For a detailed overview of all service providers and data processing activities, see our Data Processing Overview.
1) Introduction and Contact Details of the Controller
1.1 We are pleased that you are visiting our website and thank you for your interest. In the following, we inform you about the handling of your personal data when using our website. Personal data is all data with which you can be personally identified.
1.2 The controller responsible for data processing on this website within the meaning of the General Data Protection Regulation (GDPR) is MichMatz GmbH, Im Mediapark 5, 50670 Cologne, Germany, email: hello@michmatz.me. The controller responsible for the processing of personal data is the natural or legal person who alone or jointly with others determines the purposes and means of the processing of personal data.
2) Data Collection When Visiting Our Website
2.1 When using our website for informational purposes only, i.e. when you do not register or otherwise transmit information to us, we only collect data that your browser transmits to the page server (so-called “server log files”). When you access our website, we collect the following data, which is technically necessary for us to display the website to you:
- Our visited website
- Date and time of access
- Amount of data sent in bytes
- Source/reference from which you reached the page
- Browser used
- Operating system used
- IP address used (if applicable: in anonymized form)
Processing is carried out pursuant to Art. 6(1)(f) GDPR on the basis of our legitimate interest in improving the stability and functionality of our website. The data will not be passed on or otherwise used. However, we reserve the right to subsequently review the server log files if there are concrete indications of unlawful use.
2.2 This website uses SSL or TLS encryption for security reasons and to protect the transmission of personal data and other confidential content (e.g. orders or inquiries to the controller). You can recognize an encrypted connection by the string “https://” and the lock symbol in your browser bar.
3) Hosting of the Product (SaaS Application)
For hosting our SaaS application and processing customer data in the context of product usage, we use a provider that provides its services exclusively on servers within the European Union, either directly or through selected subcontractors.
All data collected in the context of product usage is processed on these servers.
We have concluded a data processing agreement with the provider that ensures the protection of our customers’ data and prohibits unauthorized disclosure to third parties.
4) Error and Crash Analysis – Sentry
To ensure the stability, security and reliability of our application we use Sentry (full provider details in our Data Processing Overview). Sentry captures technical diagnostic data on program errors and crashes (e.g. error messages, technical program execution data, app version, browser and operating system type). We have configured the service to minimise data: IP addresses are dropped, email addresses are masked, and no session replay takes place.
The legal basis is our legitimate interest in stable and secure operation pursuant to Art. 6(1)(f) GDPR. We have concluded a data processing agreement with the provider. Processing takes place in a data centre within the European Union (Frankfurt). Where data is transferred to the USA, the provider has self-certified under the EU-US Data Privacy Framework, which ensures compliance with the European level of data protection on the basis of an adequacy decision of the European Commission.
5) Cookies
To make visiting our website attractive and to enable the use of certain functions, we use cookies, i.e. small text files that are stored on your device. Some of these cookies are automatically deleted after closing the browser (so-called “session cookies”), while some cookies remain on your device for longer and allow the storage of page settings (so-called “persistent cookies”). In the latter case, you can find the storage duration in the overview of your web browser’s cookie settings.
If personal data is also processed by individual cookies we use, processing is carried out pursuant to Art. 6(1)(b) GDPR either for the performance of the contract, pursuant to Art. 6(1)(a) GDPR in the case of consent given, or pursuant to Art. 6(1)(f) GDPR to protect our legitimate interests in the best possible functionality of the website and a customer-friendly and effective design of the site visit.
You can set your browser to inform you about the setting of cookies and individually decide on their acceptance or exclude the acceptance of cookies for certain cases or in general.
Please note that the functionality of our website may be limited if cookies are not accepted.
6) Contact
6.1 When contacting us (e.g. via contact form or email), personal data is processed – exclusively for the purpose of processing and responding to your inquiry and only to the extent required for this purpose.
