Privacy policy

Joint controllers and contact

Svetlana Siegfried and Wladislaw Siegfried operate separate sole proprietorships but jointly decide how this website, its contact form and central contact address are operated. They are joint controllers for these website-related processing activities. They jointly handle enquiries sent to mail@siegfried-makler.de; Svetlana handles enquiries addressed directly to her, and Wladislaw handles enquiries addressed directly to him. Both are based at Richard-Wagner-Str. 56, 95444 Bayreuth, Germany. Contact: svetlana@siegfried-makler.de or wladislaw@siegfried-makler.de. Data protection requests may be sent to either contact.

Hosting and server logs

The website runs on a STRATO VPS. A technical administrator manages the server, has no access to the mailboxes, but may technically access server logs. STRATO provides the VPS infrastructure. Depending on the configuration, request logs may contain the IP address, date and time, requested path and URL parameters, HTTP method and version, response status, response size, referrer and browser information. These data are used to deliver the website and detect or resolve technical and security issues; the legal basis is Article 6(1)(f) GDPR, based on the interest in secure and stable operation. Actual Nginx log settings, fields and rotation/deletion period have not yet been checked. The STRATO contract is held by the technical administrator; the processor arrangements, server location and any international transfers must be verified before launch.

Contact form and email

Required fields are name, email address and message. Acknowledging that you have read this notice is also required; the phone number is optional. The selected contact point defaults to the central mailbox. The form sends one email to the selected mailbox: mail@siegfried-makler.de (handled by both), svetlana@siegfried-makler.de (handled by Svetlana), or wladislaw@siegfried-makler.de (handled by Wladislaw). All mailboxes are on the VPS. The form sends through PHP mail(); the server’s configured mail transport still needs to be checked. The website code does not save enquiries in a database or file and sends no additional copies. The purpose is to establish contact, answer the enquiry and, where relevant, prepare a contract. The legal basis is Article 6(1)(b) GDPR for pre-contractual requests and Article 6(1)(f) GDPR for other enquiries; the legitimate interest is responding to the message. The checkbox acknowledges this notice; it is not the legal basis for processing.

Retention and backups

The relevant recipient deletes an enquiry email after it has been handled and is no longer relevant for establishing contact. If an enquiry leads to a client relationship, separate statutory retention rules may apply to resulting business records. VPS backups may contain deleted mailbox data for up to 14 days. The website does not keep a separate enquiry database.

Browser storage and external services

When you visit a language route (/de/, /en/ or /ru/), that language is stored in your browser local storage so it can be applied on a later visit to the home page. No language preference is stored on the first visit to the German root page. A manually selected light/dark theme is also stored there; otherwise the site follows your system preference. These entries remain until you clear the website data in your browser. Legal-page language is selected by the “lang” URL parameter. No cookies are set for these settings, and local-storage values are not sent to the server. Google reCAPTCHA v2 is prepared for spam protection in the contact form. It loads only after site keys are configured and you explicitly activate it. IP address, browser/device information and interaction data may then be sent to Google and cookies may be set. Activation is based on consent under Article 6(1)(a) GDPR and section 25(1) TDDDG. You can instead contact us by email or phone. Reloading ends activation for subsequent visits; Google cookies can be deleted in your browser. The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland; processing in the USA is possible. See https://policies.google.com/privacy and https://policies.google.com/terms. Current service configuration, terms, transfer safeguards and retention periods must be checked before activation. The Google Maps link contacts Google only when clicked. No analytics, external fonts or embedded maps are used.

Your rights and objection

Subject to statutory conditions, you may request access, rectification, erasure, restriction of processing and data portability. You may also complain to a data protection supervisory authority. You may exercise these rights with either joint controller using the contact details above.

Right to object under Article 21 GDPR

You may object at any time, on grounds relating to your particular situation, to processing based on Article 6(1)(f) GDPR. We will then stop processing the affected personal data unless we demonstrate compelling legitimate grounds that override your interests, rights and freedoms, or the processing serves the establishment, exercise or defence of legal claims.

Supervisory authority and items to verify

The supervisory authority for non-public bodies in Bavaria is the Bavarian State Office for Data Protection Supervision (BayLDA), Promenade 18, 91522 Ansbach, Germany; lda.bayern.de. Before public launch, verify the actual Nginx logs and rotation period, TLS/HTTPS configuration, STRATO contract and server location, the applicable processing agreements with the technical administrator and STRATO, and whether any infrastructure or backup service transfers data outside the EEA. This draft does not claim those checks have been completed.