Privacy Notice

1. Controller

Mike Schönfelder – medienlab
Krausestraße 43
22049 Hamburg
Germany
Email: kontakt@medienlab.de

2. General information

Personal data means any information relating to an identified or identifiable natural person. Unless stated otherwise below, the provision of personal data is neither legally nor contractually required. If information required to process a specific enquiry is not provided, we may not be able to deal with that enquiry.

3. Hosting and technical log data

This website and the contact mailbox are hosted by DomainFactory GmbH, c/o WeWork, Neuturmstraße 5, 80331 Munich, Germany. To operate the website, the hosting provider processes technically necessary connection and access data, including IP address, timestamp, requested resource, HTTP status and browser information. Sending and receiving email may also involve technical metadata such as sender, recipient, time and message size.

This processing supports service provision, troubleshooting and the prevention of abusive access. The legal basis is Art. 6(1)(f) GDPR; our legitimate interest is the secure and reliable operation of these services.

The retention of technical logs depends on the configuration applicable to the hosting and email services used and on operational and security requirements. Relevant records may be needed for longer while a specific technical fault or suspected misuse is investigated.

4. Contact by email

If you contact us by email, we process the information you provide in order to handle your enquiry. Where the contact relates to steps taken at your request prior to entering into a contract or to the performance of a contract, the legal basis is Art. 6(1)(b) GDPR. In other cases, processing is based on Art. 6(1)(f) GDPR and our legitimate interest in handling business enquiries.

The business email account kontakt@medienlab.de is hosted by DomainFactory. It is accessed on devices used by medienlab.

5. Contact form

Our contact form allows you to submit a topic, message, name, company, email address and, optionally, a telephone number. Required fields are identified accordingly. We process this information in order to handle and respond to your enquiry.

Form data is validated on the server and sent as a plain-text email to the medienlab contact mailbox. Enquiries are currently not stored permanently in a website database.

To protect the form, we use a technically necessary PHP session with CSRF protection, an invisible honeypot and server-side plausibility and security checks. We do not use external CAPTCHA, analytics or tracking services for this purpose.

The legal basis is Art. 6(1)(b) GDPR where the enquiry relates to steps prior to entering into a contract or to the performance of a contract. In other cases, processing is based on Art. 6(1)(f) GDPR and our legitimate interest in being able to handle business enquiries.

6. Technically necessary form session

On pages containing a contact form, a session cookie associates the form with your session and protects against unauthorised requests (CSRF). If validation fails, the submitted details are held temporarily in the server-side session so that you do not have to enter them again. The time of a successful submission is also stored briefly to limit immediately repeated submissions.

Temporarily stored form details are removed after successful submission. After 30 minutes, they are discarded on the next form request. The cookie has no persistent lifetime and uses HttpOnly and SameSite=Lax; Secure is also set when HTTPS is used. Server-side sessions are additionally subject to the hosting service’s cleanup process.

Storage on and access to the device serve only the necessary form functionality and security, not analytics, advertising or profiling. The legal basis for strictly necessary device access is Section 25(2), point 2, of the German TDDDG. Processing personal data for form security is based on Art. 6(1)(f) GDPR.

7. Locally hosted fonts

The Inter and Space Grotesk fonts used on this website are served locally from our own web server. Loading these fonts does not establish a connection to Google Fonts or another external font provider.

8. No analytics or marketing services

We currently do not embed web analytics or marketing tracking services in this website. In particular, we do not use Google Analytics, marketing pixels or social media plugins. The website also currently contains no embedded YouTube/Vimeo content, Google Maps, newsletter service or external appointment-booking service.

8a. Google Search Console and site verification

We plan to use Google Search Console for technical website management and to review how our website appears in Google Search. A meta tag containing a verification code is included in the HTML head of the website to verify site ownership. This meta tag does not load Google scripts, set cookies or send additional visitor data to Google during normal browsing.

Any search performance reports used in Search Console come from Google’s search services. The meta-tag verification is not an integration of Google Analytics and does not record interactions with our contact form.

9. External links

This website contains links to external services and websites, for example project, platform or technology partners. As a rule, a connection to the respective external provider is established only when you actively follow such a link. The respective provider is responsible for subsequent processing on the destination website.

10. Encrypted transmission

This website is provided via HTTPS. This encrypts data transmitted between your browser and the web server in accordance with standard web technology.

11. Retention periods

Personal data is processed only for as long as necessary for the respective purpose or for as long as statutory retention obligations apply. Data relating to enquiries is deleted once the enquiry has been dealt with and there are no statutory or contractual reasons for further retention. If an enquiry results in a contractual relationship, commercial and tax-law retention obligations may apply in particular.

12. Recipients and processing on our behalf

DomainFactory GmbH is used for hosting, email infrastructure and the technical provision of the website. Where service providers process personal data on our behalf, this is carried out in accordance with the statutory requirements governing processing on behalf of a controller. Personal data is disclosed to other recipients only where this is necessary to deal with an enquiry or where we are legally required to do so.

13. Your rights

Where the statutory requirements are met, you have, in particular, the right of access (Art. 15 GDPR), rectification (Art. 16 GDPR), erasure (Art. 17 GDPR), restriction of processing (Art. 18 GDPR) and data portability (Art. 20 GDPR). Where processing is based on Art. 6(1)(f) GDPR, you may object to the processing in accordance with Art. 21 GDPR.

14. Right to lodge a complaint

Under Art. 77 GDPR, you have the right to lodge a complaint with a data protection supervisory authority if you believe that the processing of your personal data infringes applicable data protection law.

15. Updates to this privacy notice

We update this privacy notice if the technologies or service providers we use change or if legal requirements make an update necessary.