Privacy Policy

Semesterkur UG (haftungsbeschränkt) Ernst-Weyden-Straße 15 51105 Köln Germany

Represented by: Andrés Mora E-mail: kontakt@contentoren.de Local Court of Cologne, HRB 125723 VAT ID: DE461168928

Contentoren is a brand of Semesterkur UG (haftungsbeschränkt). When this policy uses "we" or "Contentoren," it means the company named above.

When our website is accessed, technically required connection data is processed so that the pages can be delivered, secured, and operated reliably. This includes in particular:

• IP address of the requesting system,
• date and time of access,
• requested address and amount of data transferred,
• response status code,
• referrer URL, where transmitted,
• browser, device, and operating system information (user agent).

This data is technically unavoidable for operating a website. It is processed to deliver content, ensure security (e.g. defend against attacks and misuse), and analyze errors.

Legal basis: Art. 6(1)(f) GDPR. Our legitimate interest is the secure, high-performance, and disruption-free provision of the website.

Services used: For DNS, delivery via a Content Delivery Network (CDN), defense against attacks, and hosting of the website, we use Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107, USA. Cloudflare processes the connection data on our behalf on the basis of a data processing agreement. Data may be transferred to third countries, in particular the USA; details of the transfer mechanisms are provided in Section 11.

Retention period: Server and security logs are retained only for as long as required for operation, security, and error analysis, and are then deleted or aggregated.

For the statistical evaluation of visits to our website, we use Cloudflare Web Analytics (provider as described in Section 2).

Cloudflare Web Analytics operates without cookies and without fingerprinting. No cookies are set, no information is stored on or read from your device, and no cross-device identifiers are created. Only aggregated metrics are evaluated, for example:

• number of page views and pages viewed,
• referrer or source of origin,
• approximate country of origin,
• browser and device types used.

This means that we cannot identify individual visitors; no usage profiles are created.

Legal basis: Art. 6(1)(f) GDPR (legitimate interest in privacy-conscious reach measurement to improve our service). Since no information is stored on or read from your device, no consent under Section 25 TDDDG is required for this.

In addition, this website uses no analytics or marketing cookies and no other embedded third-party trackers such as Google Analytics, Meta Pixel, or comparable services.

When you use the website questionnaire, the website stores the information entered there locally in your browser so that you can resume the questionnaire later. The information is not automatically transmitted to us. When it is submitted, it is passed to your own e-mail program; the local storage is deleted. The storage is not used for profiling, tracking, or advertising.

Legal basis: Section 25(2) no. 2 TDDDG (strictly necessary for the use of the questionnaire you expressly requested) and Art. 6(1)(f) GDPR.

5.1 E-mail and Telephone

If you contact us by e-mail or telephone, we process the information you provide - typically your name, contact details, company, and the content of your inquiry - to handle the matter and for follow-up questions. Forms on our website open your e-mail program; transmission therefore takes place via your own e-mail service.

Legal basis: Art. 6(1)(b) GDPR insofar as the inquiry concerns a contract or pre-contractual measures; otherwise Art. 6(1)(f) GDPR (legitimate interest in handling incoming inquiries).

5.2 Appointment Booking via Cal.com

For booking initial consultations, we link to a scheduling calendar provided by Cal.com. We use the provider's European instance (cal.eu). The booking page is opened only after you click. When a booking is made, Cal.com processes the data you enter (e.g. name, e-mail address, requested appointment, optional message) as well as technical connection data and makes the booking data available to us.

Legal basis: Art. 6(1)(b) GDPR (performance of pre-contractual measures at your request) or Art. 6(1)(f) GDPR (efficient appointment coordination).

5.3 WhatsApp

On our website, we link to WhatsApp chats with our telephone numbers. The chat is opened only when you click the link. The provider is WhatsApp Ireland Limited, Merrion Road, Dublin 4, Ireland (Meta group of companies). If you use WhatsApp, the provider processes metadata and message content according to its own terms; we have no influence over this. We process the telephone number, displayed profile name, and message history to handle your inquiry.