The legal basis for processing this data is our legitimate interest in responding to your inquiry pursuant to Art. 6(1)(f) GDPR. If your contact is aimed at concluding a contract, the additional legal basis for processing is Art. 6(1)(b) GDPR. Your data will be deleted when the circumstances indicate that the matter in question has been conclusively resolved, provided no statutory retention obligations prevent this.
6.2 Brevo
For sending transactional emails, i.e. event-driven messages triggered by a specific user interaction (such as contract conclusion, registration, or password reset), we use the provider Brevo (full provider details see Data Processing Overview).
On the basis of our legitimate interest in effective and user-friendly email communication, we pass on your data provided when performing such a user action pursuant to Art. 6(1)(f) GDPR to this provider so that it can handle the email dispatch on our behalf.
We have concluded a data processing agreement with the provider that protects our site visitors’ data and prohibits disclosure to third parties.
7) Use of Customer Data for Direct Marketing
Brevo
Our email newsletters and other promotional email communications are sent via the provider Brevo (full provider details see Data Processing Overview).
On the basis of our legitimate interest in effective and user-friendly email marketing, we pass on your data provided during registration pursuant to Art. 6(1)(f) GDPR to this provider so that it can handle the email dispatch on our behalf.
We reserve the right to carry out statistical success evaluations of email campaigns using web beacons or tracking pixels in the sent emails, exclusively on the basis of your explicit consent pursuant to Art. 6(1)(a) GDPR, which can measure open rates and specific interactions with newsletter content. Device information (e.g. time of access, IP address, browser type, and operating system) is also collected and analyzed but not merged with other data sets.
You can revoke your consent to email tracking at any time with effect for the future.
We have concluded a data processing agreement with the provider that protects our site visitors’ data and prohibits disclosure to third parties.
8) Data Processing for Contract Fulfillment
8.1 For the fulfillment of the contract, we cooperate with the service provider(s) listed below, who support us in whole or in part in the execution of concluded contracts. Certain personal data is transmitted to these service providers in accordance with the following information.
8.2 Use of Payment Service Providers – Stripe
One or more online payment methods of the provider Stripe are available on this website (full provider details see Data Processing Overview).
When selecting a payment method of the provider where you pay in advance (e.g. credit card payment), your payment data communicated during the order process (including name, address, bank and payment card information, currency, and transaction number) as well as information about the content of your order are passed on pursuant to Art. 6(1)(b) GDPR. Your data is passed on in this case exclusively for the purpose of payment processing with the provider and only to the extent that it is necessary for this purpose.
When selecting a payment method where the provider pays in advance (e.g. purchase on account or installment purchase or direct debit), you will also be asked during the order process to provide certain personal data (first and last name, street, house number, postal code, city, date of birth, email address, phone number, and possibly data on an alternative payment method).
To protect our legitimate interest in determining the creditworthiness of our customers, this data is forwarded by us pursuant to Art. 6(1)(f) GDPR to the provider for the purpose of a credit check. The provider checks on the basis of the personal data you have provided and further data (such as shopping cart, invoice amount, order history, payment experience) whether the payment option you have selected can be granted with regard to payment and/or default risks.
The credit report may contain probability values (so-called score values). To the extent that score values are included in the result of the credit report, they are based on a scientifically recognized mathematical-statistical procedure. The calculation of score values includes, among other things but not exclusively, address data.
You can object to this processing of your data at any time by sending a message to us or to the provider. However, the provider may still be entitled to process your personal data if this is necessary for contractual payment processing.
8.3 Electronic Termination Option for Continuing Obligations with Consumers
Consumers who have entered into contracts for paid continuing obligations (e.g. subscription contracts) on this website have the option of terminating these via an electronic button in accordance with the applicable notice periods.
Pressing the button leads to a confirmation page where the consumer can provide further details about the termination, uniquely identify themselves, and then electronically declare their termination.
