With the following privacy policy, I would like to inform you about the types of your personal data (hereinafter also referred to as “data”) that I process, for what purposes and to what extent. The privacy policy applies to all processing of personal data carried out by us, both in the context of providing our services and especially on our websites, in mobile applications and within external online presences, such as our social media profiles (hereinafter collectively referred to as “online offering”).

Status: April 2, 2026

 

Controller:

Lina Teufel

Email address: mail@linateufel.de

 

 

Overview of processing

The following overview summarizes the types of processed data and the purposes of their processing and refers to the data subjects concerned.

 

Types of processed data

Inventory data.
Employee data.
Contact data.
Content data.
Usage data.
Meta, communication and procedural data.

 

Categories of data subjects

Employees.
Communication partners.
Users.
Third parties.
Whistleblowers.

Purposes of processing

 

Communication.
Direct marketing.
Feedback.
Whistleblower protection.
Public relations.

 

 

Relevant legal bases

Relevant legal bases under the GDPR: In the following you will find an overview of the legal bases of the GDPR on which we process personal data. Please note that in addition to the provisions of the GDPR, national data protection regulations may apply in your or our country of residence or establishment. Should more specific legal bases be relevant in individual cases, we will inform you of these in the privacy policy.

 

Consent (Art. 6 para. 1 sentence 1 lit. a GDPR) – The data subject has given consent to the processing of personal data concerning them for one or more specific purposes.

 

Legal obligation (Art. 6 para. 1 sentence 1 lit. c GDPR) – Processing is necessary for compliance with a legal obligation to which the controller is subject.

 

Legitimate interests (Art. 6 para. 1 sentence 1 lit. f GDPR) – Processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, provided that the interests, fundamental rights and freedoms of the data subject do not override those interests.

 

National data protection regulations in Germany: In addition to the data protection provisions of the GDPR, national regulations on data protection apply in Germany. This includes in particular the Federal Data Protection Act (Bundesdatenschutzgesetz – BDSG). The BDSG contains special provisions in particular on the right of access, the right to erasure, the right to object, the processing of special categories of personal data, processing for other purposes and transmission as well as automated decision-making in individual cases including profiling. Furthermore, the data protection laws of the individual German federal states may apply.

 

 

Security measures

We take appropriate technical and organizational measures in accordance with legal requirements, taking into account the state of the art, implementation costs and the nature, scope, circumstances and purposes of processing as well as the varying likelihood and severity of the risk to the rights and freedoms of natural persons in order to ensure a level of protection appropriate to the risk.

 

These measures include in particular safeguarding the confidentiality, integrity and availability of data by controlling physical and electronic access to the data as well as access, input, disclosure, securing availability and separation of the data. Furthermore, we have established procedures to ensure the exercise of data subject rights, deletion of data and responses to data threats. In addition, we consider the protection of personal data already during the development or selection of hardware, software and procedures in accordance with the principle of data protection by design and by default.

 

Securing online connections through TLS/SSL encryption technology (HTTPS): To protect the data of users transmitted via our online services from unauthorized access, we rely on TLS/SSL encryption technology. Secure Sockets Layer (SSL) and Transport Layer Security (TLS) are the cornerstones of secure data transmission on the Internet. These technologies encrypt the information transmitted between the website or app and the user’s browser (or between two servers), thereby protecting the data from unauthorized access. TLS, as the more advanced and secure version of SSL, ensures that all data transmissions meet the highest security standards. When a website is secured by an SSL/TLS certificate, this is indicated by the display of HTTPS in the URL. This serves as an indicator to users that their data is transmitted securely and encrypted.

 

 

Rights of data subjects

Rights of data subjects under the GDPR: As a data subject, you have various rights under the GDPR, which arise in particular from Art. 15 to 21 GDPR:

 

Right to object: You have the right, on grounds relating to your particular situation, to object at any time to the processing of personal data concerning you which is based on Art. 6 para. 1 lit. e or f GDPR; this also applies to profiling based on these provisions. If personal data concerning you is processed for direct marketing purposes, you have the right to object at any time to the processing of personal data concerning you for such marketing; this also applies to profiling insofar as it is related to such direct marketing.