Please do not send particularly sensitive information via WhatsApp. For confidential matters, please use e-mail or telephone.

Legal basis: Art. 6(1)(b) GDPR or Art. 6(1)(f) GDPR (provision of an easy-to-use contact channel requested by the customer).

5.4 Retention Period for Contacting Us

We delete contact details and correspondence as soon as the matter has been conclusively handled and there are no statutory retention obligations (in particular under the German Commercial Code (HGB) and the German Fiscal Code (AO)) or legitimate interests, such as legal defense, to the contrary.

If a collaboration comes about, we process the data required for the quote, contract, and implementation. This typically includes:

• company master data as well as the names, roles, and contact details of contact persons,
• information from onboarding questionnaires, briefings, and consultations,
• content provided by you (texts, images, logos, access credentials to your systems),
• contract, billing, and payment data,
• communication and project history.

Legal bases: Art. 6(1)(b) GDPR (contract or pre-contractual measures), Art. 6(1)(c) GDPR (statutory retention and accounting obligations), and Art. 6(1)(f) GDPR (documentation, security, and assertion of claims). If contact persons are not themselves contracting parties, processing their contact details is based on Art. 6(1)(f) GDPR (performance of the contractual relationship with the company).

Retention period: We retain contract and billing documents in accordance with statutory periods (generally six or ten years). We delete project work data when it is no longer required for service provision, warranty obligations, and documentation.

These services concern only customers with a corresponding agreement.

7.1 Hosting and Infrastructure

For operating customer projects, we may use infrastructure from the following providers depending on the project and its requirements: Hetzner Online GmbH (Germany), netcup GmbH (Germany), Leaseweb (the Netherlands/Germany), and Cloudflare, Inc. (USA). The providers used in the specific project are set out in the relevant quote or data processing agreement. Not all named providers are used for every project.

7.2 Domain Management

At the customer's request, we register and manage domains for customers. The customer always remains the domain holder; we act as the administrative contact with the registrar and registry. For registration, holder data (name, address, e-mail address, and, where applicable, telephone number) must be transmitted to the registrar and the responsible registry. This transmission is a prerequisite for domain registration and takes place according to the rules of the respective registry.

Legal basis: Art. 6(1)(b) GDPR and Art. 6(1)(c) GDPR insofar as registry requirements must be implemented.

7.3 Storage, Data Exchange, and Backups

Depending on the project, the following may be used for file exchange, project repositories, and backups: Google Drive (Google Ireland Limited, Ireland), Cloudflare R2 (Cloudflare, Inc.), and Backblaze B2 (Backblaze, Inc., USA). The technical and organizational safeguards specified in the relevant quote, project agreement, or data processing agreement apply to backups.

The frequency, retention period, and recovery objectives for backups are based on the relevant quote or project agreement; there is no blanket commitment applicable to all projects. For technical reasons, deleted data may remain in backups for the agreed backup retention period and is permanently removed when that period expires.

7.4 Optional Product Analytics with PostHog

PostHog is not used on contentoren.com. PostHog (PostHog, Inc., USA, with optional EU hosting by PostHog Ltd.) may be set up for customer projects if expressly commissioned and configured in the project. In this case, use takes place within the customer's area of responsibility on their website or application; the privacy policy applicable there and, where required, a consent solution are controlling.

We use AI tools to support concept development, text, image, and code creation, as well as automations.

The following applies as binding policy:

• Principle: Personal or confidential customer data is not entered into general, freely accessible AI services.
• Exception: Such data is processed only through selected providers on the basis of suitable business or API plans with contractual commitments not to train on customer data, with a data processing agreement, and with project-specific safeguards.
• Standard: Without such an agreement, only anonymized or non-personal inputs are used.

Depending on the project, providers considered in particular include OpenAI, Anthropic, Google (Gemini), xAI (Grok), and DeepSeek. Here too, not every provider receives data in every project. AI results are work products requiring review; we do not make automated decisions within the meaning of Art. 22 GDPR with legal effect for you.

