Privacy Policy

Privacy Notice

Last updated: March 8, 2024

Table of Contents:

  • Controller
  • Overview of Processing
  • Legal Bases
  • Security Measures
  • Disclosure of Personal Data
  • International Data Transfers
  • Data Subject Rights
  • Use of Cookies
  • Provision of the Online Offer and Web Hosting
  • Contact and Inquiry Management
  • Web Analytics, Monitoring and Optimization
  • Social Media Presences
  • Plugins and Embedded Content

Controller

FIORELLA GENNARI
SCHMALZGASSE 13
73630 REMSHALDEN,
Germany

CAMILA ARRIAGA ORREGO
WRANGLERSTRASSE 7
70599 STUTTGART,
Germany

Email: fgennari.studio@gmail.com
Imprint: https://paquitapilatesreformer.com/imprint/

Security Measures

We take appropriate technical and organizational measures in accordance with legal requirements, taking into account the state of the art, implementation costs, the nature, scope, circumstances and purposes of processing, and the varying likelihood and severity of risks to the rights and freedoms of natural persons, in order to ensure a level of security appropriate to the risk.

Measures include, in particular, safeguarding the confidentiality, integrity and availability of data by controlling physical and electronic access to the data, as well as access, input, disclosure, ensuring availability and separation of data. We have also established procedures to ensure the exercise of data subject rights, deletion of data and responses to data breaches. We also take the protection of personal data into account during the development or selection of hardware, software and procedures in accordance with the principles of privacy by design and by default.

Disclosure of Personal Data

In the course of processing personal data, it may happen that data is transmitted to other entities, companies, legally independent organizational units or persons, or disclosed to them. Recipients may include, for example, service providers commissioned with IT tasks or providers of services and content integrated into a website. In such cases, we comply with legal requirements and, in particular, conclude appropriate contracts or agreements with the recipients of your data to protect your data.

International data transfers:

Processing in third countries: If we process data in a third country (i.e. outside the European Union (EU) or the European Economic Area (EEA)) or processing takes place in the context of using services of third parties or disclosure/transmission of data to other persons, entities or companies, this is done only in accordance with legal requirements. Where an adequacy decision recognizes an adequate level of protection in the third country (Art. 45 GDPR), this serves as the basis for the transfer. Otherwise, transfers take place only where another safeguard is in place, in particular standard contractual clauses (Art. 46(2)(c) GDPR), explicit consent, or where the transfer is necessary for contractual or legal reasons (Art. 49(1) GDPR). We will inform you about the bases of third-country transfers for individual providers. Information on third-country transfers and adequacy decisions can be found on the website of the European Commission: https://commission.europa.eu/law/law-topic/data-protection/international-dimension-data-protection_en.

EU-US Data Privacy Framework (DPF): Under the DPF, the European Commission recognized on 10 July 2023 that the level of data protection is adequate for certain US companies. The list of certified companies and further information is available on the website of the U.S. Department of Commerce: https://www.dataprivacyframework.gov/. We indicate in these privacy notices which service providers we use are certified under the DPF.

Data Subject Rights

Rights under the GDPR: As a data subject, you have various rights under Articles 15 to 21 GDPR:

  • Right to object: You have the right to object at any time, on grounds relating to your particular situation, to the processing of personal data concerning you that is based on Art. 6(1)(e) or (f) GDPR, including profiling based on those provisions. Where personal data are processed for direct marketing purposes, you have the right to object at any time to such processing, including profiling to the extent it is related to such direct marketing.
  • Right to withdraw consent: You have the right to withdraw consent at any time.
  • Right of access: You have the right to obtain confirmation as to whether or not personal data concerning you are being processed, and, where that is the case, access to the personal data and further information, as well as a copy of the data, in accordance with legal requirements.
  • Right to rectification: You have the right to obtain the completion of incomplete personal data or the rectification of inaccurate personal data concerning you.
  • Right to erasure and restriction of processing: You have the right to obtain the erasure of personal data concerning you without undue delay, or alternatively the restriction of processing, in accordance with legal requirements.
  • Right to data portability: You have the right to receive the personal data concerning you, which you have provided to us, in a structured, commonly used and machine-readable format, or to request transmission to another controller.
  • Right to lodge a complaint with a supervisory authority: Without prejudice to any other administrative or judicial remedy, you have the right to lodge a complaint with a supervisory authority, in particular in the Member State of your habitual residence, place of work or place of the alleged infringement.

Use of Cookies

Cookies are small text files or other storage markers that store information on end devices and read information from end devices, for example, to store the login status in a user account, a shopping cart, the content retrieved or functions used within an online offer. Cookies may be used for different purposes, e.g. to ensure functionality, security and user comfort of online offers, as well as to create analyses of visitor flows.