 

Right to withdraw consent: You have the right to withdraw consent at any time.

 

Right of access: You have the right to request confirmation as to whether data concerning you is being processed and to request access to this data as well as further information and a copy of the data in accordance with legal requirements.

 

Right to rectification: You have the right to request the completion of data concerning you or the correction of inaccurate data concerning you in accordance with legal requirements.

 

Right to erasure and restriction of processing: In accordance with legal requirements, you have the right to request that data concerning you be deleted without undue delay or, alternatively, to request restriction of the processing of the data.

 

Right to data portability: You have the right to receive data concerning you which you have provided to us in a structured, commonly used and machine-readable format or to request its transmission to another controller in accordance with legal requirements.

 

Complaint to supervisory authority: Without prejudice to any other administrative or judicial remedy, you have the right to lodge a complaint with a supervisory authority, in particular in the Member State of your habitual residence, place of work or place of the alleged infringement if you consider that the processing of personal data concerning you infringes the GDPR.

 

 

Newsletter and electronic notifications

I send newsletters, emails and other electronic notifications (hereinafter “newsletter”) exclusively with the consent of the recipients or on the basis of a legal permission. If the content of the newsletter is described during registration, this content is decisive for the user’s consent. Registration for our newsletter normally requires only your email address. However, in order to provide you with a personalized service, we may ask for your name for personal addressing in the newsletter or for further information if this is necessary for the purpose of the newsletter.

 

Deletion and restriction of processing: We may store unsubscribed email addresses for up to three years based on our legitimate interests before deleting them in order to be able to prove previously given consent. The processing of this data is limited to the purpose of a potential defense against claims. An individual deletion request is possible at any time, provided that the former existence of consent is confirmed at the same time. In the case of obligations to permanently observe objections, we reserve the right to store the email address solely for this purpose in a suppression list (“blocklist”).

 

The logging of the registration procedure is carried out on the basis of our legitimate interests for the purpose of proving its proper execution. If we commission a service provider to send emails, this is done on the basis of our legitimate interests in an efficient and secure mailing system.

 

 

Information about us, our services, promotions and offers.

Types of data processed: Inventory data (e.g. full name, residential address, contact information, customer number, etc.); contact data (e.g. postal and email addresses or telephone numbers); meta, communication and procedural data (e.g. IP addresses, time data, identification numbers, persons involved). Usage data (e.g. page views and duration of stay, click paths, intensity and frequency of use, device types and operating systems used, interactions with content and functions).

 

Data subjects: Communication partners.

 

Purposes of processing and legitimate interests: Direct marketing (e.g. by email or postal mail).

 

Legal basis: Consent (Art. 6 para. 1 sentence 1 lit. a GDPR).

 

Right to object (opt-out): You can unsubscribe from our newsletter at any time, i.e. withdraw your consent or object to further receipt. A link to unsubscribe can be found at the end of each newsletter or you can otherwise use one of the contact options above, preferably email.

 

 

Further information on processing procedures, processes and services:

Measurement of open and click rates: The newsletters contain a so-called “web beacon”, i.e. a pixel-sized file that is retrieved from our server or the server of a mailing service provider when the newsletter is opened. As part of this retrieval, technical information such as information about your browser and system as well as your IP address and the time of retrieval are collected. This information is used for the technical improvement of our newsletter based on technical data or target groups and their reading behavior based on their retrieval locations (this text section must be unlocked with a premium license.

 

Legal basis: Consent (Art. 6 para. 1 sentence 1 lit. a GDPR).

 

 

Presence in social networks (social media)

We maintain online presences within social networks and process user data in this context in order to communicate with users active there or to offer information about us.

 

We point out that user data may be processed outside the European Union. This may result in risks for users because, for example, the enforcement of user rights could be made more difficult.

