Privacy Policy

1. Controller

The controller responsible for data processing on this website within the meaning of the General Data Protection Regulation (GDPR) is:

Alexander Lutsyuk – Arnika Plau
Dr. Alban Str. 24
19395 Plau am See
Germany

Phone: +49 179 3949637
Email: info@arnika-web.com

No data protection officer has been appointed, as there is no statutory obligation to do so.

2. General information on data processing

(1) We process personal data only to the extent necessary to provide this website and our services, or where a legal basis exists. Legal bases include in particular:

  • Art. 6 (1)(a) GDPR – consent
  • Art. 6 (1)(b) GDPR – performance of a contract or pre-contractual measures
  • Art. 6 (1)(c) GDPR – legal obligation (e.g. tax retention duties)
  • Art. 6 (1)(f) GDPR – legitimate interest (e.g. secure and stable operation of the website)
  • § 25 (2) TDDDG – storing or accessing information on your device where this is strictly necessary to provide a service you have expressly requested

(2) Personal data are not transferred to third countries outside the EU/EEA without your consent, except for the technically necessary use of Cloudflare Turnstile on contact forms as described below. Google services (fonts, maps) are loaded only after consent.

(3) Personal data are deleted as soon as the purpose of storage ceases to apply and no statutory retention obligations prevent deletion.

3. Hosting and server log files

(1) This website is hosted by: Contabo GmbH, Welfenstraße 22, 81541 Munich, Germany. A data-processing agreement under Art. 28 GDPR has been concluded with the hosting provider. The servers are located in Germany / the European Union.

(2) When this website is accessed, the hosting provider automatically collects and stores information in so-called server log files:

  • IP address of the requesting device
  • date and time of access
  • page or file accessed
  • referrer URL (previously visited page)
  • browser type and version used
  • operating system used

(3) Processing is based on Art. 6 (1)(f) GDPR. Our legitimate interest is the technically error-free, secure and stable operation of the website and defence against attacks. Log data are deleted or anonymised after 14 days, unless a security-related evaluation (e.g. in case of an attack) requires longer retention.

4. Contact (email and contact form)

(1) When you contact us by email or via a contact form, we process the data you provide (name, email address, phone number if any, and the content of your message) solely to handle your enquiry.

(2) The legal basis is Art. 6 (1)(b) GDPR where the enquiry relates to a contract or pre-contractual measures; otherwise Art. 6 (1)(f) GDPR (legitimate interest in answering enquiries).

(3) Data are deleted once the enquiry has been finally handled and no statutory retention obligations (e.g. for business correspondence under § 257 HGB / § 147 AO) apply.

5. Web analytics with Matomo (cookieless)

(1) This website uses the open-source software Matomo for statistical analysis of visitor access. Matomo is operated on our own server in Germany (self-hosting) at stats.arnika-web.com. The data collected are not shared with third parties.

(2) Matomo is configured without cookies on this website: no cookies are set on your device. Measurement runs independently of the consent bar (no Google tag, no Google Analytics).

(3) Your IP address is anonymised before storage (masking of the last two octets, e.g. 192.168.x.x). Together with technical browser data, Matomo derives a configuration identifier that changes each calendar day (no cookie, no stable cross-device visitor ID). We cannot recognise you across days. There is no cross-site tracking.

(4) The legal basis is Art. 6 (1)(f) GDPR. Our legitimate interest is anonymised statistical analysis of usage to optimise our offering. Where this involves accessing information on your device, we also rely on § 25 (2) TDDDG (strictly necessary reach measurement). Anonymising the IP address and not using cookies protects your confidentiality interests.

(5) If your browser supports and has enabled “Do Not Track”, your visits are not recorded by Matomo. You may also object under Art. 21 GDPR (contact details in section 1).

6. Consent to external content (TDDDG)

(1) Google Fonts and Google Maps are loaded only after you click Accept on the bar at the bottom of the page (or “Load map” on the contact page). Until then, your browser does not connect to Google’s servers.

(2) The legal basis is your consent under Art. 6 (1)(a) GDPR and § 25 (1) TDDDG. Consent is voluntary. Reject is equally available and leaves necessary functions only; the site remains fully usable, with system fonts and without the map if you refuse.

(3) We store your choice in the cookie arnika_consent (values necessary or google, lifetime 180 days, SameSite=Lax). This cookie is required to remember your decision and falls under § 25 (2) TDDDG.

(4) You may withdraw consent at any time with effect for the future via the External content control at the bottom left of the screen, or by deleting cookies in your browser.

