1. Controller
Controller for the processing of personal data is:
El CaminoSole proprietor: Miguel Leal SpohrSörgenlocher Weg 1355268 Nieder-OlmGermanyThis notice applies to digital-913.de and digital-913.com, to the personal website previews at demo.digital-913.de, to the business contact details we collect for approaching a company, as well as to the processing of invoices and payments.
2. Provision and security of the website
This website and the previews are hosted by Vercel Inc. When a page is accessed, technically necessary connection data may be processed. This includes in particular the IP address, date and time, the accessed URL, referrer, browser and device information, and server and security logs.
The processing serves the reliable provision of the pages, technical security and the prevention of misuse. The legal basis is Article 6(1)(f) GDPR. Our legitimate interests lie in the secure, stable and efficient operation of our services.
3. Enquiries and contact form
If you contact us by form or email, we process your details in order to answer your enquiry and, where desired, to prepare or carry out a contract. We receive the data directly from you.
The legal basis is Article 6(1)(b) GDPR insofar as pre-contractual measures or a contract are concerned. In all other cases, the legal basis is Article 6(1)(f) GDPR on the basis of our legitimate interest in answering business enquiries. We process data for misuse prevention on the same legal basis.
We require details marked as mandatory fields in order to understand and answer your enquiry. Provision is neither legally nor contractually required; however, without these details we may not be able to respond. Providing the company is voluntary.
- name and, if provided, company
- email address
- selected area of interest, language and message content
- IP address and time of sending for short-term misuse prevention
4. Website previews (demos)
For a company that we approach, we create a personal website preview at demo.digital-913.de. These pages are not public: they can only be accessed via an individual link with token, are blocked for search engines and expire automatically after 21 days.
When a preview is accessed, we process the connection data described in section 2 and the event that the preview was opened and when it was opened. We use this exclusively to decide whether to follow up once. The legal basis is Article 6(1)(f) GDPR; our legitimate interest is the evaluation of our own offering. We do not use a tracking pixel or open tracking in emails.
If you submit a form on a preview – request for a call-back, request for changes or express consent to further emails – we process your details to respond and for contract initiation (Article 6(1)(b) GDPR) or on the basis of your consent (Article 6(1)(a) GDPR), which you may withdraw at any time.
All texts and images on the previews come from us; we do not adopt content from the company to which a preview relates. The images are served via our own preview domain.
- slug, access token and expiry date of the preview
- event and time of opening
- form entries such as name, email address, telephone number and message
- whether and when consent to further emails was given
5. Business contact details of companies we approach
In order to present our offering, we collect business contact details of companies in and around Bingen am Rhein. These data do not come from you, but from publicly available sources: the company website including its imprint, the public Google business profile via the Google Places API, public business directories and the open mapping service OpenStreetMap. For sole traders, business contact details are also personal data; in that case, this section is the information under Article 14 GDPR.
The sole purpose is a one-off, personally worded approach with a website preview tailored to the company. The legal basis is Article 6(1)(f) GDPR; our legitimate interest is direct marketing (Recital 47 GDPR).
We contact a company no more than once, follow up no more than once and write exclusively to the business address published in the imprint.
You may object to this processing at any time and without giving reasons (Article 21(2) GDPR) – informally by email or by replying to our message with “Nein”. After that, you will no longer be contacted on any channel. In order for the objection to remain effective permanently, we store the company name and email address in a blocklist; this entry is exempt from deletion because it is precisely what enforces your objection.
The recipient of this data is our CRM provider Attio (see section 7). If a company does not reply and no contact is established, we delete the record no later than twelve months after collection.
- company name, address and sector
- business email address, telephone number and website
- the name of the owner, insofar as it is stated in the company’s imprint
- source and date of collection
- the result of our automated review of the publicly accessible website
- any objection and the resulting block notice
6. Invoices and payments
Our customers settle invoices via PayPal. The payment itself is processed by PayPal (Europe) S.à r.l. et Cie, S.C.A., Luxembourg, as an independently responsible controller in accordance with its own privacy policy. We receive from PayPal only the information we need to allocate and record the payment.
We process invoice and payment data for the performance of the contract (Article 6(1)(b) GDPR) and for compliance with our tax and commercial law obligations (Article 6(1)(c) GDPR). We retain invoices for ten years in accordance with § 147 AO and § 257 HGB.