 

Furthermore, user data within social networks is generally processed for market research and advertising purposes. For example, usage profiles can be created based on usage behavior and resulting interests of users. These usage profiles may in turn be used to place advertisements within and outside the networks that presumably correspond to the interests of users. Therefore, cookies are generally stored on users’ computers in which usage behavior and interests are stored. In addition, data may also be stored in usage profiles independently of the devices used by users (especially if they are members of the respective platforms and logged in).

 

For a detailed presentation of the respective forms of processing and the possibilities to object (opt-out), we refer to the privacy policies and information provided by the operators of the respective networks.

 

In the case of requests for information and the assertion of data subject rights, we also point out that these can be most effectively asserted with the providers. Only they have access to user data and can directly take appropriate measures and provide information. Should you nevertheless require assistance, you can contact us.

 

Types of data processed: Contact data (e.g. postal and email addresses or telephone numbers); content data (e.g. textual or visual messages and posts and information relating to them, such as authorship or time of creation). Usage data (e.g. page views and duration of stay, click paths, intensity and frequency of use, device types and operating systems used, interactions with content and functions).

 

Data subjects: Users (e.g. website visitors, users of online services).

 

Purposes of processing and legitimate interests: Communication; feedback (e.g. collecting feedback via online form). Public relations.

 

Storage and deletion: Deletion in accordance with the information in the section “General information on data storage and deletion”.

 

Legal basis: Legitimate interests (Art. 6 para. 1 sentence 1 lit. f GDPR).

 

 

Further information on processing procedures, processes and services:

Instagram: Social network, enables the sharing of photos and videos, commenting and favoriting of posts, messaging, subscribing to profiles and pages; Service provider: Meta Platforms Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland; Legal basis: Legitimate interests (Art. 6 para. 1 sentence 1 lit. f GDPR); Website: https://www.instagram.com; Privacy policy: https://privacycenter.instagram.com/policy/. Basis for third country transfers: Data Privacy Framework (DPF).

 

 

Changes and updates

We ask you to regularly inform yourself about the content of our privacy policy. We adapt the privacy policy as soon as changes to the data processing we carry out make this necessary. We will inform you as soon as the changes require an act of cooperation on your part (e.g. consent) or other individual notification.

If we provide addresses and contact information of companies and organizations in this privacy policy, please note that addresses may change over time and ask you to check the information before contacting us.

 

Definitions

In this section you will find an overview of the terminology used in this privacy policy. Where the terms are defined by law, their legal definitions apply. The following explanations are primarily intended to aid understanding.

 

Employees: Employees are persons who are in an employment relationship, whether as staff, workers or in similar positions. An employment relationship is a legal relationship between an employer and an employee established by an employment contract or agreement. It includes the employer’s obligation to pay remuneration while the employee performs work. The employment relationship includes various phases, including establishment, performance and termination. Employee data includes all information relating to these persons in the context of their employment. This includes personal identification data, identification numbers, salary and bank data, working hours, vacation entitlements, health data and performance assessments.

 

Inventory data: Inventory data includes essential information necessary for the identification and administration of contractual partners, user accounts, profiles and similar assignments. This data may include personal and demographic information such as names, contact information, dates of birth and specific identifiers (user IDs). Inventory data forms the basis for any formal interaction between persons and services, institutions or systems by enabling clear assignment and communication.

 

Content data: Content data includes information generated in the course of creating, editing and publishing content of all kinds. This category may include texts, images, videos, audio files and other multimedia content as well as metadata such as tags, descriptions, author information and publication dates.

 

Contact data: Contact data is essential information that enables communication with persons or organizations. It includes telephone numbers, postal addresses, email addresses and social media identifiers.

Meta, communication and procedural data: Meta data describes context, origin and structure of other data. Communication data records exchanges of information between users (emails, call logs, social network messages). Procedural data describes processes and workflows including logs and audit trails.

 

Usage data: Usage data records how users interact with digital services, including duration, frequency, click paths, device information and IP addresses. It is used to analyze behavior, optimize user experience and improve services.

 

Personal data: “Personal data” means any information relating to an identified or identifiable natural person.

 

Controller: The natural or legal person who determines the purposes and means of processing personal data.

 

Processing: Any operation performed on personal data, including collection, storage, use, disclosure or deletion.