Privacy

In web hosting, we collect, process and use a user’s personal data without further consent only to the extent necessary for establishing and performing the contract and for billing purposes.

To establish and perform a contractual relationship, the user’s name, address, telephone number, e-mail address and bank details as well as access credentials are generally required (master data). These data are generally collected via electronic order forms.

To fulfil our duty to provide information under data protection law, the personal data collected and stored are visible to the customer at any time in their configuration menu under Settings -> Contact details. Account or payment data can never be displayed, as they are stored only in encrypted form (sandbox procedure).

The user is advised that registering a domain requires certain personal data, usually name and address, to be transmitted to the relevant national and international registries and to be published in the publicly accessible Whois databases.

For the registration of a .de domain, for example, the names and addresses of the domain holder, the administrative and technical contacts and the zone administrator, as well as the telephone and fax numbers and e-mail addresses of the technical contact and the zone administrator, are currently transmitted to DENIC e.G., Frankfurt/Main, and published in the DENIC database at www.denic.de.

Usage data, such as information on the beginning, end and extent of a user’s use of certain services, or connection data for e-mail services, are collected, processed and used only to the extent necessary to enable and bill the use of these services. As a rule, the date, time and time zone of the beginning and end of use, the volume in bytes, the user’s IP address and the type of telemedia service used are recorded.

Where usage data are required for billing purposes (billing data), they are stored for no longer than six months after the invoice has been sent, and beyond that only if and for as long as the user raises objections to the invoice or fails to pay the invoice despite a payment reminder. After termination of the contractual relationship and settlement of all outstanding claims, twosteps GmbH deletes all personal data in accordance with the applicable requirements of the Data Protection Act and the Telecommunications Ordinance. Where the data are required to comply with existing statutory, statutory-by-law or contractual retention periods, we block the data for the prescribed period.

In accordance with the applicable provisions, we are entitled to provide information to law enforcement authorities and courts for the purposes of criminal prosecution. On request, we provide the user with information free of charge and without delay about all data stored about them. The information may also be provided electronically.

Who is responsible for data collection on this website?

Data processing on this website is carried out by the website operator. You can find their contact details in the legal notice (Impressum) of this website.

How do we collect your data?

On the one hand, your data are collected when you provide them to us. This may, for example, be data that you enter during the ordering process. Other data are collected automatically by our IT systems when you visit the website. These are mainly technical data (e.g. internet browser, operating system, origin or time of the page request). These data are collected automatically as soon as you enter our website.

What do we use your data for?

Part of the data is collected to ensure that the website is provided without errors. Another part is used to carry out your order and to prevent fraud. Other data may be used to analyse your user behaviour.

What rights do you have regarding your data?

You have the right at any time to receive information free of charge about the origin, recipients and purpose of your stored personal data. You also have the right to request the correction, blocking or deletion of these data. For this purpose and for any further questions on data protection, you can contact us at any time at the address given in the legal notice. You also have the right to lodge a complaint with the competent supervisory authority.

Note on the controller

twosteps GmbH
Ralf Kayser
Postfach 230 304
70623 Stuttgart-Flughafen
Germany

Withdrawal of your consent to data processing

Many data processing operations are only possible with your express consent. You can withdraw consent you have already given at any time. An informal e-mail to us is sufficient. The lawfulness of the data processing carried out until the withdrawal remains unaffected by the withdrawal.

Right to lodge a complaint with the competent supervisory authority

In the event of breaches of data protection law, the data subject has the right to lodge a complaint with the competent supervisory authority. The competent supervisory authority for data protection matters is the data protection commissioner of the federal state in which our company has its registered office. A list of the data protection commissioners and their contact details can be found at the following link: https://www.bfdi.bund.de/DE/Infothek/Anschriften_Links/anschriften_links-node.html

Right to data portability

You have the right to have data that we process automatically on the basis of your consent or in performance of a contract handed over to you or to a third party in a common, machine-readable format. If you request the direct transfer of the data to another controller, this will only take place to the extent that it is technically feasible.

