Privacy

1. Controller

Christian Fritsch, VendoNexo
Bürgermeister-Keckl-Straße 24, 92364 Deining, Germany
Email: kontakt@vendonexo.de
Phone: +49 160 90270847

2. Hosting and technical provision

The website is hosted by IONOS SE, Elgendorfer Str. 57, 56410 Montabaur, Germany. When the site is accessed, the hosting provider processes technically necessary connection data, including the IP address, time, requested address, browser information and, where applicable, the previous page. This processing provides and protects the website under Article 6(1)(f) GDPR. My legitimate interest is secure and reliable operation.

As part of its web hosting services, IONOS processes, in particular, information about the previously visited page (referrer), the requested website or file, browser type and browser version, the operating system used, device type, the time of access, and the IP address in anonymized form. According to IONOS, this visitor data is stored for eight weeks. IONOS states that, as part of its web hosting services, this visitor data is neither disclosed to third parties nor transferred to third countries outside the European Union.

Where IONOS processes personal data on my behalf, such processing is carried out on the basis of a data processing agreement pursuant to Art. 28 GDPR.

As part of the hosting services, IONOS WebAnalytics is used. In this context, data is processed for statistical analysis and the technical optimization of the website. This includes, in particular, the referrer, the requested website or file, browser type and browser version, the operating system used, device type, and the time of access.

The IP address technically transmitted when the website is accessed is immediately anonymized by IONOS and subsequently processed without any reference to an identifiable individual. IONOS WebAnalytics does not use cookies. According to IONOS, the data collected via WebAnalytics is not disclosed to third parties.

3. Contact by form, email or phone

When you contact me, I process your information to handle your enquiry. The form requires your name, email address and message. Providing your company name is optional. The form cannot be submitted without the required information; you may alternatively contact me by phone.

The provision of this data is neither required by law nor by contract. However, your name, email address, and message are required so that I can receive and respond to your inquiry submitted via the contact form. Without this information, it is not possible to contact me via the form. Alternatively, you may contact me by email or telephone.

Where an enquiry concerns entering into or performing a contract with you, the legal basis is Article 6(1)(b) GDPR. Other enquiries, including communication with a company’s representatives, are processed under Article 6(1)(f) GDPR and my legitimate interest in handling business communication appropriately. Recipients may include the service providers engaged for hosting and email.

The contact form does not create a permanent message archive in WordPress. Messages are forwarded by email. To allow you to continue after an error, your entries are temporarily stored in encrypted form. They can be retrieved for up to ten minutes and are deleted on retrieval. Expired entries that have not been retrieved are removed by regular server-side cleanup. Enquiries are deleted when they are no longer needed, unless statutory retention requirements or legitimate reasons justify continued storage.

For sending and receiving business emails, I use Microsoft 365 and Exchange Online. In this context, email and communication data is processed by Microsoft. For users in the European Economic Area, the responsible Microsoft entity is Microsoft Ireland Operations Limited, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, Ireland.

In the course of email communication, the data processed may include, in particular, the sender’s and recipient’s email addresses, name, subject line, message content, time of communication, and any attachments transmitted. Messages submitted via the contact form are transmitted via the configured email connection to my Microsoft Exchange mailbox.

Where Microsoft processes personal data on my behalf, such processing is carried out on the basis of the data protection and data processing terms applicable to Microsoft Online Services. Microsoft has introduced commitments for Microsoft 365 regarding the storage and processing of customer data within the EU Data Boundary. In certain limited cases, however, data may still be processed or transferred outside the EU or the EEA. For such cases, Microsoft uses the safeguards provided for under applicable data protection law, in particular the EU Standard Contractual Clauses.

Emails and any personal data contained therein are deleted as soon as they are no longer required for processing the respective inquiry and any subsequent business communication, unless statutory retention obligations or other legitimate grounds require further storage.

4. Contact form protection

To prevent misuse, the form uses a hidden control field, time-limited security tokens and a request limit. A keyed verification value is derived from the IP address for this purpose. This value and the counter remain valid for up to one hour; expired entries are regularly removed on the server. The original IP address is not stored in the WordPress database for this purpose. The legal basis is Article 6(1)(f) GDPR, with the legitimate interest of preventing spam and technical misuse.

5. Cookies, fonts and external content

Visits to the public website do not set cookies. Visitor information is not stored in Local Storage, Session Storage or comparable browser storage. No external fonts, maps, videos or social media widgets are loaded. The site uses system fonts and locally supplied image files. The public contact process does not require cookies. Signing in to the WordPress administration area uses technically necessary authentication cookies.

No tracking technologies requiring consent are used. A consent banner is therefore not provided for this configuration. Any services added later require a fresh assessment, particularly under section 25 of the German TDDDG. The statistical analysis by IONOS WebAnalytics described above is carried out without the use of cookies; the IP address is immediately anonymized by IONOS.

6. Your rights

Subject to the statutory requirements, you have rights of access (Article 15 GDPR), rectification (Article 16), erasure (Article 17), restriction of processing (Article 18) and data portability (Article 20). Where processing is based on consent, you may withdraw it for the future under Article 7(3).

Right to object: Where processing is based on Article 6(1)(f) GDPR, you may object under Article 21 on grounds relating to your particular situation. You may object to processing for direct marketing at any time.

You may lodge a complaint with a data protection supervisory authority under Article 77 GDPR, particularly in your place of residence, workplace or the place of the alleged infringement. For private businesses in Bavaria, you may contact the Bavarian State Office for Data Protection Supervision.

7. Security and automated decisions

The intended production website uses HTTPS encryption for data transmission. This contact form does not involve automated decision-making, including profiling, within the meaning of Article 22 GDPR.

8. Changes

This information is updated if technical services or processing arrangements change. Linked external websites are responsible for their own data processing.