Privacy Policy

This privacy policy informs you about the nature, scope and purpose of the processing of personal data when you use this website and when you contact me by email.

Last updated:

1. Controller

Andre Kapp
Eynattener Straße 2
52064 Aachen
Germany

Email: hallo@tabiji.de

2. Data protection officer / privacy contact

No data protection officer (DPO) has been appointed for this service, as the legal requirements for a mandatory appointment under Art. 37 GDPR are not met.

For all privacy-related enquiries, for exercising your rights as a data subject and for any other data protection matters, the controller is available to you as the privacy contact:

Privacy contact:
Andre Kapp (Tabiji)
Email: hallo@tabiji.de

3. General information on data processing

Personal data is any information relating to an identified or identifiable natural person. Personal data is only processed insofar as this is permitted by law, necessary to provide this website, or you have given your consent.

In particular, I process personal data in order to

• provide this website technically,
• ensure the stability and security of the website,
• respond to enquiries and
• communicate with you by email.

4. Accessing the website / hosting via IONOS Deploy Now

This website is hosted via IONOS Deploy Now. When you access the website, technically necessary connection data is processed so that the page can be delivered and the stability and security of the service can be ensured.

In particular, the following data may be processed:

• IP address,
• date and time of access,
• requested file or page,
• referrer URL,
• information about the browser and operating system used,
• status codes and similar technical connection data.

Processing is based on Art. 6(1)(f) GDPR. My legitimate interest lies in providing the website securely, stably and without technical errors.

The recipient of this data is my hosting provider:

IONOS SE
Elgendorfer Str. 57
56410 Montabaur
Germany

Further information on data processing by IONOS can be found at:
https://www.ionos.de/terms-gtc/datenschutzerklaerung/

Personal data is only processed for as long as necessary for the technical provision of the website, system security and error analysis. Where log or connection data is processed by IONOS as part of the hosting, the storage period and deletion are governed by IONOS's data protection and retention policies.

5. Transfers to third countries

This website is hosted by IONOS SE, based in Germany. No connection data is transferred to third countries as part of the hosting.

When you use the contact form, form data is transmitted to the Web3Forms service (Swiftlabs Digital, web3forms.com), whose servers are operated in the USA. A transfer to the USA therefore cannot be ruled out. Where necessary, I base this transfer on Art. 6(1)(f) GDPR (legitimate interest in handling enquiries properly) and on standard contractual clauses pursuant to Art. 46 GDPR.

The contact form and the review form on this website are protected by Cloudflare Turnstile (Cloudflare, Inc., USA). In the process, technical connection data is transmitted to Cloudflare in the USA. This transfer is based on standard contractual clauses pursuant to Art. 46(2)(c) GDPR and, where applicable, on the EU-US Data Privacy Framework (Art. 45 GDPR).

To store customer reviews, I use Supabase (Supabase, Inc.). The database infrastructure is operated in an EU data centre in Frankfurt am Main. Access to the data by Supabase, Inc. from outside the EU cannot be completely ruled out; any such transfer is based on standard contractual clauses pursuant to Art. 46(2)(c) GDPR.

To process bookings and customer enquiries, I use Microsoft 365 (Bookings, Power Automate, Lists, Forms). The responsible EU entity is Microsoft Ireland Operations Limited. A transfer to the USA by Microsoft cannot be ruled out. This transfer is based on standard contractual clauses pursuant to Art. 46(2)(c) GDPR and on the EU-US Data Privacy Framework (Art. 45 GDPR), insofar as Microsoft is certified under it.

6. Contact by email

If you contact me by email, I process the data you provide in order to handle your enquiry and communicate with you.

In particular, the following data may be processed:

• name,
• email address,
• content of your message,
• any attachments sent,
• and any other information you provide voluntarily.

Processing is carried out

• on the basis of Art. 6(1)(b) GDPR, insofar as your enquiry is aimed at concluding or performing a contract or concerns pre-contractual measures,
• otherwise on the basis of Art. 6(1)(f) GDPR, as I have a legitimate interest in handling enquiries properly and communicating with prospective and existing customers.

The data is deleted once your enquiry has been fully dealt with and no statutory retention obligations or other legitimate reasons prevent deletion. For general enquiries that do not lead to a contract, the storage period is generally up to 3 years after the end of the correspondence. For enquiries that lead to a contract, commercial and tax retention obligations of up to 10 years may apply (Section 257 HGB, Section 147 AO).