For a website order, we also process the billing address, legal provider details, payment status, change requests and domain registrant details. This serves contract performance (Art. 6(1)(b) GDPR) and statutory invoicing obligations (Art. 6(1)(c) GDPR). For authorised new .de registrations, domain registrant details are sent to INWX and the registry DENIC; website content is stored in a private GitHub repository.
7. Service providers and international transfers
We use the following service providers. Each receives only the data it needs to provide its service; where a provider processes data on our behalf, this is done on the basis of a data processing agreement pursuant to Article 28 GDPR:
- Vercel Inc. — Hosting this website and the previews, server and security logs (USA)
- Resend (Plus Five Five, Inc.) — Sending and receiving our emails (USA)
- Neon (Databricks, Inc.) — Database for preview content, access tokens, opening events and form entries (EU region Frankfurt)
- Attio Ltd. — CRM: lead, contact and sales data (USA)
- GitHub, Inc. — Private customer repositories containing website content and files for deployment and handover.
- PayPal (Europe) S.à r.l. et Cie, S.C.A. — Payment processing, independently responsible (EU)
Vercel, Resend and Attio are based outside the European Economic Area. Personal data may therefore be processed outside the EEA. Transfers are safeguarded – where applicable in each case – by an adequacy decision such as the EU-US Data Privacy Framework and/or the European Commission’s Standard Contractual Clauses. Further information can be found in the providers’ privacy and data processing terms.
We use the Google Places API solely to retrieve publicly accessible company profiles; data from visitors to our pages are not transmitted to Google in the process. We do not integrate Google Maps, Google Fonts, social media plugins or comparable third-party content on this website or on the previews.
8. Storage period
Entries for misuse prevention on this website expire after about ten minutes. Technical logs are stored in accordance with the hosting provider’s applicable retention periods and only for as long as is necessary for operation and security.
As a general rule, we delete enquiry correspondence no later than twelve months after the last substantive contact, provided no business relationship is established. If an enquiry leads to a contract, we store relevant correspondence for the duration of the business relationship and the applicable statutory retention or limitation periods.
We delete lead records without a response no later than twelve months after collection. Previews expire automatically after 21 days and are then deleted. Entries in the blocklist remain stored permanently so that an objection remains effective permanently. We retain invoices and the associated payment data for ten years.
9. Cookies and analytics
This website currently uses no analytics tools, advertising trackers, third-party marketing pixels or non-essential cookies or browser storage. For the current configuration, therefore, no consent banner is required. Our emails also contain no tracking pixel.
If you select a language, we store the strictly necessary functional cookie digital913_locale for up to one year. This ensures that your explicit selection takes precedence over your browser language setting. The cookie contains solely the selected language code (en, de or es), is not used for tracking and is necessary to provide the language version you requested. The legal basis for accessing your device is Section 25(2)(2) of the TDDDG and, insofar as the GDPR applies, Article 6(1)(f) GDPR.
10. Your rights
Under the statutory conditions, you have the following rights:
- access to your personal data (Article 15 GDPR)
- rectification of inaccurate data (Article 16 GDPR)
- erasure (Article 17 GDPR)
- restriction of processing (Article 18 GDPR)
- data portability, where applicable (Article 20 GDPR)
- objection to processing based on legitimate interests (Article 21 GDPR)
- withdrawal of consent at any time, insofar as processing is based on consent; the lawfulness of processing carried out before withdrawal remains unaffected
Insofar as we process your data for direct marketing, you may object at any time and without giving reasons; we will then cease processing altogether (Article 21(2) GDPR). An informal email to the above address is sufficient, as is a reply with “Nein” to one of our messages.
11. Right to lodge a complaint
You may lodge a complaint with a data protection supervisory authority. For our location, in particular the following authority is responsible:
Der Landesbeauftragte für den Datenschutz und die Informationsfreiheit Rheinland-PfalzHintere Bleiche 3455116 MainzDeutschland12. Automated decision-making
There is no automated decision-making or profiling within the meaning of Article 22 GDPR. Our automated website review assesses publicly accessible pages of a company, not a person; a human decides on every approach and also writes it.
OpenAI is used exclusively as an editorial tool for translating static website texts. Visitor and enquiry data are not transmitted from this website to OpenAI.