidence under the German General Equal Treatment Act (AGG). In such cases, the data may be retained for up to four months or until the conclusion of legal proceedings.
Legal basis: Art. 6(1)(f) GDPR and Section 24(1)(2) BDSG. Our legitimate interest is the defence or enforcement of legal claims.
Applicant and Prospective Candidate Database
If you explicitly consent to the longer retention of your data, for example, to be included in an applicant or prospective candidate database, your data will continue to be processed on the basis of your consent.
Legal basis: Art. 6(1)(a) GDPR.
You may withdraw your consent at any time with effect for the future by notifying us, in accordance with Art. 7(3) GDPR.
13. Your Rights as a Data Subject
You have the following rights:
Right of Access (Art. 15 GDPR)
Upon request, we will inform you which personal data we have stored about you and how we process or have processed it.
Right to Rectification (Art. 16 GDPR)
If we have stored incorrect information about you, you may request that it be corrected, for example, if your surname has changed.
Right to Erasure (Art. 17 GDPR)
If you have not become or are no longer a customer, you may request the deletion of your data, provided that no other legal obligations prevent its deletion.
Right to Restriction of Processing (Art. 18 GDPR)
If you no longer agree to certain types of processing, you may request that the processing of your personal data be restricted.
Right to Data Portability (Art. 20 GDPR)
You may request that we provide you with a copy of your data in a transferable format.
Right to Object (Art. 21 GDPR)
You have the right to object at any time to the processing of your personal data on grounds relating to your particular situation.
Right to Withdraw Consent (Art. 7 GDPR)
If you have given your consent to the processing of your personal data, you may withdraw that consent at any time.
14. Right to Lodge a Complaint
You have the right to lodge a complaint with a data protection supervisory authority regarding our processing of your personal data.
30 June 2025