7. Strictly necessary storage

In addition to the consent cookie, the website may set arnika_lang_pref to remember a chosen language version (DE/EN). Legal basis: § 25 (2) TDDDG, Art. 6 (1)(f) GDPR. Lifetime: up to 12 months.

8. Cloudflare Turnstile (spam protection)

(1) On the contact forms and the free security check we use Cloudflare Turnstile (Cloudflare, Inc., USA) to limit automated submissions. A Cloudflare script is loaded; your IP address and technical browser data are transmitted to Cloudflare.

(2) Legal basis: Art. 6 (1)(f) GDPR and § 25 (2) TDDDG (spam protection is necessary for the form service you choose to use). Transfers to the USA rely on standard contractual clauses (Art. 46 GDPR).

(3) We do not use Google reCAPTCHA.

9. Google Fonts (only after consent)

(1) After your consent, fonts may be loaded from Google Ireland Ltd. / Google LLC (USA) (fonts.googleapis.com / fonts.gstatic.com). Your IP address is then transmitted to Google.

(2) Legal basis: Art. 6 (1)(a) GDPR, § 25 (1) TDDDG. Transfers to the USA rely on your consent (Art. 49 (1)(a) GDPR) and, where applicable, Google’s standard contractual clauses (Art. 46 GDPR).

(3) Without consent we use the system fonts on your device. Google font servers are not contacted.

10. Google Maps (only after consent)

(1) On the contact pages, a Google Maps iframe may be embedded after consent. Google then receives your IP address and learns that you visited our website.

(2) Legal basis: Art. 6 (1)(a) GDPR, § 25 (1) TDDDG; third-country transfer as in section 9.

(3) Without consent we show a placeholder. “Load map” loads the map and counts as consent for external Google content.

11. Blog comments

(1) If you leave comments on this website, we process, in addition to your comment, the data you provide (name or pseudonym, email address), the time of creation and your IP address.

(2) The IP address is stored for our protection in case third parties’ rights are infringed by your comment (e.g. unlawful content). Legal basis: Art. 6 (1)(f) GDPR.

(3) Your email address is not published. Comments remain stored until the commented content is deleted or statutory deletion duties apply.

(4) If you consent when commenting to storage of your name and email address in a cookie (opt-in), this is solely for convenience so you need not re-enter your details for a further comment. Legal basis: Art. 6 (1)(a) GDPR; you may delete this cookie at any time via your browser settings.

12. Recipients of data and processors

Personal data are disclosed only to the following categories of recipients where necessary for operating the website and performing contracts, or where you have consented:

  • hosting provider (processing under Art. 28 GDPR)
  • email service provider (processing under Art. 28 GDPR)
  • Cloudflare, Inc. (Turnstile on forms; standard contractual clauses)
  • Google Ireland Ltd. / Google LLC (fonts and Maps, only after consent)
  • tax advisors where applicable (due to legal obligations)

Further disclosure occurs only if we are legally obliged or you have consented. We do not use Google Analytics, the Google tag (gtag.js) or Google Tag Manager. Google Search Console is queried server-side via our SEO plugin with our own credentials, not in visitors’ browsers.

13. Your rights as a data subject

You have the following rights regarding your personal data:

  • access (Art. 15 GDPR)
  • rectification of inaccurate data (Art. 16 GDPR)
  • erasure (Art. 17 GDPR)
  • restriction of processing (Art. 18 GDPR)
  • data portability (Art. 20 GDPR)
  • objection to processing based on Art. 6 (1)(f) GDPR (Art. 21 GDPR)
  • withdrawal of consent with effect for the future (Art. 7 (3) GDPR)

To exercise your rights, an informal notice to the contact details above is sufficient.

14. Right to lodge a complaint with a supervisory authority

You have the right to lodge a complaint with a data-protection supervisory authority about our processing of your personal data (Art. 77 GDPR). The competent authority is:

The State Commissioner for Data Protection and Freedom of Information of Mecklenburg-Vorpommern
Werderstraße 74a
19055 Schwerin
Website: www.datenschutz-mv.de

15. SSL/TLS encryption

This website uses SSL/TLS encryption for security and to protect transmission of confidential content. You can recognise an encrypted connection by “https://” and the padlock symbol in your browser’s address bar.

16. Data security

We take technical and organisational security measures under Art. 32 GDPR to protect your data against manipulation, loss, destruction and unauthorised access. Our security measures are continuously improved in line with technological developments.

17. Currency of this privacy policy

This privacy policy is currently valid and dated August 2026. Further development of our website or changes in legal requirements may require an update.

Last updated: August 2026