Legal basis: Art. 6(1)(f) GDPR (legitimate interest in website functionality and security) and § 25(2) TTDSG

If you accept cookies, WordPress’s built-in analytics tracks visitor statistics including:

• Number of visitors
• Pages viewed
• Geographic location (anonymized)
• Device and browser information
• Traffic sources

Legal basis: Art. 6(1)(a) GDPR (consent)

You can withdraw consent at any time by clearing your cookies or revisiting the cookie banner to adjust your preferences.

4. Data Transfers to Third Countries

Some of the service providers I work with (Microsoft, Google Fonts) operate servers in the United States, which is considered a third country outside the European Economic Area (EEA) under data protection law.

What does this mean?  

The USA has different data protection laws than the EU. However, Microsoft and Google have implemented safeguards to ensure your data receives adequate protection:

Safeguards in place:  

• EU-US Data Privacy Framework (DPF): Microsoft and Google are certified under this framework, which has been recognized by the European Commission as providing adequate protection (Adequacy Decision, July 2023; confirmed by EuGH 2025).
• EU Standard Contractual Clauses: Additional contractual safeguards approved by the EU Commission (Art. 46(2)(c) GDPR). Microsoft’s EU Data Boundary keeps most M365/Bookings data in EU datacenters (Germany, etc.), with limited operational transfers to USA.
• Technical and organizational measures: Encryption, access controls, and security protocols.

Transparency: While these safeguards provide strong protection, I want to be transparent that data protection authorities and courts continue to scrutinize international data transfers. The legal landscape is evolving, and I continuously monitor developments to ensure compliance.

5. Your Rights Under GDPR

You have comprehensive rights regarding your personal data. These are not just theoretical – they are legally enforceable rights that I respect and facilitate.

Right of Access (Art. 15 GDPR)
You have the right to know what personal data I store about you. You can request a copy of your data at any time.

Right to Rectification (Art. 16 GDPR)
If your data is incorrect or incomplete, you have the right to have it corrected or completed.

Right to Erasure (Art. 17 GDPR)
Also known as the „right to be forgotten.“ You can request deletion of your data if:

• The data is no longer necessary for the purpose it was collected
• You withdraw your consent and there is no other legal basis for processing
• You object to processing and there are no overriding legitimate grounds
• The data was processed unlawfully

Note: This right may be limited by statutory retention obligations (e.g., tax and accounting records must be kept for 10 years).

Right to Restriction of Processing (Art. 18 GDPR)
You can request that I limit how I use your data in certain situations, such as when you contest the accuracy of the data.

Right to Data Portability (Art. 20 GDPR)
You have the right to receive your personal data in a structured, commonly used, and machine-readable format. You can also request that I transmit this data directly to another controller.

Right to Object (Art. 21 GDPR)
You can object to processing based on legitimate interests (Art. 6(1)(f) GDPR) at any time. I will then stop processing unless I can demonstrate compelling legitimate grounds that override your interests.

Right to Withdraw Consent (Art. 7(3) GDPR)
If processing is based on your consent, you can withdraw it at any time. The withdrawal does not affect the lawfulness of processing before the withdrawal.

How to Exercise Your Rights
Contact me at: dataprotection@facilicat.com

I will respond to your request without undue delay and within one month of receiving it. If your request is complex, I may extend this period by two months and will inform you accordingly.

Right to Lodge a Complaint
If you believe I am processing your data unlawfully, you have the right to lodge a complaint with a data protection supervisory authority.

The competent authority for Baden-Württemberg:

Der Landesbeauftragte für den Datenschutz und die Informationsfreiheit Baden-Württemberg
Lautenschlagerstraße 20
70173 Stuttgart, Germany

Website: www.baden-wuerttemberg.datenschutz.de

You can also contact the supervisory authority in your country of residence or workplace.

6. Data Security

I take the security of your data seriously and implement appropriate technical and organizational measures to protect your personal data against accidental or unlawful destruction, loss, alteration, unauthorized disclosure, or access (Art. 32 GDPR).

Security measures include:

Technical measures:

• SSL/TLS encryption for all data transmission (you can see this by the lock symbol in your browser’s address bar)
• Encrypted email communication through Microsoft 365
• Regular security updates and patches
• Firewalls and intrusion detection systems
• Secure password policies and authentication mechanisms

Organizational measures:

• Access restricted to authorized personnel only (in my case, primarily myself)
• Data processing agreements with all processors
• Regular review of data protection practices
• Data minimization (collecting only what’s necessary)
• Clear data retention and deletion procedures

No security system is perfect: While I implement strong security measures, no system can guarantee 100% security. I continuously monitor and update my security practices to address new threats.

7. Appointment Booking via Microsoft Bookings

When you book an appointment through my online booking system (Microsoft Bookings), additional data protection information applies.

How the Booking Process Works

1. You access the booking page
2. You select a date and time
3. You provide your contact information (name, email)
4. Before confirming, you must acknowledge the data protection notice
5. You receive an appointment confirmation via email

Required Acknowledgment

Before you can complete your booking, you will be asked to confirm:
„I acknowledge that my contact details (name, email address) will be processed for appointment scheduling via Microsoft Bookings. Data processing takes place on Microsoft servers (EU/USA) based on contract fulfillment (Art. 6(1)(b) GDPR). Further information can be found in the Privacy Policy.“

Why This Acknowledgment is Necessary

Under Art. 13 GDPR, I must inform you about data processing before collecting your data. This acknowledgment ensures you understand that:

• Your appointment data will be stored on Microsoft servers
• Microsoft acts as a data processor on my behalf
• Data may be processed in the USA under appropriate safeguards
• The legal basis is contract fulfillment (arranging our meeting)

What Happens to Your Appointment Data

• Appointment details are stored in my Microsoft 365 calendar
• You might receive automated confirmation and reminder emails
• I can see your contact information and appointment details to prepare for our meeting
• After the appointment, the data remains in my system for up to 3 years for business continuity purposes

You can cancel or modify your appointment by contacting me directly at the email or phone number provided above.

8. Changes to this Privacy Policy

Data protection law continues to evolve, as do the services and tools I use. I reserve the right to update this privacy policy to reflect:

• Changes in applicable laws and regulations
• New services or tools I implement
• Guidance from data protection authorities
• Improvements in data protection practices

When I make changes: The updated policy will be published on this page with a new „last updated“ date. For significant changes that affect your rights, I will provide additional notice (e.g., via email if I have your contact information in an ongoing relationship).

Your responsibility: I encourage you to review this policy periodically to stay informed about how I protect your data.

Questions or Concerns?

If you have any questions about this privacy policy, how I handle your data, or your rights, please contact me:

Email: dataprotection@facilicat.com
Phone: +49 711 50440080

I’m here to help and committed to transparency in all data processing activities.