Notes on consent: We use cookies in accordance with legal requirements. We therefore obtain prior consent from users unless this is not legally required. Consent is not necessary in particular if the storage and reading of information (including cookies) is strictly necessary to provide a telemedia service expressly requested by the users (i.e. our online offer). Strictly necessary cookies generally include functions for the display and operability of the online offer, load balancing, security, the storage of user preferences and choices, or similar purposes related to providing the main and ancillary functions of the requested online offer. Revocable consent is clearly communicated to users and includes information on the respective cookie usage.

Notes on legal bases: The legal basis on which we process users' personal data with the help of cookies depends on whether we ask users for consent. If users consent, the legal basis is the declared consent. Otherwise, data processed with the help of cookies is processed on the basis of our legitimate interests (e.g. the economical operation of our online offer and its improvement) or, where necessary to fulfill our contractual obligations, where the use of cookies is required to fulfill our contractual obligations. We provide information on the purposes for which cookies are processed in this privacy notice or in our consent and processing processes.

Storage duration: With regard to storage duration, the following types of cookies are distinguished:

  • Temporary cookies (also: session cookies): Temporary cookies are deleted at the latest after a user has left an online offer and closed their end device (e.g. browser or mobile application).
  • Permanent cookies: Permanent cookies remain stored even after the end device is closed. For example, the login status can be saved or preferred content can be displayed directly when a user revisits a website. Similarly, data collected with the help of cookies can be used to measure reach. Unless we provide users with explicit information on the type and storage duration of cookies (e.g. as part of obtaining consent), users should assume that cookies are permanent and that the storage duration can be up to two years.

General notes on withdrawal and objection (so-called "opt-out"): Users can withdraw consent at any time and object to processing in accordance with legal requirements. Users can, among other things, restrict the use of cookies in their browser settings (which may restrict the functionality of our online offer). An objection to the use of cookies for online marketing purposes can also be made via the websites https://optout.aboutads.info and https://www.youronlinechoices.com/.

Legal basis: Legitimate interests (Art. 6(1)(f) GDPR).

Further notes on processing operations, procedures and services:

Complianz (consent management): Procedure for obtaining, logging, managing and withdrawing consents, in particular for the use of cookies and similar technologies to store, read and process information on users' end devices; provider: operated on servers and/or computers under our own data protection responsibility; Website: https://complianz.io/; Privacy Policy: https://complianz.io/legal/. Further information: An individual user ID, language, types of consents and the time of their submission are stored server-side and in a cookie on the user's device.

Provision of the Online Offer and Web Hosting

We process users' data in order to provide our online services. For this purpose, we process the user's IP address, which is necessary to transmit the content and functions of our online services to the user's browser or end device.

Types of data processed: Usage data (e.g. websites visited, interest in content, access times); meta, communication and procedural data (e.g. IP addresses, timestamps, identifiers, consent status).

Categories of data subjects: Users (e.g. website visitors, users of online services).

Purposes of processing: Provision of our online offer and user-friendliness; information technology infrastructure (operation and provision of information systems and technical devices such as computers and servers); security measures.

Legal basis: Legitimate interests (Art. 6(1)(f) GDPR).

Further notes on processing operations, procedures and services:

Collection of access data and log files: Access to our online offer is logged in the form of so-called "server log files." Server log files may include the addresses and names of the requested web pages and files, date and time of access, transmitted data volumes, messages about successful retrieval, browser type and version, the user's operating system, referrer URL (the previously visited page), and, as a rule, IP addresses and the requesting provider. Server log files are used, among other things, for security purposes (e.g. to avoid server overload, in particular in the case of abusive attacks such as DDoS attacks) and to ensure server utilization and stability; Legal basis: Legitimate interests (Art. 6(1)(f) GDPR). Deletion of data: Log file information is stored for a maximum of 30 days and then deleted or anonymized. Data that must be retained for evidentiary purposes are excluded from deletion until the respective incident is finally clarified.

Contact and Inquiry Management

When contacting us (e.g. by post, contact form, email, telephone or via social media) and in the context of existing user and business relationships, the information provided by the inquiring persons is processed to the extent necessary to respond to contact requests and any requested actions.

Types of data processed: Contact data (e.g. email, telephone numbers); content data (e.g. entries in online forms); usage data (e.g. websites visited, interest in content, access times); meta, communication and procedural data (e.g. IP addresses, timestamps, identifiers, consent status).

Categories of data subjects: Communication partners.

Purposes of processing: Contact requests and communication; management and response to inquiries; feedback (e.g. collecting feedback via online form); provision of our online offer and user-friendliness.

Legal bases: Legitimate interests (Art. 6(1)(f) GDPR); performance of a contract and pre-contractual inquiries (Art. 6(1)(b) GDPR).

