1. Controller
XXX XXXX
XXXXXXXXXX
Email: info.umzughilfen@gmail.com
2. Website delivery and server logs
The website is delivered through ChatGPT Sites. OpenAI Ireland Ltd and the hosting/security infrastructure used for the service may process technically necessary connection data such as IP address, date and time, requested URL, referrer, browser, operating system, device, request/response and diagnostic or security data. The purposes are delivery, stability, troubleshooting and protection against abuse. The legal basis is Article 6(1)(f) GDPR. Data is retained only for service and security purposes and is then deleted or returned under the applicable Sites data-processing terms, unless legal retention is required.
3. Contact by email
When you email us, we process sender and contact details, message content, any attachments and communication metadata in order to reply, prepare a quotation or perform a contract. The basis is Article 6(1)(b) GDPR for pre-contractual or contractual communication and otherwise Article 6(1)(f) GDPR. Gmail and mail-transport providers may receive the data; global processing may occur under the provider’s applicable safeguards. Do not send sensitive documents by ordinary email.
4. Contact form and moving enquiry (Formspree)
The contact form processes name, preferred language, email and/or phone number and message. The moving enquiry can also include customer type, service, origin and destination, floors, lifts, carrying distance, date, flexibility, urgency, property type, rooms, area, volume, inventory, extras and preferred contact channel. Routing metadata, IP address, browser, domain, time and referrer may also be processed. The purposes are replying, assessing feasibility, preparing a quotation, coordination and spam/security protection. The basis is Article 6(1)(b) GDPR and, for general communication or security, Article 6(1)(f) GDPR. File uploads are not enabled and no profiling or solely automated decision is performed.
5. Formspree
Formspree, Inc., USA, receives the form submission and sends it to the stated Gmail inbox. Formspree states that its AWS infrastructure is located in the USA, that data is encrypted in transit and at rest, and that it relies on Standard Contractual Clauses as a processor. The operational deletion routine removes submissions from the Formspree account after handling and no later than 30 days after receipt.
6. Disclosure to service partners
Data is not distributed indiscriminately. Only the contact, route, property, inventory and timing information required for pricing, availability or performance is disclosed to one selected independent subcontractor or specialist business. The recipient processes the data under the role allocated in the relevant partner agreement and its own legal obligations.
7. Contract, invoice and complaint data
If a contract is formed, quotation, order, performance, acceptance, invoice, payment and complaint data is processed for contract performance, documentation, legal claims and commercial or tax duties. The legal bases are Article 6(1)(b), (c) and, where required, (f) GDPR.
8. Local storage and cookie settings
Regardless of your choice, the website stores the consent version, time and your selections for “Strictly necessary” and “Statistics” in the browser’s “umzughilfen-consent” local-storage entry. It remains for no more than 180 days, can be changed or deleted at any time through “Cookie settings”, and is not transmitted to third parties. Access is technically necessary to remember the setting you requested (section 25(2) no. 2 TDDDG); the related processing is based on Article 6(1)(f) GDPR.
9. Google Analytics 4 and Consent Mode
If you consent to the “Statistics” category in the consent manager, we load Google Analytics 4 for measurement ID G-5FDR1X1KDH. The service provider and recipient is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. The purpose is to evaluate the website’s reach, use and technical performance and to improve its content and enquiry process.
The data processed may include pseudonymous online identifiers, page URL and title, referrer, time, language, approximate location, browser, device, operating-system and screen information, and event and interaction data. Names, email addresses, telephone numbers, message content, free-text route details and other form content are not sent to Google Analytics. The event parameters form_name, service_category and object_type contain only predefined categories and no free-text input.
We use Basic Consent Mode v2. The Google tag remains completely blocked until you consent; if you choose “Necessary only”, no cookieless measurement signals are sent to Google Analytics. Consent grants analytics_storage only. ad_storage, ad_user_data and ad_personalization remain denied; Google signals and advertising personalisation are disabled.
The legal basis for storing or accessing Analytics information on your device is section 25(1) TDDDG; the legal basis for the subsequent processing of personal data is Article 6(1)(a) GDPR. Consent is voluntary and may be withdrawn at any time through “Cookie settings” with effect for the future. Withdrawal does not affect the lawfulness of processing carried out before withdrawal.
Google states that it does not log or store individual IP addresses of users in the EU. IP addresses are used to derive approximate location data and are discarded before logging. Measurement data from the EU is initially collected through servers and domains in the EU and is then forwarded to Analytics servers for processing. Processing by Google companies or subprocessors outside the EEA cannot be excluded. Google identifies adequacy decisions, including the EU-US Data Privacy Framework, and appropriate safeguards such as Standard Contractual Clauses as transfer mechanisms.
After consent, the first-party cookies “_ga” and “_ga_5FDR1X1KDH” may be set to distinguish pseudonymous users and maintain session state. We technically limit their lifetime to no more than 180 days; browser limits or withdrawal may shorten it. User-level and event data is retained for no more than 14 months for analysis; aggregated reports may remain longer.
10. Recipients and international transfers
Recipients may include OpenAI Ireland and its infrastructure subprocessors, Formspree/AWS in the USA, Google/Gmail, Google Analytics after consent, one selected service partner and, where necessary, tax or legal advisers, insurers, authorities or courts. Transfers outside the EEA take place only where the requirements of Articles 44 et seq. GDPR are met, including an applicable adequacy decision or appropriate safeguards such as Standard Contractual Clauses.
11. Retention
Ordinary messages are generally deleted six months after final handling. Unsuccessful quotation correspondence is generally deleted twelve months after the last contact. Formspree submissions are removed from the Formspree account after handling and no later than 30 days after receipt. Analytics user-level and event data is retained for no more than fourteen months. Contract, commercial and tax records are retained for the applicable statutory periods, commonly six, eight or ten years depending on the document. Claim-related data may be retained until the relevant limitation periods expire. Earlier deletion applies where the purpose ends and no legal ground requires retention.
12. Your rights
Send requests to info.umzughilfen@gmail.com. No solely automated decision with legal or similarly significant effects is used.
- access under Article 15 GDPR
- rectification under Article 16 GDPR
- erasure under Article 17 GDPR
- restriction under Article 18 GDPR
- data portability under Article 20 GDPR where applicable
- objection under Article 21 GDPR
- withdrawal of consent with future effect where processing relies on consent
13. Right to complain
You may complain to a data protection authority. The competent authority in Hesse is: Der Hessische Beauftragte für Datenschutz und Informationsfreiheit, Wilhelmstraße 7, 65185 Wiesbaden, Germany.
14. Requirement to provide data
There is no legal obligation to use the forms. Fields marked as required and a valid contact channel are needed to answer or assess the enquiry; without them the request cannot be handled. Direct email remains an alternative.
15. Security, third-party data and minors
HTTPS encryption and access restrictions are used. Do not enter another person’s data unless you are authorised to do so. Do not submit identity documents, bank records, health data or special-category data. The service is not directed at children.