Privacy Policy

Responsible party

Moritz Hübscher und Hugo Schroeder Digital GbR
Florastraße 61
13187 Berlin, Germany
E-Mail: info@aesthetics.to
Phone: +49 151 29698169

Represented by: Moritz Hübscher, Hugo Schroeder

Data protection officer

The appointment of a data protection officer is not required under § 38 BDSG, as fewer than 20 persons are regularly involved in automated processing of personal data.

SSL/TLS encryption

This website uses SSL/TLS encryption for security. You can recognize an encrypted connection by the lock icon in your browser bar and the https prefix in the URL.

Collection and storage of personal data

When visiting our website, the server automatically collects: browser type and version, operating system, referrer URL, hostname, time of request, and IP address. This data is deleted after 30 days.

Legal basis

Personal data is processed based on GDPR Art. 6(1): (a) consent, (b) contract fulfillment or pre-contractual measures, (f) legitimate interest in ensuring website security and operation.

Hosting

The origin server for this website is operated by Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany. Application data is processed and stored in the Helsinki (Finland) data center and therefore exclusively within the EU. A data processing agreement (DPA) per GDPR Art. 28 is in place with Hetzner. For more information: https://www.hetzner.com/legal/privacy-policy — Additionally, we use Cloudflare, Inc. (101 Townsend St, San Francisco, CA 94107, USA) as a Content Delivery Network (CDN) and DNS provider. Cloudflare temporarily processes connection data (IP address, browser type) to deliver the website and provide DDoS protection. Processing is based on GDPR Art. 6(1)(f) (legitimate interest in website security and availability). Cloudflare is certified under the EU-US Data Privacy Framework. For more information: https://www.cloudflare.com/privacypolicy/

Contact form

When you contact us via the contact form, your details (name, email, message, optional budget) are stored in a database to process your inquiry and for follow-up questions. We do not share this data without your consent. Processing is based on GDPR Art. 6(1)(b) (pre-contractual measures at your request). Your data will be deleted after your inquiry has been fully handled, unless legal retention obligations apply — at the latest after 6 months. Providing this data is neither legally nor contractually required; without a name and email address, however, we cannot respond to your inquiry. No disadvantage arises for you from this. So that we can handle your inquiry promptly, we also send ourselves a notification via the email service provider Brevo (Sendinblue SAS, 106 Boulevard Haussmann, 75008 Paris, France). That notification contains the details you entered in the form. A data processing agreement per GDPR Art. 28 is in place with Brevo, and processing takes place within the EU.

Security logging

To protect against automated attacks, we log access attempts to non-public paths of this website (e.g. login and administration areas). This records the IP address, the browser user agent, and — if entered into a login form — the submitted email address. The legal basis is GDPR Art. 6(1)(f) (legitimate interest in preventing unauthorized access). These logs are evaluated solely for attack detection, are not combined with other data, and are deleted automatically after 30 days.

Data recipients

We do not pass on personal data for advertising purposes and do not sell it. Third-party access occurs solely through the processors named here: Hetzner Online GmbH (hosting), Cloudflare, Inc. (CDN and DNS), and Sendinblue SAS / Brevo (sending the notification for contact inquiries). Beyond that, we only disclose data where legally required or where you have expressly consented.

Fonts

This website uses Google Fonts loaded locally via Next.js. No connection to Google servers is made. No IP addresses are transmitted to third parties.

Cookies & local storage

This website does not use tracking cookies or analytics tools. Only technically necessary technologies are used: The language selection is stored in the browser's local storage. The internal admin area uses an encrypted session cookie (JWT) solely for authentication, which does not transmit personal data to third parties. These technically necessary storage operations are permitted without consent under § 25(2) TDDDG.

Withdrawal of consent

If data processing is based on your consent (GDPR Art. 6(1)(a)), you have the right to withdraw that consent at any time with effect for the future. The lawfulness of processing carried out before the withdrawal remains unaffected. To withdraw consent, simply send an email to info@aesthetics.to.

Right to object under GDPR Art. 21

You have the right to object at any time, on grounds relating to your particular situation, to processing of your personal data carried out on the basis of legitimate interest (GDPR Art. 6(1)(f)). On this website this covers server log data, security logging, and the use of Cloudflare. If you object, we will no longer process the data concerned unless we can demonstrate compelling legitimate grounds that override your interests, or the processing serves to establish or defend legal claims. An informal objection by email to info@aesthetics.to is sufficient.

Your rights

Under GDPR Art. 15–21, you have the right to: access (Art. 15), rectification (Art. 16), deletion (Art. 17), restriction of processing (Art. 18), data portability (Art. 20), and objection to processing (Art. 21). You also have the right to lodge a complaint with a supervisory authority (Art. 77). Please direct requests to the email address above. We will respond within one month.

Supervisory authority

Berlin Commissioner for Data Protection and Freedom of Information
Alt-Moabit 59–61, 10555 Berlin
E-Mail: mailbox@datenschutz-berlin.de
datenschutz-berlin.de

No automated decision-making

We do not use automated decision-making, including profiling, within the meaning of GDPR Art. 22(1).

Changes to this privacy policy

We update this privacy policy whenever our website, the services we use, or the legal situation changes. The version published on this page with the date shown below always applies.