Privacy

1. Introduction

Data protection is an important topic in the age of the internet. All too often we don't really know what is happening in the background. That's why this page puts its cards on the table and shows you what's going on. We try to explain transparently how a website works, and if you still have questions, feel free to get back to us.

2. Responsible for this website

The controller within the meaning of the GDPR is:

Spacifik UG (haftungsbeschränkt)
Gerichtstr. 19
13347 Berlin, Germany
Email: [email protected]

Person responsible for the website and data protection officer: Luis Rieke

Feel free to reach out to me at any time with questions or concerns.

3. Why these texts?

The following texts are meant to show you, as a "data subject", how we process personal data, and of course it is also important to us to explain your rights under data protection law.

First of all, it's important for you to know that our website can generally be used without entering any personal data. You are not obliged to disclose information about yourself. If you contact us or send a booking request, however, personal data such as your name and email address will naturally be collected. Of course, we can also delete this data retroactively at your request, unless statutory retention obligations apply.

We process personal data confidentially, and if you contact us via the booking form or by email, we will of course not pass on your email address.

All data is always processed in accordance with the General Data Protection Regulation (GDPR) and the country-specific data protection provisions applicable to Spacifik UG (haftungsbeschränkt).

The individual sections of this privacy policy always show you exactly how much and which data we collect and why.

4. Very important for you

From the very beginning, we have made sure that your data is safe and that we protect it like our own. We use numerous measures to ensure the most complete protection possible for personal data processed via this website.

However, please note that data transmission over the internet can have security gaps, so absolute protection cannot be guaranteed. You should always keep this in mind, on every website.

Such gaps can arise, for example, from your Wi-Fi router. A good antivirus program may help, as can a decent firewall and a secure browser. Complete protection of data against access by third parties is, however, not possible.

For this reason, we of course leave everyone the option of sending us personal data by alternative means, for example by post.

5. Your rights regarding your data

You can request an export of your personal data from us, including all data you have provided to us.

You can also request the deletion of all personal data we have stored about you. This does not include data we are required to retain for administrative, legal or security reasons.

You also have the right to access, rectification, restriction of processing and objection, as well as the right to lodge a complaint with a supervisory authority, e.g. the Berlin Commissioner for Data Protection and Freedom of Information.

6. Definitions

We want you to understand all of these texts, so here are a few explanations. If you have any questions, feel free to contact our data protection officer.

The terms listed here are those used in the General Data Protection Regulation (GDPR). In our privacy policy we use, among others, the following terms:

Processors are natural or legal persons, public authorities, agencies or other bodies that process personal data on behalf of a controller.
A data subject is anyone whose data is processed by our company.
A third party is a natural or legal person, public authority, agency or body other than you and us, i.e. other than the data subject, the controller, the processor and persons who, under the direct authority of the controller or processor, are authorised to process personal data.
Restriction of processing means marking stored personal data in order to limit its future processing.
Consent is a clear indication of wishes, given by a written statement or another clear affirmative action, by which the data subject signifies agreement to the processing of personal data relating to them.
A recipient is a natural or legal person, public authority, agency or other body to which personal data is disclosed. Public authorities that receive personal data in the framework of a particular inquiry are not regarded as recipients.
Personal data means any information relating to you as an identifiable natural person, for example your name, your location or specific factors of your physical, physiological, genetic, mental, economic, cultural or social identity.
Profiling means any form of processing personal data to evaluate, analyse or predict certain personal aspects relating to a natural person.
Pseudonymisation means processing personal data in such a way that it can no longer be attributed to a specific person.
Processing means any automated operation performed on personal data, such as collection, recording, combination, sorting, organisation, storage, alteration, retrieval, use or any form of making it available.

7. Legal basis for processing

If we need personal data from you to fulfil an order, we explicitly ask for your permission.