The collection of personal data and its transmission to us is carried out pursuant to Art. 6(1)(b) GDPR and only to the extent that it is necessary for the proper processing of the termination. Also on the basis of Art. 6(1)(b) GDPR, the personal data provided is used to confirm receipt of the termination declaration and the termination date electronically in text form. A further legal basis for processing is Art. 6(1)(c) GDPR. We are legally obligated to maintain an electronic termination option for consumer contracts for paid continuing obligations concluded by electronic means.
9) Hosting of the Marketing Website
This marketing website (michmatz.me) is hosted on GitHub Pages (full provider details see Data Processing Overview). When you visit the website, information is automatically stored in server log files that your browser transmits. This includes: IP address, date and time of access, requested URL, referrer URL, browser and operating system used. This data is technically necessary for delivering the website and is not merged with other data sources. Legal basis: Art. 6(1)(f) GDPR (legitimate interest in the reliable provision of the website).
For data transfers to the USA, the provider has joined the EU-US Data Privacy Framework, which ensures compliance with the European level of data protection on the basis of an adequacy decision of the European Commission.
10) Site Functionalities
10.1 Google Web Fonts
This site uses so-called web fonts from the provider Google for the uniform display of fonts (full provider details see Data Processing Overview).
When you access a page, your browser loads the required web fonts into its browser cache to correctly display texts and fonts and establishes a direct connection to the provider’s servers. In doing so, certain browser information, including your IP address, is transmitted to the provider.
The processing of personal data in the course of establishing a connection with the font provider is only carried out if you have given us your explicit consent pursuant to Art. 6(1)(a) GDPR. You can revoke your consent at any time with effect for the future by deactivating this service via the “cookie consent tool” provided on the website. If your browser does not support web fonts, a standard font from your computer will be used.
For data transfers to the USA, the provider has joined the EU-US Data Privacy Framework, which ensures compliance with the European level of data protection on the basis of an adequacy decision of the European Commission.
Further information on Google’s privacy policy can be found here: https://business.safety.google/intl/de/privacy/
10.2 Cloudflare Turnstile
On this website, we use the CAPTCHA service of the provider Cloudflare (full provider details see Data Processing Overview).
The service checks whether input is made by a natural person or abusively by machine and automated processing, and blocks spam, DDoS attacks, and similar automated malicious access. To ensure that an action is performed by a human and not by an automated bot, Cloudflare Turnstile collects the IP address of the device used, identification data of the browser and operating system type used, as well as the date and duration of the visit, and transmits this to the provider’s servers for evaluation.
The described processing is only carried out if you have given us your explicit consent pursuant to Art. 6(1)(a) GDPR. You can revoke your consent at any time with effect for the future by deactivating this service in the “cookie consent tool” provided on the website.
We have concluded a data processing agreement with the provider that ensures the protection of our site visitors’ data and prohibits unauthorized disclosure to third parties.
For data transfers to the USA, the provider has joined the EU-US Data Privacy Framework, which ensures compliance with the European level of data protection on the basis of an adequacy decision of the European Commission.
11) Reach Measurement – Plausible
11.1 This website uses the web analytics service Plausible Analytics (for full provider details, see our Data Processing Overview) in order to evaluate the use of the website statistically and to improve what we offer.
Plausible uses no cookies and creates no persistent identifiers. No user profiles are built, neither across devices nor across websites. The following is recorded for a page view: the page requested (hostname and path, without query parameters other than campaign parameters), the referring page (referrer), browser, operating system, device type, and the country, region and city derived from the IP address.
Your IP address and your browser identification (user agent) are used solely to calculate a daily-rotating count value and are not stored. That value is formed from a randomly generated value that is created anew each day, the domain of this website, your IP address and your browser identification; the random value is deleted after 24 hours. Recognition beyond the day is therefore technically impossible.
11.2 In addition we record a single event: when you activate one of the “Try it without signing up” buttons, the event “Ausprobieren” is counted, together with an indication of where on the page the activated button sits. No personal data is transmitted in the process.
The legal basis is Art. 6(1)(f) GDPR. Our legitimate interest lies in the statistical evaluation of website usage in order to shape what we offer according to need. Because this processing neither stores information on your device nor reads information from it, consent under Section 25(1) TDDDG is not required.