Providing your data is neither a legal nor a contractual requirement. However, without the necessary information I may not be able to handle your enquiry, or not fully.

7. Recipients of personal data

As a rule, I only pass on personal data to third parties if

• this is necessary to perform a contract or handle your enquiry,
• there is a legal obligation to do so,
• you have given your consent, or
• the disclosure is permitted on the basis of legitimate interests under Art. 6(1)(f) GDPR.

Recipients may in particular be technical service providers used to operate and provide this website or to handle business processes, specifically:

• IONOS SE (hosting),
• Web3Forms / Swiftlabs Digital (contact form transmission),
• Cloudflare, Inc. (spam/bot protection via Turnstile),
• Supabase, Inc. (review database),
• Microsoft Ireland Operations Limited (bookings, process automation, data management, forms).

8. Contact form (Web3Forms)

If you use the contact form on this website, the data you enter (in particular your name, email address and details of your planned trip) is processed in order to handle your enquiry.

For the technical transmission of the form data, I use the service Web3Forms provided by Swiftlabs Digital (web3forms.com). When you submit the form, the data you entered is transmitted to Web3Forms servers and forwarded from there to me as an email. Web3Forms stores the transmitted data temporarily for delivery.

Further information on data processing by Web3Forms can be found at:
https://web3forms.com/privacy

Processing is carried out

• on the basis of Art. 6(1)(b) GDPR, insofar as your enquiry is aimed at concluding or performing a contract or concerns pre-contractual measures,
• otherwise on the basis of Art. 6(1)(f) GDPR, as I have a legitimate interest in handling enquiries properly.

The data is deleted once your enquiry has been fully dealt with and no statutory retention obligations prevent deletion.

9. Cloudflare Turnstile (spam and bot protection)

In the contact form and the review form on this website, I use the service Cloudflare Turnstile provided by Cloudflare, Inc. Turnstile protects the forms against automated requests (bots and spam) and replaces traditional CAPTCHA solutions.

When the form loads, your browser connects to Cloudflare servers. In particular, the following data may be processed:

• IP address,
• browser and device properties (user agent, screen resolution, etc.),
• interaction data (mouse movements, timing),
• technical connection data.

To carry out the check, Cloudflare may set or read cookies or similar technologies (e.g. local storage) on your device.

Processing is based on Art. 6(1)(f) GDPR. My legitimate interest lies in the security of the website and protection against abusive form submissions.

The recipient of this data is:
Cloudflare, Inc.
101 Townsend St
San Francisco, CA 94107
USA

The data transfer to the USA is based on standard contractual clauses pursuant to Art. 46(2)(c) GDPR and on the EU-US Data Privacy Framework (Art. 45 GDPR), insofar as Cloudflare is certified under it.

Further information on data processing by Cloudflare can be found at:
https://www.cloudflare.com/privacypolicy/

10. Supabase (review database)

To display and store customer reviews, I use the service Supabase provided by Supabase, Inc. The database infrastructure is operated in an EU data centre (Frankfurt am Main, Germany).

When the reviews section loads, your browser connects to the Supabase servers. In the process, your IP address may be transmitted to Supabase. If you submit a review, the data you enter (name/pseudonym, review text, rating) is also transmitted to Supabase and stored in the database.

The processing of technical connection data (IP address) when retrieving content is based on Art. 6(1)(f) GDPR (legitimate interest in providing the website). The processing of review data is based on Art. 6(1)(a) GDPR (consent given by actively submitting the review) and Art. 6(1)(f) GDPR.

The recipient of this data is:
Supabase, Inc.
970 Toa Payoh North
#07-04, Singapore 318992
(infrastructure in the EU data centre in Frankfurt am Main, Germany)

Supabase, Inc. is a US company. Insofar as personal data is accessed outside the EU data centre, I base this transfer on standard contractual clauses pursuant to Art. 46(2)(c) GDPR.

Further information on data processing by Supabase can be found at:
https://supabase.com/privacy

11. Microsoft 365 services (Bookings, Power Automate, Lists, Forms)

To organise my services and handle customer enquiries, I use various services from Microsoft 365. These are used in the background of my business processes and are not embedded directly in this website, but they do process personal data in connection with initiating and carrying out bookings and consulting services:

• Microsoft Bookings: Appointment scheduling for consultations. Processes name, email address, phone number if provided, preferred appointment and notes.
• Microsoft Power Automate: Workflow automation, e.g. forwarding and processing enquiry and booking data.
• Microsoft Lists: Management and tracking of customer contacts and bookings.
• Microsoft Forms: Collecting information on travel wishes and customer requirements as part of the consultation.