Legal basis: Art. 6(1)(b) GDPR when used to provide services; otherwise Art. 6(1)(f) GDPR (efficient service production). If used on behalf of a customer, the legal basis is determined by that customer's specifications.

• For our own website, our communications, our contract administration, and our accounting, we are the controller within the meaning of Art. 4 no. 7 GDPR.
• When we operate or support our customers' systems (e.g. websites, forms, chatbots, automations, CRM integrations), we regularly process the data arising there as a processor under Art. 28 GDPR. In these cases, the customer remains the controller; the purposes, means, and deletion concepts are specified there, and we conclude a data processing agreement.

Data subjects whose data is processed in a customer system should contact the respective controller regarding their rights. We will promptly forward inquiries that reach us to that controller.

We disclose personal data only where this is necessary:

• to technical service providers that act as processors for us (hosting, CDN, storage, e-mail, appointment booking, project-dependent tools),
• to tax advisors, auditors, banks, and payment service providers as part of contract and invoice processing,
• to registrars and registries as part of domain management,
• to authorities and courts where we are legally obliged to do so or where this is required for legal enforcement.

There is no sale of personal data and no disclosure for third-party advertising purposes.

Individual service providers process data outside the European Economic Area, in particular in the USA. Such a transfer takes place only if the requirements of Art. 44 et seq. GDPR are met. Depending on the provider, we use as safeguards certification under the EU-US Data Privacy Framework on the basis of the European Commission adequacy decision or the European Commission's Standard Contractual Clauses, supplemented by additional technical and organizational measures such as encryption and access restrictions.

We review the transfer mechanism on a provider-by-provider basis and make no blanket adequacy promise for all services used. On request, we will inform you of the basis applicable to a specific service.

• Server and security logs: only for the duration required for operation, security, and error analysis.
• Reach measurement: aggregated only, without personal reference.
• Contact inquiries: until conclusively handled, then deletion subject to retention obligations.
• Website questionnaire: locally in the browser until submission or deletion in the browser.
• Contract and invoice data: according to statutory periods, generally six or ten years.
• Project and backup data: according to the retention agreed in the quote or contract.

Under the GDPR, you have the right to:

• access to the data processed about you (Art. 15 GDPR),
• rectification of inaccurate data (Art. 16 GDPR),
• erasure (Art. 17 GDPR),
• restriction of processing (Art. 18 GDPR),
• data portability (Art. 20 GDPR),
• object to processing based on Art. 6(1)(f) GDPR (Art. 21 GDPR).

If processing is based on your consent, you may withdraw it at any time with effect for the future. The lawfulness of processing carried out before withdrawal remains unaffected.

Right to object: You may object at any time, on grounds relating to your particular situation, to processing that we base on a legitimate interest. We will then no longer process the data unless we can demonstrate compelling legitimate grounds that override your interests, rights, and freedoms, or the processing serves the establishment, exercise, or defense of legal claims.

To exercise your rights, a message to kontakt@contentoren.de is sufficient.

Right to lodge a complaint: You may lodge a complaint with a data protection supervisory authority. The authority responsible for us is the State Commissioner for Data Protection and Freedom of Information of North Rhine-Westphalia, Kavalleriestraße 2-4, 40213 Düsseldorf. You may also contact the supervisory authority at your habitual place of residence.

The provision of personal data is not generally required by law or contract. However, we require certain information (e.g. contact and billing data) to conclude and perform a contract. Without this information, we cannot conclude or perform a contract.

We take technical and organizational measures appropriate to the state of the art to protect data against loss, misuse, and unauthorized access. These include in particular transport encryption for the website (TLS), access restrictions according to the principle of least privilege, and regular updates of the systems used. The measures are continuously adapted to technological developments.

We adapt this Privacy Policy when our website, the services used, our services, or the legal requirements change. The version published on this page at any given time applies. The German version controls; translations are provided for better understanding.

Status as of: August 12, 2026