We have concluded a data processing agreement with the provider. The data is processed and stored exclusively on servers within the European Union (Germany). No transfer to third countries takes place.
12) Rights of the Data Subject
12.1 Applicable data protection law grants you the following data subject rights (rights of access and intervention) vis-à-vis the controller with regard to the processing of your personal data, whereby the respective legal basis is referred to for the respective exercise conditions:
- Right of access pursuant to Art. 15 GDPR;
- Right to rectification pursuant to Art. 16 GDPR;
- Right to erasure pursuant to Art. 17 GDPR;
- Right to restriction of processing pursuant to Art. 18 GDPR;
- Right to notification pursuant to Art. 19 GDPR;
- Right to data portability pursuant to Art. 20 GDPR;
- Right to withdraw consent pursuant to Art. 7(3) GDPR;
- Right to lodge a complaint pursuant to Art. 77 GDPR.
12.2 RIGHT TO OBJECT
IF WE PROCESS YOUR PERSONAL DATA ON THE BASIS OF OUR OVERRIDING LEGITIMATE INTEREST IN THE CONTEXT OF A BALANCING OF INTERESTS, YOU HAVE THE RIGHT AT ANY TIME TO OBJECT TO THIS PROCESSING WITH EFFECT FOR THE FUTURE ON GROUNDS RELATING TO YOUR PARTICULAR SITUATION.
IF YOU EXERCISE YOUR RIGHT TO OBJECT, WE WILL CEASE PROCESSING THE DATA CONCERNED. HOWEVER, FURTHER PROCESSING REMAINS RESERVED IF WE CAN DEMONSTRATE COMPELLING LEGITIMATE GROUNDS FOR THE PROCESSING WHICH OVERRIDE YOUR INTERESTS, FUNDAMENTAL RIGHTS AND FUNDAMENTAL FREEDOMS, OR IF THE PROCESSING SERVES THE ESTABLISHMENT, EXERCISE OR DEFENSE OF LEGAL CLAIMS.
IF YOUR PERSONAL DATA IS PROCESSED BY US FOR DIRECT MARKETING PURPOSES, YOU HAVE THE RIGHT TO OBJECT AT ANY TIME TO THE PROCESSING OF PERSONAL DATA CONCERNING YOU FOR THE PURPOSE OF SUCH MARKETING. YOU MAY EXERCISE THE OBJECTION AS DESCRIBED ABOVE.
IF YOU EXERCISE YOUR RIGHT TO OBJECT, WE WILL CEASE PROCESSING THE DATA CONCERNED FOR DIRECT MARKETING PURPOSES.
13) Duration of Storage of Personal Data
The duration of storage of personal data is determined by the respective legal basis, the processing purpose, and – if applicable – additionally by the respective statutory retention period (e.g. commercial and tax retention periods).
When processing personal data on the basis of explicit consent pursuant to Art. 6(1)(a) GDPR, the data concerned is stored until you revoke your consent.
If statutory retention periods exist for data processed in the context of legal or quasi-legal obligations on the basis of Art. 6(1)(b) GDPR, this data is routinely deleted after the retention periods have expired, provided it is no longer necessary for the performance of the contract or the initiation of a contract and/or there is no longer a legitimate interest on our part in continued storage.
When processing personal data on the basis of Art. 6(1)(f) GDPR, this data is stored until you exercise your right to object pursuant to Art. 21(1) GDPR, unless we can demonstrate compelling legitimate grounds for the processing which override your interests, rights, and freedoms, or the processing serves the establishment, exercise, or defense of legal claims.
When processing personal data for the purpose of direct marketing on the basis of Art. 6(1)(f) GDPR, this data is stored until you exercise your right to object pursuant to Art. 21(2) GDPR.
Unless otherwise apparent from the other information in this declaration about specific processing situations, stored personal data is otherwise deleted when it is no longer necessary for the purposes for which it was collected or otherwise processed.
