Privacy Notice

Information about the processing of personal data on medienlab.de.

1. Controller

Mike Schönfelder – medienlab
Krausestraße 43
22049 Hamburg
Germany
Email: kontakt@medienlab.de

2. General information

Personal data means any information relating to an identified or identifiable natural person. Unless stated otherwise below, the provision of personal data is neither legally nor contractually required. If information required to process a specific enquiry is not provided, we may not be able to deal with that enquiry.

3. Hosting and technical log data

This website is hosted by DomainFactory GmbH, c/o WeWork, Neuturmstraße 5, 80331 Munich, Germany. To operate the website, the hosting provider processes technically necessary connection and access data, including IP address, timestamp, requested resource, HTTP status and browser information. Our email service is also provided through DomainFactory; details of Titan and the service providers involved are set out in sections 4 and 12. Sending and receiving email may involve technical metadata such as sender, recipient, time, IP address and message size.

This processing supports service provision, troubleshooting and the prevention of abusive access. The legal basis is Art. 6(1)(f) GDPR; our legitimate interest is the secure and reliable operation of these services.

The retention of technical logs depends on the configuration applicable to the hosting and email services used and on operational and security requirements. Relevant records may be needed for longer while a specific technical fault or suspected misuse is investigated.

4. Contact by email

If you contact us by email, we process the information you provide in order to handle your enquiry. Where the contact relates to steps taken at your request prior to entering into a contract or to the performance of a contract, the legal basis is Art. 6(1)(b) GDPR. In other cases, processing is based on Art. 6(1)(f) GDPR and our legitimate interest in handling business enquiries.

For our business mailbox kontakt@medienlab.de, we use “Professional E-Mail powered by Titan” through DomainFactory. DomainFactory engages Titan Solution Ltd SEZC, based in the Cayman Islands, as a sub-processor for this service. The email service processes sender and recipient addresses, message content, any attachments provided, and connection and delivery data. This enables us to send, receive and store business correspondence and helps protect against spam and malware.

The mailbox is accessed on devices used by medienlab. Section 12 describes the recipients and possible processing outside the EU or European Economic Area; retention periods are explained in section 11.

5. Contact form

Our contact forms allow you to submit a topic, message, name, company and email address, as well as an optional telephone number, website or product address, preferred project start and budget range. The fields available depend on the form. Required fields are identified accordingly. We process this information in order to handle and respond to your enquiry.

Form data is validated on the server and sent as a plain-text email to the medienlab contact mailbox. These messages are also subject to the email processing through DomainFactory and Titan described in sections 4 and 12. Enquiries are currently not stored permanently in a website database; the resulting message is stored in the email mailbox.

To protect the form, we use a technically necessary PHP session with CSRF protection, an invisible honeypot and server-side plausibility and security checks. We do not use external CAPTCHA, analytics or tracking services for this purpose.

The legal basis is Art. 6(1)(b) GDPR where the enquiry relates to steps prior to entering into a contract or to the performance of a contract. In other cases, processing is based on Art. 6(1)(f) GDPR and our legitimate interest in being able to handle business enquiries.

6. Technically necessary form session

On pages containing a contact form, a session cookie associates the form with your session and protects against unauthorised requests (CSRF). If validation fails, the submitted details are held temporarily in the server-side session so that you do not have to enter them again. The time of a successful submission is also stored briefly to limit immediately repeated submissions.

Temporarily stored form details are removed after successful submission. After 30 minutes, they are discarded on the next form request. The cookie has no persistent lifetime and uses HttpOnly and SameSite=Lax; Secure is also set when HTTPS is used. Server-side sessions are additionally subject to the hosting service’s cleanup process.

Storage on and access to the device serve only the necessary form functionality and security, not analytics, advertising or profiling. The legal basis for strictly necessary device access is Section 25(2), point 2, of the German TDDDG. Processing personal data for form security is based on Art. 6(1)(f) GDPR.

7. Locally hosted fonts

The Inter and Space Grotesk fonts used on this website are served locally from our own web server. Loading these fonts does not establish a connection to Google Fonts or another external font provider.

8. No analytics or marketing services

We currently do not embed web analytics or marketing tracking services in this website. In particular, we do not use Google Analytics, marketing pixels or social media plugins. The website also currently contains no embedded YouTube/Vimeo content, Google Maps, newsletter service or external appointment-booking service.

8a. Google Search Console and site verification

We plan to use Google Search Console for technical website management and to review how our website appears in Google Search. A meta tag containing a verification code is included in the HTML head of the website to verify site ownership. This meta tag does not load Google scripts, set cookies or send additional visitor data to Google during normal browsing.

Any search performance reports used in Search Console come from Google’s search services. The meta-tag verification is not an integration of Google Analytics and does not record interactions with our contact form.

9. External links

This website contains links to external services and websites, for example project, platform or technology partners. As a rule, a connection to the respective external provider is established only when you actively follow such a link. The respective provider is responsible for subsequent processing on the destination website.

10. Encrypted transmission

This website is provided via HTTPS. This encrypts data transmitted between your browser and the web server in accordance with standard web technology.

11. Retention periods

Personal data is processed only for as long as necessary for the respective purpose or for as long as statutory retention obligations apply. Data relating to enquiries is deleted once the enquiry has been dealt with and there are no statutory or contractual reasons for further retention. If an enquiry results in a contractual relationship, commercial and tax-law retention obligations may apply in particular.

12. Recipients, processors and international processing

DomainFactory GmbH provides hosting, email infrastructure and the technical services for this website. Titan Solution Ltd SEZC is involved as a sub-processor in providing the email service. The providers may engage further service providers for infrastructure, operations, support and email security. Personal data is disclosed to other recipients only where this is necessary to deal with an enquiry or where we are legally required to do so.

According to DomainFactory’s information about the email service (German), the servers are located in Frankfurt am Main. DomainFactory also states that service provision may involve processing and access outside Germany and Europe. Processing exclusively within the EU or European Economic Area is therefore not guaranteed.

Titan’s published data processing terms refer to standard data protection clauses under Art. 46(2)(c) GDPR for the circumstances specified in those terms. These clauses provide contractual safeguards for the relevant data transfers. The terms and information about the service providers involved are available through the links below. You may request further information about the safeguards applicable to our processing using the contact details above.

13. Your rights

Where the statutory requirements are met, you have, in particular, the right of access (Art. 15 GDPR), rectification (Art. 16 GDPR), erasure (Art. 17 GDPR), restriction of processing (Art. 18 GDPR) and data portability (Art. 20 GDPR). Where processing is based on Art. 6(1)(f) GDPR, you may object to the processing in accordance with Art. 21 GDPR.

14. Right to lodge a complaint

Under Art. 77 GDPR, you have the right to lodge a complaint with a data protection supervisory authority if you believe that the processing of your personal data infringes applicable data protection law.

15. Updates to this privacy notice

We update this privacy notice if the technologies or service providers we use change or if legal requirements make an update necessary.

Last updated: 1 October 2026.