Privacy Policy

1. General information

The following provides you with information on the nature, scope and purpose of the processing of personal data when visiting this website. Personal data is any data that can be used to personally identify you.

2. Controller

Managing directors: Nicole Lüdeke-Pirc, Jörg Schulze Greiving

3. Data protection officer

A data protection officer has not been appointed, as the legal requirements for doing so are not met. For data protection inquiries, please contact the controller named in Section 2, or email us directly at datenschutz@aupos.de.

4. Types of data processed and purposes of processing

4.1 Categories of personal data

• Access data/server logs (e.g. IP address, date and time of the request, referrer URL, user agent)
• Communication data (e.g. email address, phone number), if provided by you via the contact form
• Content data (e.g. form entries), if provided by you
• Usage data (e.g. pages visited), to the extent recorded in server logs

4.2 Purposes of processing

• Providing the website, its stability and security
• Communication and handling of inquiries
• Fulfilling legal obligations

5. Hosting and server log files

This website is hosted with a hosting provider based in Germany, on a rented server (VPS). A data processing agreement pursuant to Art. 28 GDPR is in place with the hosting provider.

When you access our website, information is automatically collected in server log files that your browser transmits:

• IP address
• Date and time of the server request
• Content of the request (specific page)
• Access status/HTTP status code
• Amount of data transferred
• Referrer URL
• Browser type and version, operating system

Processing is based on Art. 6(1)(f) GDPR. Our legitimate interest lies in the technically error-free presentation and security of our website. Server log files are continuously and automatically overwritten as part of log rotation.

6. Use of cookies and local storage

6.1 Technically necessary cookies

This website uses the following cookies:

6.2 Local storage

Your browser's localStorage is used exclusively to store your color-scheme preference (light/dark) – key mkart-theme. This information never leaves your device.

Legal basis for storing this entry on your device: Section 25(2) no. 2 TDDDG (German Telecommunications Digital Services Data Protection Act) – the storage is strictly necessary to provide the service you have explicitly requested (the display you have chosen).

6.3 Tracking and marketing cookies

No tracking, analytics or marketing cookies are used.

Legal basis: Art. 6(1)(f) GDPR (legitimate interest in a functional and user-friendly website).

7. External resources

The website loads all static resources (stylesheets, JavaScript, fonts) exclusively from our own server. No external CDN services are used. The Inter font is self-hosted (no calls to external font servers).

8. YouTube videos

On some pages we embed videos from the YouTube platform. Provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland.

We use the privacy-friendly domain youtube-nocookie.com and a two-click mechanism: YouTube content is loaded only after your explicit consent. Without consent, only a placeholder image is shown and no data is transmitted to Google.

After you consent, Google may set cookies and collect usage data. Legal basis: Art. 6(1)(a) GDPR (consent). More information: Google's privacy policy.

9. Contact form

If you contact us via the contact form, the data you enter (company, salutation, first and last name, email address, optionally phone number, message) is processed for the purpose of handling your inquiry. Legal basis: Art. 6(1)(b) GDPR (pre-contractual measures) or Art. 6(1)(f) GDPR (legitimate interest in responding to inquiries).

For reliable processing, your inquiry is first temporarily stored on the web server and retrieved by our internal order-processing system; in parallel, it is sent to us by email. The local copy on the web server is automatically deleted no later than 30 days after receipt. The flow of data occurs exclusively between the web server and our internal company system – there is no transfer to external third parties beyond the hosting provider (see Section 5).

10. Legal bases for processing (Art. 6 GDPR)

• Art. 6(1)(a) GDPR – Consent: For loading YouTube videos after consent.
• Art. 6(1)(b) GDPR – Performance of a contract/pre-contractual measures: Where processing is necessary for the performance of a contract with you (e.g. contact inquiries).
• Art. 6(1)(f) GDPR – Legitimate interests: For the technically necessary provision, security and optimization of our website (server logs, cookies).

11. Data retention period

• Server logs: continuously and automatically overwritten as part of log rotation
• Contact inquiries: local copy on the web server max. 30 days; in the internal processing system until the matter is resolved, for a maximum of 12 months
• Preview cookie mkart_intern: 7 days

12. Recipients of data & transfers to third countries

As a general rule, personal data is not transferred to third parties unless this is necessary to fulfill legal obligations.

Through the use of YouTube (see Section 8), IP addresses may be transferred to servers outside the EU, in particular to the USA. This transfer is based on your explicit consent pursuant to Art. 49(1)(a) GDPR, which you give by loading the video. Please note that the USA may not provide a level of data protection equivalent to that under EU law; in particular, US authorities may be able to access the data without you having effective legal remedies against this.

In addition, Google relies on the EU-US Data Privacy Framework (adequacy decision pursuant to Art. 45 GDPR) and on the European Commission's Standard Contractual Clauses pursuant to Art. 46(2)(c) GDPR.

13. Your rights

Under applicable law, you have the following rights:

• Right of access to your data stored with us (Art. 15 GDPR)
• Right to rectification of inaccurate or completion of incomplete data (Art. 16 GDPR)
• Right to erasure of your data (Art. 17 GDPR)
• Right to restriction of processing (Art. 18 GDPR)
• Right to data portability (Art. 20 GDPR)
• Right to object to processing based on Art. 6(1)(f) GDPR (Art. 21 GDPR)
• Right to withdraw consent already given, with effect for the future (Art. 7(3) GDPR)

To exercise your rights, please contact us using the contact details given in Section 2.

Right to lodge a complaint: You have the right to lodge a complaint with a supervisory authority (Art. 77 GDPR). The supervisory authority responsible for us is:

14. Obligation to provide data

Providing personal data is neither legally nor contractually required, nor is it necessary to enter into any contract. You are not obliged to provide personal data. However, failure to do so may mean you are unable to use our contact form.

15. Data security

We take technical and organizational measures to protect your data against loss, destruction, manipulation and unauthorized access. Transmission is encrypted via a TLS connection (HTTPS). We continuously improve our security measures in line with technological developments.

16. Contact for privacy inquiries

For questions about data protection, to exercise your rights as a data subject, or for complaints, please contact:

17. Status and amendments of this privacy policy

Last updated: September 2026. We reserve the right to amend this privacy policy in the event of changes to the law or to the services we use.