Privacy
Controller and contact
The controller for personal data processed on this website is innData Kommunikationssysteme, Martin Rieder, Obere Hofmark 8, 84543 Winhöring, Germany. Telephone: 08671 973358-0. Email: info@inndata.de. For data protection enquiries: datenschutz@inndata.de. Martin Rieder handles data protection enquiries at datenschutz@inndata.de.
Scope of this notice
This notice covers the company website, its contact options and the protected administration area. Separate linked products and services are subject to the privacy notices provided on their respective websites.
Website delivery and hosting
The website runs on a server rented by innData from Hetzner in Germany. The provider is Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany. innData administers the server itself. Visits involve processing technically necessary connection data, such as IP address, time, requested address and information transmitted by the browser, to deliver the website and protect its operation. The legal basis is Article 6(1)(f) GDPR; our legitimate interest is a secure and reliable website. Hosting provider information: https://www.hetzner.com/de/legal/privacy-policy/ . A data processing agreement pursuant to Article 28 GDPR is in place with Hetzner.
Logs and abuse prevention
The website application does not keep permanent general access logs. innData does not keep additional website access logs outside the application either, including reverse proxy access logs. To limit contact requests, IP addresses and timestamps are processed temporarily in memory. The checking window is ten minutes; expired entries are cleared on subsequent requests and are lost on restart. The legal basis is Article 6(1)(f) GDPR; our legitimate interest is preventing abusive requests and maintaining website availability.
Language selection and browser storage
When you select a language, the website stores its language code in your browser’s localStorage to remember your choice on later visits. No user profile is created. This setting has no fixed expiry and remains until changed or until you delete the website data in your browser. Storage serves your selected language setting (section 25(2), point 2 TDDDG); where personal data is involved, processing relies on Article 6(1)(f) GDPR and our interest in providing a usable multilingual website.
No analytics or advertising services
The public website does not use analytics or advertising cookies. It has no social plugins, comment functions or externally embedded font, map or video services. Links to other websites connect to the respective provider only when opened.
Contact by email, telephone or form
When you contact us, we process your contact details and enquiry content to handle and answer your request. Article 6(1)(b) GDPR applies to contractual or pre-contractual enquiries; Article 6(1)(f) GDPR applies to other matters based on our interest in handling incoming communications. Statutory duties may provide a basis under Article 6(1)(c) GDPR. Where we obtain separate consent, Article 6(1)(a) GDPR applies. Acknowledging this privacy notice does not constitute consent to advertising.
Contact form data
Where the contact form is available, it processes name, company, email address, optional telephone number, subject or service, location where applicable, message, language and acknowledgement of this notice. Enquiries are stored in a local database with processing or delivery status and sent to innData when email delivery is enabled. Required fields are marked in the form. Without information necessary to handle your request, we may be unable to answer; alternative contact methods remain available.
Email service providers and recipients
Emails to info@inndata.de are processed using Microsoft 365 with Germany as the data region selected by innData. The service is obtained directly from Microsoft; the provider for customers in the European Economic Area is Microsoft Ireland Operations Limited. Access within innData is restricted to people involved in the relevant matter or technical operation. Hosting and email providers supply the necessary infrastructure services; administration by innData does not exclude service-related processing by these providers. Further recipients may arise from statutory duties or the performance of a contract. Data is not shared for third-party advertising purposes. Microsoft information: https://www.microsoft.com/de-de/privacy/privacystatement . A data processing agreement pursuant to Article 28 GDPR is in place with Microsoft.
Transfers to third countries
Service providers may require processing outside the European Economic Area. Such transfers may only take place subject to Articles 44 et seq. GDPR, for example under an applicable adequacy decision or appropriate safeguards such as EU standard contractual clauses and supplementary protective measures where necessary. You may request information about safeguards applicable to a specific transfer using our data protection contact.
Enquiry retention
Completed enquiries are deleted once the process decision has been concluded, unless statutory retention duties require continued storage. Where a statutory duty applies, the relevant documents are retained only for the applicable period and then deleted. The decision takes account of the nature and content of the documents; not every enquiry is subject to a statutory retention duty. innData reviews and deletes records; the website does not apply an automatic blanket deletion period. This rule also covers local enquiry copies and subsequent email correspondence.
Backups
Backups are created daily. Backup versions are overwritten on a weekly cycle. Data deleted from the live system may therefore remain in backups until the scheduled overwrite. Backups serve to restore data following a loss and are accessible only to the responsible people within innData. The legal basis is Article 6(1)(f) GDPR; our legitimate interest is maintaining system availability and recoverability.
Protected administration area
The administration area is intended for authorised staff. We process account details, password hashes, session data and security-related events there. Passwords are not stored in plain text. A technically necessary session cookie enables login (section 25(2), point 2 TDDDG). Sessions expire after eight hours at the latest; authenticated sessions also expire after 30 minutes of inactivity, and anonymous preparation sessions remain valid for 15 minutes. You can delete the cookie in your browser. The legal basis is Article 6(1)(f) GDPR and our interest in access-controlled administration.
Administration security data
To protect against login attempts, checking values derived from the IP address and login name are processed with timestamps. The checking window is 15 minutes; expired attempts are cleared on subsequent logins. Security and administration actions are logged with account, action and time; entries older than 90 days are cleared on subsequent logged actions. Account data remains necessary for the duration of authorisation.
Images in the administration area
Authorised staff can upload images with descriptions and assign them for publication. Originals are stored in the protected area and may contain capture or location metadata. Optimised image files generated for the website are exported without embedded EXIF, GPS and XMP metadata. Published images and descriptions are publicly accessible; personal rights and customer references must therefore be checked before publication. Originals and archived versions remain until specifically deleted where needed for management or restoration. Replacing the visible image assignment does not automatically delete these files.
Your rights
Subject to the applicable statutory conditions, you may request access, rectification, erasure, restriction of processing and data portability (Articles 15 to 20 GDPR). You may withdraw consent at any time with effect for the future; this does not affect the lawfulness of earlier processing.
Objection and complaints
For processing under Article 6(1)(f) GDPR, you have a right to object on grounds relating to your particular situation under Article 21 GDPR. You may object to direct marketing at any time. Under Article 77 GDPR, you may also complain to a supervisory authority, particularly in your place of residence, workplace or the place of the alleged infringement. In Bavaria, the Bavarian State Office for Data Protection Supervision is generally responsible for private businesses: https://www.lda.bayern.de/de/beschwerde.html .
Automated decisions and version
This website does not carry out automated decisions with legal or similarly significant effects or profiling. This notice was updated on 3 November 2026. We update it when operations or functions change.