SSL/TLS encryption

For security reasons and to protect the transmission of confidential content, such as orders or enquiries that you send to us as the site operator, this site uses SSL/TLS encryption. You can recognise an encrypted connection by the fact that the browser’s address bar changes from “http://” to “https://” and by the lock symbol in your browser bar. When SSL/TLS encryption is activated, the data you transmit to us cannot be read by third parties.

Encrypted payment transactions on this website

If, after concluding a contract subject to a charge, there is an obligation to provide us with your payment data (e.g. account number for a direct debit authorisation), these data are required for payment processing. Payments via the common means of payment (Visa/MasterCard, direct debit) are made exclusively via an encrypted SSL/TLS connection. With encrypted communication, the payment data you transmit to us cannot be read by third parties. Employees of twosteps GmbH have no access to your payment data and can neither view nor change them.

Information, blocking, deletion

Within the framework of the applicable statutory provisions, you have the right at any time to free information about your stored personal data, their origin and recipients and the purpose of the data processing and, where applicable, a right to correction, blocking or deletion of these data. For this purpose and for any further questions on personal data, you can contact us at any time at the address given in the legal notice.

Cookies

Some of the web pages use so-called cookies. Cookies do not cause any damage to your computer and do not contain viruses. Cookies serve to make our offer more user-friendly, effective and secure. Cookies are small text files that are placed on your computer and stored by your browser.

Most of the cookies we use are so-called “session cookies”. They are automatically deleted at the end of your visit. Other cookies remain stored on your device until you delete them. These cookies enable us to recognise your browser on your next visit.

You can set your browser so that you are informed about the setting of cookies and allow cookies only in individual cases, exclude the acceptance of cookies for certain cases or in general, and activate the automatic deletion of cookies when closing the browser. If cookies are deactivated, the functionality of this website may be limited.

Cookies that are required to carry out the electronic communication process or to provide certain functions you have requested (e.g. shopping cart function) are stored on the basis of Art. 6(1)(f) GDPR. The website operator has a legitimate interest in storing cookies for the technically error-free and optimised provision of its services. Insofar as other cookies (e.g. cookies for analysing your browsing behaviour) are stored, these are dealt with separately in this privacy policy.

Server log files

The provider of the pages automatically collects and stores information in so-called server log files, which your browser automatically transmits to us.
These are:
• browser type and browser version
• operating system used
• referrer URL
• host name of the accessing computer
• time of the server request
• IP address
These data are not merged with other data sources. The basis for the data processing is Art. 6(1)(b) GDPR, which permits the processing of data for the performance of a contract or pre-contractual measures.

Processing of data (customer and contract data)

We collect, process and use personal data only to the extent necessary for establishing, structuring the content of or changing the legal relationship (master data). This is done on the basis of Art. 6(1)(b) GDPR, which permits the processing of data for the performance of a contract or pre-contractual measures. We collect, process and use personal data about the use of our web pages (usage data) only to the extent necessary to enable the user to use the service or to bill for it.

The customer data collected are deleted after completion of the order or termination of the business relationship. Statutory retention periods remain unaffected.

Data transmission upon conclusion of a contract

We transmit personal data to third parties only if this is necessary in the context of contract processing, for example to registrars or to the credit institution commissioned with payment processing. Any further transmission of the data does not take place, or only if you have expressly consented to the transmission. Your data will not be passed on to third parties, for example for advertising purposes.

We generally provide other kinds of information (e.g. to tax advisers or similar) only upon presentation and verification of a written power of attorney from the account holder that also states the scope and purpose of the information.

Newsletter

Newsletter data

If you would like to receive the newsletter offered on the website, we need an e-mail address from you as well as information that allows us to verify that you are the owner of the e-mail address provided and that you agree to receive the newsletter. Further data are not collected, or only on a voluntary basis. We use these data exclusively for sending the requested information and do not pass them on to third parties.

The data entered in the newsletter registration form are processed exclusively on the basis of your consent (Art. 6(1)(a) GDPR). You can withdraw your consent to the storage of the data, the e-mail address and their use for sending the newsletter at any time, for example via the “unsubscribe” link in the newsletter. The lawfulness of the data processing operations already carried out remains unaffected by the withdrawal.

