Privacy policy
How personal data is handled on the Customizer website and when you contact us.
1. Controller
The controller responsible for processing personal data on this website is:
Simon Rossmann
Simon-Dach-Str. 19
10245 Berlin
Germany
info@simonrossmann.de
For privacy enquiries and to exercise your rights, please contact Simon Rossmann directly using the details above.
2. Website delivery and hosting
This website is hosted with Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany, on our infrastructure in Falkenstein, Germany. When you visit, your browser transmits information including your IP address, the time and destination of the request, and technical connection and browser details to the servers involved. This processing enables delivery of the content and a secure connection.
The legal basis is Article 6(1)(f) GDPR. Our legitimate interest is the reliable delivery and protection of our information website. Hetzner receives the data required for hosting and is used as a hosting service provider. Processing personal data on behalf of a controller is subject to the requirements of Article 28 GDPR.
3. Access logs and operational data
Access and error logs help us identify and resolve technical faults and investigate attacks and misuse. They may include IP addresses, requested addresses, timestamps, response statuses and technical error or connection information. The legal basis is Article 6(1)(f) GDPR; our legitimate interest is secure and reliable operation.
Centrally collected logs and traces are normally retained for seven days. This period applies to central logging. Retention of other technical operational data depends on how long it is needed to resolve faults, ensure operational security or deal with a specific security incident. Where longer retention is necessary to investigate a specific incident or establish, exercise or defend legal claims, it is limited to that purpose and the necessary scope. Data is deleted once its purpose and any grounds requiring continued retention no longer apply.
4. Language preference and browser storage
When you choose a language, the website stores that preference in the “.AspNetCore.Culture” cookie. It contains the language/culture setting and enables further pages to be displayed in your chosen language. It is stored for up to 365 days from its last update; opening another page with an existing language preference renews that period. You can delete the cookie in your browser at any time. Without a stored preference, the language is determined from the available language settings or the default language.
A technical security cookie whose name starts with “.AspNetCore.Antiforgery.” is also set. It contains a random security value, protects requested functions against forged requests and is stored as a session cookie without a persistent lifetime.
These cookies support your requested language function or the secure delivery of requested functions. Their storage is based on section 25(2), point 2, of the German Telecommunications Digital Services Data Protection Act (TDDDG). Where personal data is processed, the legal basis is Article 6(1)(f) GDPR; our legitimate interest is the secure delivery of your selected functions.
The dark appearance is fixed. The website does not read or write a theme preference in Local Storage. The website itself does not use analytics or advertising trackers. The website's fonts, images, stylesheets and scripts are served locally.
The FAQ keeps the search text, open answers, reading position and focus target in your local browser history so that Back/Forward and reload can restore your place. This information is not sent to a search service or our server and is not saved in Local Storage. Retention follows your browser history and its deletion by your browser. The YouTube player described in section 7 is an exception to locally served website assets and is loaded only at your request.
5. Interactive functions
The language selector and price calculator can establish an interactive connection to our server. Technical connection data and inputs needed for the function, such as the selected language or user quantity, are transmitted and processed temporarily. A price calculation is not an order.
The legal basis is Article 6(1)(f) GDPR. Our legitimate interest is providing the interactive functions you access. Their state is held in memory during the connection. After disconnection, it remains available for reconnection for no more than three minutes. This connection state is not intended to be stored persistently. Technical error and security logs follow the purposes and deletion criteria described in section 3.
6. Contact by email or telephone
When you contact us using the contact form, by email or telephone, we process your contact details, the contents of your enquiry and other information you provide to handle your request. For steps towards a contract with you or performance of that contract, the legal basis is Article 6(1)(b) GDPR. General enquiries and communication with a business customer's employees are based on Article 6(1)(f) GDPR; our legitimate interest is appropriate handling and business communication.
The contact form sends your email address, message and optional name and company to our mailbox on the server through Microsoft Graph. The website does not separately store form contents persistently. To prevent abusive requests, the IP address is temporarily used in memory to limit submissions. Technically necessary cookies protect form submission and show a one-time confirmation after the message is accepted for sending. The confirmation cookie contains no contact details and expires within five minutes. We use Microsoft 365/Exchange Online to receive, send and manage email. The service provider is Microsoft Ireland Operations Limited, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, D18 P521, Ireland. Processing includes sender and recipient addresses, message content, attachments and technical delivery information. Processing on our behalf is governed by Microsoft's Products and Services Data Protection Addendum; section 8 explains possible international transfers.
Enquiries are retained for as long as necessary to handle them and, where applicable, perform the resulting contract. Business correspondence subject to statutory retention is kept according to applicable commercial and tax obligations, based on Article 6(1)(c) GDPR. Where documents are needed for specific legal claims, necessary retention may be based on Article 6(1)(f) GDPR. The data is deleted afterwards.
7. Customer portal, downloads and YouTube
This policy covers the product website and the contact enquiries described here. Registration, orders, payments and licence management take place in the separate customer portal, which provides the applicable privacy information. Merely visiting this website does not transmit payment data to Mollie or create a customer account.
An order link to the portal passes the product identifier, selected licence quantity and language. Opening it also establishes the technically necessary connection to the destination server. Account details, billing data, payment data and licence keys are not passed in this website link.
When you open an external link or download destination, its provider processes the connection data arising there. The installer, installed software and licence checks have their own processing operations and privacy information; they are not triggered by merely visiting the product website.
An embedded YouTube video loads only when you choose “Load video”. Your browser then connects to YouTube; your IP address, browser information and usage data may be sent to and processed by Google. We embed videos through youtube-nocookie.com; this does not mean that no data is processed after loading. The provider is Google Ireland Limited. Google’s privacy policy applies: https://policies.google.com/privacy. Processing outside the European Economic Area may occur. Without loading the video, this embed does not connect to YouTube.
8. Recipients and international processing
Access is provided to the controller and service providers used for the stated purposes, particularly Hetzner and Microsoft. Data is disclosed to authorities or other bodies where legally required or necessary for the lawful handling of legal claims.
Hosting in Germany does not mean that all email data is processed exclusively in Germany. In addition to Microsoft Ireland Operations Limited, other Microsoft group companies and subprocessors may be involved in Microsoft 365. Transfers or support access outside the European Economic Area, particularly in the United States, are possible.
Microsoft describes the applicable safeguards in its Data Protection Addendum, particularly EU Standard Contractual Clauses for international transfers under Article 46 GDPR and supplementary measures. The Microsoft Data Protection Addendum linked below provides the relevant contractual information. You can also request a copy or further information about the relevant safeguards using our privacy contact.
9. Your rights
Subject to the statutory conditions, you have rights of access (Article 15 GDPR), rectification (Article 16), erasure (Article 17), restriction of processing (Article 18) and data portability (Article 20). Contact the controller to exercise these rights.
Where processing is based on consent, you may withdraw it at any time with future effect. The lawfulness of processing before withdrawal is unaffected.
Right to object: Under Article 21 GDPR, you may object to processing based on Article 6(1)(e) or (f) on grounds relating to your particular situation. You may object to processing for direct marketing at any time.
You also have the right to complain to a data protection authority, particularly in the place of your habitual residence, place of work or the alleged infringement. The Berlin Commissioner for Data Protection and Freedom of Information is a contact authority for the provider's location.
10. Provision of data and automated decisions
You do not need a customer account to visit this website. Technical connection data is required for your browser to retrieve it. Missing contact details or relevant information may prevent us from handling an enquiry.
This product website does not make automated decisions with legal or similarly significant effects under Article 22 GDPR or perform profiling for that purpose.