Further notes on processing operations, procedures and services:

Contact form: If users contact us via our contact form, email or other communication channels, we process the data provided in this context to handle the request; Legal bases: Performance of a contract and pre-contractual inquiries (Art. 6(1)(b) GDPR), legitimate interests (Art. 6(1)(f) GDPR).

Web Analytics, Monitoring and Optimization

Web analytics (also referred to as "reach measurement") is used to evaluate visitor flows to our online offer and can include behavior, interests or demographic information about visitors (e.g. age or gender) as pseudonymous values. With the help of reach analysis, we can recognize, for example, when our online offer or its functions or content are used most frequently or invite reuse, and which areas require optimization.

In addition to web analytics, we may also use testing procedures to test and optimize different versions of our online offer or its components.

Unless otherwise stated below, profiles (i.e. data combined for a usage process) may be created for these purposes, and information may be stored in a browser or end device and read from it. The collected information includes, in particular, websites visited and elements used there, as well as technical information such as the browser used, the computer system used and information on usage times. If users have consented to the collection of their location data by us or by the providers of the services we use, location data may also be processed.

Users' IP addresses are also stored. However, we use IP masking (i.e. pseudonymization by shortening the IP address) to protect users. In general, no clear data of users (such as email addresses or names) are stored in the context of web analytics, A/B testing and optimization, but only pseudonyms. This means that neither we nor the providers of the software used know the actual identity of the users, only the information stored in their profiles for the purposes of the respective procedures.

Types of data processed: Usage data (e.g. websites visited, interest in content, access times); meta, communication and procedural data (e.g. IP addresses, timestamps, identifiers, consent status).

Categories of data subjects: Users (e.g. website visitors, users of online services).

Purposes of processing: Reach measurement (e.g. access statistics, recognition of returning visitors); profiles with user-related information (creating user profiles); provision of our online offer and user-friendliness.

Security measures: IP masking (pseudonymization of IP address).

Legal basis: Consent (Art. 6(1)(a) GDPR).

Further notes on processing operations, procedures and services:

Google Analytics: We use Google Analytics to measure and analyze the use of our online offer based on a pseudonymous user identification number. This identification number does not contain unique data such as names or email addresses. It serves to assign analytics information to an end device to recognize which content users have accessed within one or more usage processes, which search terms they have used, whether they have accessed content again, or interacted with our online offer. The time of use and its duration, as well as the sources of users referring to our online offer and technical aspects of their end devices and browsers are stored. Pseudonymous user profiles are created with information from the use of different devices, and cookies may be used. Google Analytics does not log or store individual IP addresses for EU users. Analytics provides only coarse geolocation data by deriving the following metadata from IP addresses: city (and the derived latitude and longitude of the city), continent, country, region, subcontinent (and ID-based counterparts). For EU traffic, IP address data is used exclusively for this derivation of geolocation data before it is immediately deleted. It is not logged, not accessible and not used for other purposes. When Google Analytics collects measurement data, all IP queries are performed on EU-based servers before traffic is forwarded to Analytics servers for processing; Provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland; Legal basis: Consent (Art. 6(1)(a) GDPR); Website: https://marketingplatform.google.com/intl/de/about/analytics/; Security measures: IP masking (pseudonymization of IP address); Privacy Policy: https://policies.google.com/privacy; Data Processing Terms: https://business.safety.google/adsprocessorterms/; Basis for third country transfers: Data Privacy Framework (DPF); Opt-out: https://tools.google.com/dlpage/gaoptout?hl=de; Ad personalization settings: https://myadcenter.google.com/personalizationoff; Further information: https://business.safety.google/adsservices/.

Social Media Presences

We maintain online presences within social networks and process user data in this context to communicate with users active there or to provide information about us.

We point out that user data may be processed outside the European Union. This may pose risks for users, for example because it may be more difficult to enforce users' rights.

User data within social networks is generally processed for market research and advertising purposes. For example, usage profiles can be created based on usage behavior and the resulting interests of users. These usage profiles can be used to display advertisements inside and outside the networks that are presumed to match users' interests. Cookies are usually stored on users' computers for these purposes, in which users' usage behavior and interests are stored. Data can also be stored in usage profiles regardless of the devices used by the users (especially if users are members of the respective platforms and are logged in).

For detailed information on the respective forms of processing and options for objection (opt-out), please refer to the privacy policies and information provided by the operators of the respective networks.

In the case of requests for information and the exercise of data subject rights, we also point out that these can be asserted most effectively with the providers. Only the providers have access to users' data and can take appropriate measures and provide information directly. If you nevertheless need help, you can contact us.

