Privacy notice

2. Website access and hosting

This website is hosted by STRATO GmbH, Otto-Ostrowski-Straße 7, 10249 Berlin, Germany. Delivery and security require connection data, including IP address, time, requested address, HTTP status, volume, browser/operating-system details and, if transmitted, the referring page. STRATO receives these data as the hosting provider. The basis is Art. 6(1)(f) GDPR: our legitimate interest in a secure, reliably available website.

STRATO states that original IP addresses are retained for up to seven days to detect and prevent attacks. Separately, access logs described by the provider as anonymised are available in the hosting account for the preceding six weeks.

A data-processing agreement under Art. 28 GDPR is in place with STRATO.

3. Data-minimising access statistics

Alongside the statistics in the protected STRATO hosting account, we run a simple page counter on our own server. A full HTML request immediately increases an aggregate for that page and calendar day (Europe/Berlin time). Only these totals and the date counting began are stored. The German/English split is derived from the page path. This statistics store contains no IP addresses, visitor identifiers, individual timestamps, query parameters, referring pages or browser characteristics. It is not combined with enquiries.

The counter uses no analytics cookies or other analytics storage on your device, and loads no additional tracking code, counting pixel or external analytics service. Connection data already transmitted with a request are processed to deliver the page; our application uses only the page path and technical request information to distinguish full page requests from preloading. Our purpose and legitimate interest are a simple, data-minimising assessment of website usage (Art. 6(1)(f) GDPR). The hosting information above applies separately to STRATO logs.

The report covers a rolling 365-day window. Older daily totals are removed the next time a page is counted or the dashboard is opened. Repeat requests, our own visits and automated requests can be included; view changes without a new HTML request and pages displayed from browser cache may be missing. These figures therefore do not represent distinct people.

The dashboard is password-protected. Only in this private statistics area, a necessary session cookie (aq_statistics) supports login and protection against forged form requests. It is restricted to this area and is not used to count visitors. Login expires after 30 minutes of inactivity and at most eight hours. Processing relies on Art. 6(1)(f) GDPR; storage supports the expressly requested protected access (section 25(2)(2) TDDDG). Passwords are stored only as verification hashes. Login protection retains only a global attempt count for the current minute, not IP addresses.

4. Email and telephone enquiries

We use the contact details and enquiry content you supply to respond. Enquiries about a potential contract are processed under Art. 6(1)(b) GDPR; other correspondence under Art. 6(1)(f), reflecting our interest in appropriate communication. Providing information is voluntary, but insufficient details may prevent us from replying. Access is limited to Stephan Sauer and the necessary technical providers, particularly STRATO for email.

Enquiries are deleted when handling is complete and retention is no longer necessary. Statutory retention duties or the need to establish or defend legal claims may require relevant documents to be kept until the applicable periods expire.

5. Contact form

The form transmits your name, email address, topic and message, together with any optional company or telephone details, over an encrypted connection to our website server. The server sends an email to kontakt@aquasphere-phytoscience.de. This address and stephan@aquasphere-phytoscience.de receive mail in the STRATO mailbox info@aquasphere-phytoscience.de. Stephan Sauer handles enquiries exclusively through STRATO Webmail, without additional CRM, cloud or AI services.

We use these details to respond to your enquiry. The legal basis is Art. 6(1)(b) GDPR for enquiries relating to a potential contract, or Art. 6(1)(f) for other correspondence. Contacts are not used for newsletters or advertising, or passed to cooperation partners. Required fields are needed to handle the enquiry; supplying them is not a statutory obligation. You can also contact us by email or telephone. Retention follows the criteria in the enquiries section.

6. Music, media and settings

Images, fonts, animations and music load from our own hosting space, not external media platforms. Requests involve the same connection data as page access. Use “Turn sound off” to stop the quiet background music. If autoplay is blocked, it starts only after pressing “Turn sound on”. Neither microphone nor camera is used.

Only after you use the sound button do we save your “on” or “off” choice as “aquasphere-design-sound” in that tab’s sessionStorage, so it survives page changes. No visitor identifier is stored or sent to the server. Storage lasts for the tab session and can be cleared through browser controls. Its sole purpose is the sound control you requested (section 25(2)(2) TDDDG). No additional analytics or marketing storage is used by our website.

The website runtime may also use temporary session storage to prevent repeated page-reload loops. This error handling supports reliable navigation, contains no visitor identifier and is not used for analytics or advertising.

7. External links and transfers

References are ordinary links. A destination is requested only when you open it, and its provider’s privacy policy then applies. Our website features do not embed external analytics, maps, video platforms or advertising. These features do not envisage transfers to recipients outside the European Economic Area.

8. Your rights

Subject to the statutory conditions, you may request access, rectification, erasure, restriction and data portability (Arts. 15–20 GDPR). Where processing relies on consent, you may withdraw it for the future without affecting the lawfulness of earlier processing. We do not make automated decisions, including profiling, within the meaning of Art. 22 GDPR.

9. Right to object

You may object at any time to processing based on Art. 6(1)(f) GDPR for reasons relating to your particular situation (Art. 21 GDPR). Please use the contact details above.

10. Right to complain

You may complain to a data protection authority, particularly where you normally live or work or where you believe an infringement occurred (Art. 77 GDPR). The Bavarian State Office for Data Protection Supervision (BayLDA) supervises private-sector controllers in Bavaria.