The data you have provided to us for the purpose of receiving the newsletter are stored by us or the newsletter service provider until you unsubscribe from the newsletter and are deleted from the newsletter distribution list after you unsubscribe. Data stored by us for other purposes remain unaffected.

After you have been removed from the newsletter distribution list, your e-mail address may be stored by us or the newsletter service provider in a blacklist to prevent future mailings. The data from the blacklist are used only for this purpose and are not merged with other data. This serves both your interest and our interest in complying with the legal requirements when sending newsletters (legitimate interest within the meaning of Art. 6(1)(f) GDPR). Storage in the blacklist is not limited in time. You can object to the storage if your interests outweigh our legitimate interest.

Social media

Facebook plugins (Like & Share button)

Plugins of the social network Facebook are integrated on this website. The provider of this service is Facebook Ireland Limited, 4 Grand Canal Square, Dublin 2, Ireland. According to Facebook, however, the data collected are also transferred to the USA and other third countries.

You can recognise the Facebook plugins by the Facebook logo or the “Like button” on this website. An overview of the Facebook plugins can be found here: https://developers.facebook.com/docs/plugins/?locale=de_DE.

When you visit this website, the plugin establishes a direct connection between your browser and the Facebook server. Facebook thereby receives the information that you have visited this website with your IP address. If you click the Facebook “Like button” while logged into your Facebook account, you can link the content of this website to your Facebook profile. This allows Facebook to associate the visit to this website with your user account. We point out that, as the provider of the pages, we have no knowledge of the content of the transmitted data or their use by Facebook. Further information can be found in Facebook’s privacy policy at: https://de-de.facebook.com/privacy/explanation.

If you do not want Facebook to be able to associate your visit to this website with your Facebook user account, please log out of your Facebook user account.

The Facebook plugins are used on the basis of Art. 6(1)(f) GDPR. The website operator has a legitimate interest in the greatest possible visibility on social media. If corresponding consent has been requested, processing takes place exclusively on the basis of Art. 6(1)(a) GDPR; consent can be withdrawn at any time.

Twitter plugin

Functions of the Twitter service are integrated on this website. These functions are offered by Twitter Inc., 1355 Market Street, Suite 900, San Francisco, CA 94103, USA. By using Twitter and the “Re-Tweet” function, the websites you visit are linked to your Twitter account and made known to other users. Data are also transferred to Twitter in the process. We point out that, as the provider of the pages, we have no knowledge of the content of the transmitted data or their use by Twitter. Further information can be found in Twitter’s privacy policy at: https://twitter.com/de/privacy.

The Twitter plugin is used on the basis of Art. 6(1)(f) GDPR. The website operator has a legitimate interest in the greatest possible visibility on social media. If corresponding consent has been requested, processing takes place exclusively on the basis of Art. 6(1)(a) GDPR; consent can be withdrawn at any time.

You can change your privacy settings on Twitter in the account settings at https://twitter.com/account/settings.

Our social media presences

Data processing by social networks

We maintain publicly accessible profiles on social networks. The individual social networks we use are listed below.

Social networks such as Facebook, Twitter etc. can generally analyse your user behaviour comprehensively when you visit their website or a website with integrated social media content (e.g. like buttons or advertising banners). Visiting our social media presences triggers numerous processing operations relevant to data protection. In detail:

If you are logged into your social media account and visit our social media presence, the operator of the social media portal can associate this visit with your user account. Under certain circumstances, however, your personal data may also be collected if you are not logged in or do not have an account with the respective social media portal. In this case, the data are collected, for example, via cookies stored on your device or by recording your IP address.

With the help of the data collected in this way, the operators of the social media portals can create user profiles in which your preferences and interests are stored. In this way, interest-based advertising can be displayed to you inside and outside the respective social media presence. If you have an account with the respective social network, interest-based advertising can be displayed on all devices on which you are or were logged in.

Please also note that we cannot trace all processing operations on the social media portals. Depending on the provider, further processing operations may therefore be carried out by the operators of the social media portals. For details, please refer to the terms of use and privacy policies of the respective social media portals.