Art. 6 GDPR begins: "Processing shall be lawful only if and to the extent that at least one of the following applies: the data subject has given consent to the processing of his or her personal data for one or more specific purposes." This is what we rely on in this case (Art. 6 (1)(a) GDPR).

Sometimes processing personal data is necessary to perform a contract to which you are a party. This is the case for a bike rental, but also, for example, for an enquiry or to fulfil tax obligations. In these cases processing is based on Art. 6 (1)(b) GDPR.

It's unlikely, but we want to address it too: someone could be in danger. If, for example, someone is seriously injured, we will of course pass vital information on to a doctor, hospital or other third parties. Here, processing is based on Art. 6 (1)(d) GDPR, to protect the vital interests of the data subject.

Finally, processing operations may be based on Art. 6 (1)(f) GDPR. This covers processing that is not covered by any of the above legal bases, in particular where processing is necessary to protect a legitimate interest of our company or a third party. The European legislator considered that a legitimate interest could be assumed if you are a customer of our company; we refer explicitly to Recital 47, sentence 2 GDPR.

8. Our hosting

This website is hosted by Netlify and delivered via its content delivery network (CDN).

Netlify, Inc., 101 2nd Street, San Francisco, CA 94105, USA

When you visit the site, Netlify processes technically necessary data such as IP address, date, time and browser type in so-called server log files (Art. 6 (1)(f) GDPR). Transfers to the USA are based on the EU-US Data Privacy Framework or standard contractual clauses.

More information: https://www.netlify.com/privacy/

9. Technology

If you are only on this website for information, i.e. you don't use a form or send us information in any other way, we only receive the data your browser sends to our server. This is called a server log file.

The following information may be collected:

Which browser you use
Your operating system
The website from which you came to our site
Your IP address
Your internet service provider
The pages you click on
The date and time of your visit

We do not draw any conclusions about you as a person from this general data. We need this information so that we can:

know which technical conditions to build our website for (phones, laptops, desktops? Which browser? And so on) to deliver our content correctly,
provide law enforcement authorities with the necessary information in the event of a cyberattack,
ensure our IT systems keep working.

This data is only of interest to us in aggregate with all other data, and we evaluate it statistically with the aim of improving data protection and data security in our company.

The legal basis for this processing is Art. 6 (1)(f) GDPR. Our legitimate interest follows from the purposes listed above, because this is the only way we can operate the website that our business relies on.

10. Disclosure of data to third parties

We do not share your personal data with third parties for any purposes other than those listed below. We only share your personal data with third parties if:

you have given your consent under Art. 6 (1)(a) GDPR,
there is a legal obligation to disclose it under Art. 6 (1)(c) GDPR,
it is legally permissible and necessary under Art. 6 (1)(b) GDPR to perform a contract with you,
disclosure is permitted under Art. 6 (1)(f) GDPR to protect our legitimate interests and there is no reason to assume that you have an overriding interest worthy of protection in your data not being disclosed.

11. Cookies

Cookies are small files that your browser creates automatically and stores on your device, for example a laptop or smartphone. Cookies do not harm your device and contain no viruses or trojans. They help your browser do its job.

We only use one strictly necessary cookie ("lang") that stores your chosen language so you don't have to select it again on your next visit (§ 25 (2) TDDDG, Art. 6 (1)(f) GDPR). No tracking or marketing cookies are used.

Most browsers accept cookies automatically. However, you can configure your browser not to store cookies or to always notify you before a new cookie is set. Disabling cookies completely may mean that some functions of our website do not work properly.

12. Booking requests via Tally

By using the booking form, you consent to the processing of your data for the purpose of contacting you and handling your request. For the form we use the service Tally (Tally BV, Belgium). The data you enter (e.g. name, email, rental period) is processed to handle your request and perform the contract (Art. 6 (1)(b) GDPR). The form is only loaded when you open the booking page or start a request.

13. Fonts

All fonts are served locally from our server. No connection to Google Fonts is made.