In particular, the following data may be processed: name, email address, phone number, details of the planned trip and any other information you provide voluntarily.

Processing is carried out

• on the basis of Art. 6(1)(b) GDPR, insofar as the data processing is necessary to initiate or perform a contract (booking a consulting service),
• otherwise on the basis of Art. 6(1)(f) GDPR, as I have a legitimate interest in handling customer enquiries efficiently and properly.

The recipient of this data is:
Microsoft Ireland Operations Limited
One Microsoft Place, South County Business Park
Leopardstown, Dublin 18
Ireland

Microsoft Ireland Operations Limited is responsible for Microsoft 365 services in the EU. A transfer of data to the USA by Microsoft cannot be completely ruled out. This transfer is based on standard contractual clauses pursuant to Art. 46(2)(c) GDPR and on the EU-US Data Privacy Framework (Art. 45 GDPR), insofar as Microsoft is certified under it.

Further information on data processing by Microsoft can be found at:
https://privacy.microsoft.com/de-de/privacystatement

12. Cookies, local storage and similar technologies

I do not use any cookies myself for analytics, tracking or marketing purposes.

As part of the spam and bot protection provided by Cloudflare Turnstile (see section 9), Cloudflare may set or read cookies or similar storage technologies (e.g. local storage) on your device. This serves exclusively to protect against automated abuse and is technically necessary for the security of the form.

Beyond that, information is only stored on or read from your device if this is technically necessary or if there is a legal basis or valid consent.

13. External links

This website may contain links to external websites or services. If you click such a link, you leave this website and the privacy policy of the respective provider applies.

I accept no responsibility for the content and data processing on linked external sites.

14. Data security

I take appropriate technical and organisational measures to protect personal data against loss, misuse, unauthorised access, unauthorised disclosure or unauthorised alteration.

This website should only be accessed in encrypted form via HTTPS.

15. Storage period

I only store personal data for as long as necessary for the respective purposes or as required by statutory retention obligations. The following overview shows the specific storage periods for each processing context:

As soon as the respective purpose no longer applies and there are no legal or legitimate grounds for further storage, the data concerned is deleted.

16. Your rights under the GDPR

Subject to the statutory requirements, you have in particular the following rights:

• the right of access to the personal data I process (Art. 15 GDPR),
• the right to have inaccurate data corrected or incomplete data completed (Art. 16 GDPR),
• the right to erasure of your personal data (Art. 17 GDPR),
• the right to restriction of processing (Art. 18 GDPR),
• the right to data portability (Art. 20 GDPR),
• the right to object to the processing of personal data (Art. 21 GDPR),
• the right to withdraw consent with effect for the future, where processing is based on Art. 6(1)(a) GDPR.

The right to data portability only applies insofar as the processing is based on consent or on the performance of a contract and is carried out using automated means. This is generally not the case for the technically necessary provision of this website.

To exercise your rights, please contact the privacy contact in writing or by email:
hallo@tabiji.de

17. Right to object under Art. 21 GDPR

Where I process personal data on the basis of Art. 6(1)(f) GDPR, you have the right to object to this processing at any time on grounds relating to your particular situation.

If you object, I will no longer process the personal data concerned unless I can demonstrate compelling legitimate grounds for the processing that override your interests, rights and freedoms, or the processing serves the establishment, exercise or defence of legal claims.

The processing of data required for the technical provision of the website generally cannot be avoided while the website is being used.

18. Right to lodge a complaint with a supervisory authority

You have the right to lodge a complaint with a data protection supervisory authority about the processing of your personal data.

In particular, the supervisory authority of your habitual residence, your place of work or the place of the alleged infringement is responsible.

For North Rhine-Westphalia, for example, this is:

Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen (State Commissioner for Data Protection and Freedom of Information of North Rhine-Westphalia)
Kavalleriestraße 2–4
40213 Düsseldorf
Phone: +49 211 38424-0
Email: poststelle@ldi.nrw.de
Website: https://www.ldi.nrw.de/

19. No automated decision-making

No automated decision-making, including profiling within the meaning of Art. 22 GDPR, takes place via this website.

20. Changes to this privacy policy

I reserve the right to amend this privacy policy if legal requirements, the data processing or the services used change.

The version published on this website applies in each case.