Types of data processed: Contact data (e.g. email, telephone numbers); content data (e.g. entries in online forms); usage data (e.g. websites visited, interest in content, access times); meta, communication and procedural data (e.g. IP addresses, timestamps, identifiers, consent status).

Categories of data subjects: Users (e.g. website visitors, users of online services).

Purposes of processing: Contact requests and communication; feedback (e.g. collecting feedback via online form); marketing.

Legal basis: Legitimate interests (Art. 6(1)(f) GDPR).

Further notes on processing operations, procedures and services:

Instagram: Social network; Provider: Meta Platforms Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland; Legal basis: Legitimate interests (Art. 6(1)(f) GDPR); Website: https://www.instagram.com; Privacy Policy: https://instagram.com/about/legal/privacy; Basis for third country transfers: Data Privacy Framework (DPF).

Plugins and Embedded Content

We integrate functional and content elements into our online offer that are obtained from the servers of their respective providers (hereinafter referred to as "third-party providers"). These may include graphics, videos or city maps (hereinafter uniformly referred to as "content").

Integration always requires that the third-party providers of this content process the users' IP address, since they could not send the content to the users' browser without the IP address. The IP address is therefore required to display this content or functions. We endeavor to use only content whose providers use the IP address solely for the delivery of the content. Third-party providers may also use so-called pixel tags (invisible graphics, also referred to as "web beacons") for statistical or marketing purposes. The "pixel tags" can be used to evaluate information such as visitor traffic on the pages of this website. The pseudonymous information may also be stored in cookies on the users' device and, among other things, contain technical information about the browser and operating system, referring web pages, visit time, as well as other information on the use of our online offer, and may be combined with such information from other sources.

Types of data processed: Usage data (e.g. websites visited, interest in content, access times); meta, communication and procedural data (e.g. IP addresses, timestamps, identifiers, consent status). Location data (information on the geographical position of a device or person).

Categories of data subjects: Users (e.g. website visitors, users of online services).

Purposes of processing: Provision of our online offer and user-friendliness.

Legal bases: Legitimate interests (Art. 6(1)(f) GDPR); consent (Art. 6(1)(a) GDPR).

Further notes on processing operations, procedures and services:

Google Fonts (retrieval from Google server): Retrieval of fonts (and icons) for technically secure, maintenance-free and efficient use of fonts and icons with regard to topicality and loading times, their uniform display and consideration of possible license restrictions. The provider of the fonts is informed of the user's IP address so that the fonts can be provided in the user's browser. In addition, technical data (language settings, screen resolution, operating system, hardware used) is transmitted that is necessary to provide the fonts depending on the devices used and the technical environment. This data may be processed on a server of the font provider in the USA. When visiting our online offer, users' browsers send their HTTP requests to the Google Fonts Web API (a software interface for retrieving the fonts). The Google Fonts Web API provides the users with the Cascading Style Sheets (CSS) of Google Fonts and then the fonts specified in the CSS. These HTTP requests include (1) the IP address used by the user to access the Internet, (2) the requested URL on the Google server and (3) the HTTP headers, including the user agent describing the browser and operating system versions of website visitors, as well as the referrer URL (the web page on which the Google font is to be displayed). IP addresses are neither logged nor stored on Google servers and are not analyzed. The Google Fonts Web API logs details of the HTTP requests (requested URL, user agent and referrer URL). Access to this data is restricted and strictly controlled. The requested URL identifies the font families the user wants to load. This data is logged so that Google can determine how often a particular font family is requested. With the Google Fonts Web API, the user agent must customize the font generated for the respective browser type. The user agent is primarily logged and used for debugging, to generate aggregated usage statistics that measure the popularity of font families. These aggregated usage statistics are published on the Google Fonts "Analytics" page. Finally, the referrer URL is logged so that the data can be used for production maintenance and to generate an aggregated report on the top integrations based on the number of font requests. According to Google, none of the information collected by Google Fonts is used to create profiles of end users or to serve targeted ads; Provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland; Legal basis: Legitimate interests (Art. 6(1)(f) GDPR); Website: https://fonts.google.com/; Privacy Policy: https://policies.google.com/privacy; Basis for third country transfers: Data Privacy Framework (DPF). Further information: https://developers.google.com/fonts/faq/privacy.

Google Maps: We integrate maps from the "Google Maps" service provided by Google. The data processed may include, in particular, IP addresses and location data of users; Provider: Google Cloud EMEA Limited, 70 Sir John Rogerson's Quay, Dublin 2, Ireland; Legal basis: Consent (Art. 6(1)(a) GDPR); Website: https://mapsplatform.google.com/; Privacy Policy: https://policies.google.com/privacy. Basis for third country transfers: Data Privacy Framework (DPF).

Generated with the free Datenschutz-Generator.de by Dr. Thomas Schwenke