Draft (Art. 13 GDPR) for the adconsent website/app. Replace placeholders and obtain lawyer review before go-live.
1. Controller
Advertiso GmbH
Mielerstede 6, 22927 Großhansdorf, Germany
Email: kontakt@advertiso.de · Phone: +49 40 25309121
Data Protection Officer: [DATENSCHUTZBEAUFTRAGTER falls bestellt]
2. Purposes and legal bases
- Operating the website and admin app; contract performance (Art. 6(1)(b) GDPR).
- Security, abuse prevention, server logs (Art. 6(1)(f) GDPR).
- Billing and accounting (Art. 6(1)(c)/(b) GDPR).
- Consent where applicable (Art. 6(1)(a) GDPR).
3. Hosting / processors
Hosting by Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany (servers in Germany / EU) as processor.
CDN: [CDN-Anbieter]
Payment provider: [ZAHLUNGSANBIETER]
4. Data processed
- Server logs: IP, timestamp, URL, user agent, referrer — short-term for security.
- Account data: name, email, organization name, auth data, accepted contract versions.
- Admin usage: configurations, properties, scan results.
- Consent-log data on behalf of customers: pseudonymous consent ID, IP-derived country, user-agent hash, TC string, timestamps — Advertiso acts as processor; see the DPA/AVV.
5. Cookies on our own site/app
- Session cookie for login (necessary).
- Our own CMP consent cookie for this site (where a banner is used).
- Optional cookies only after consent.
6. Retention
- Account data: contract term plus statutory retention (often up to 10 years for accounting).
- Server logs: typically days to weeks unless needed for security incidents.
- Backups: daily with 14-day retention.
- Customer consent logs: per DPA / customer instructions.
7. Recipients / transfers
Primarily EU/EEA (Hetzner, Germany). If [CDN-Anbieter] or [ZAHLUNGSANBIETER] process outside the EU, transfers use appropriate safeguards (e.g. SCCs). [PRÜFEN after final vendor selection.]
8. Data subject rights
Access, rectification, erasure, restriction, portability, objection, and withdrawal of consent (where processing is based on consent). Contact: kontakt@advertiso.de.
9. Supervisory authority
Unabhängiges Landeszentrum für Datenschutz Schleswig-Holstein (ULD)
Holstenstraße 98, 24103 Kiel
www.datenschutzzentrum.de
10. Requirement to provide data
Account data are required to conclude and perform the contract; without them the Service cannot be provided.