Last updated:
Controller and contact
The controller responsible for processing personal data is Michael Oberhoff, trading as Mindsetfree LABS, Vacher Str. 17, 90587 Obermichelbach, Germany.
Email: legal@mindsetfree.de Telephone: +49 911 97796981
This notice covers our website, including its access-restricted administration area, and communication with us.
Website access and hosting
When our website is accessed, the IP address, time of the request, requested address and technical request information sent by the browser are processed. This is necessary to deliver content and operate the website reliably and securely. The legal basis is Article 6(1)(f) GDPR. Our legitimate interest is to provide and protect this website.
We use hosting services provided by Host Europe GmbH, c/o Spaces, Gertrudenstraße 30–36, 50667 Cologne, Germany. The provider supplies the technical infrastructure and may access data when providing these services or necessary support. Request data needed to deliver content are generally processed only while handling the request. Our web application does not keep a separate visitor access log. Operational and error logs are described below.
Operational and error logs
Our own web and application services process operational and error messages to identify and resolve faults and prevent misuse. These messages may include technical information about an affected request. We limit logging to the information required for these purposes. The legal basis is Article 6(1)(f) GDPR; our legitimate interest is secure and reliable operation.
Logs of our running web and application services are automatically deleted within seven days during normal operation. Size limits also apply. Where specific information is needed to investigate an actual security incident or establish, exercise or defend legal claims, only the necessary data are retained separately with restricted access. They are deleted when that purpose ends and no statutory retention duty applies. This seven-day period applies to our own operational and error logs.
Automatic language selection
When the start address is opened without a language code, the IP address is checked on our server against a locally stored DB-IP Country Lite country database. German is initially displayed for Germany and Austria, and English for other countries or addresses that cannot be assigned to a country.
The IP address is not sent to DB-IP or another external geolocation service for this check. The function does not determine a precise location or keep an individual country or visit history. The country result is used only for the current language selection.
The legal basis is Article 6(1)(f) GDPR. Our legitimate interest is to provide an initially suitable language version. The language can be changed at any time using the language selector. Pages accessed directly under /de/ or /en/ remain available in the chosen language.
Cookies and browser storage
The public website does not use cookies or comparable browser storage for analytics, advertising or a persistent language preference. Language selection is reflected in the German and English page addresses. Opening the neutral start address again triggers a new country lookup.
A language cookie remaining from an earlier website version is not used for language selection and is removed on the designated entry or former language-selection routes. Existing cookies can also be deleted through browser settings.
The administration area uses the necessary session cookies described below. Additional persistent browser storage for navigation or colour-scheme preferences is not used there.
Administration area
The administration area is restricted to authorised persons. Public registration is not available. Account information, permissions and session data are processed for account management, login and access protection. These include the account identifier, a password hash and, for sessions, the IP address, browser identifier and time of last activity.
The encrypted mindsetfree_session cookie associates requests with a session. The XSRF-TOKEN cookie supports protection against forged requests. Both are transmitted only over HTTPS and have a lifetime of 120 minutes, renewed with session activity. The session cookie is inaccessible to JavaScript. Login expires after 120 minutes of inactivity; there is no persistent remember-me login.
Expired server-side session records are automatically cleaned up twice an hour. During normal operation, they are therefore deleted no later than three hours after the last activity. When authorisation ends, access is revoked; account data no longer needed are deleted unless another legal basis requires continued retention.
The legal basis is Article 6(1)(f) GDPR. Our legitimate interest is secure administration and access control. Cookies and device access that are strictly necessary for the expressly requested login are used under Section 25(2)(2) of the German Telecommunications Digital Services Data Protection Act (TDDDG).
Contact by email or telephone
When someone contacts us, we process the contact details and information provided to handle the enquiry. For emails, this includes sender and recipient addresses, subject, message content, technical transmission data and any attachments. We use Host Europe GmbH's own email service for receiving and sending emails. Microsoft 365 is not used for this purpose.
An email link on the website opens the email application in use. A message is transmitted only when the sender sends it. The public website currently has no contact form.
Where an enquiry concerns a contract with the person making the enquiry or related pre-contractual steps, the legal basis is Article 6(1)(b) GDPR. Article 6(1)(f) GDPR applies to other enquiries and communication with contacts at businesses. Our legitimate interest is to handle and document business communication appropriately.
Providing information is generally voluntary. Without the information necessary to handle the matter and a means of responding, we may be unable to process the enquiry or reply.
Retention of enquiries and business records
Business correspondence subject to statutory retention duties must generally be retained for six years, and invoices and accounting vouchers for eight years. Books, inventories and annual accounts subject to retention duties must generally be kept for ten years. Relevant rules include Section 147 of the German Fiscal Code (AO), Section 14b of the German VAT Act (UStG) and, where applicable, Section 257 of the German Commercial Code (HGB). The periods generally start at the end of the calendar year specified by the applicable provision. Statutory extensions and special rules remain applicable.
Legally required retention is based on Article 6(1)(c) GDPR. Necessary retention for legal claims is based on Article 6(1)(f) GDPR; our legitimate interest is to preserve, enforce or defend those claims. Data are deleted when the applicable basis no longer exists. These periods do not apply indiscriminately to all emails or website visitors.
Recipients
Access to personal data is limited to persons authorised for the relevant purpose. Host Europe is involved as the provider of hosting and email infrastructure. Other recipients are involved only where necessary for a specifically requested service or compliance with legal duties, for example competent authorities where disclosure is legally required.
Information subject to retention duties is limited to what is required and protected against unauthorised access.
Backups
For recovery after technical incidents, we also process personal data in protected backups of our website database and configuration. The legal basis is Article 6(1)(f) GDPR; our legitimate interest is the availability and recoverability of the website.
Our own operational backups containing personal data are deleted or replaced by newer backups within 30 days during normal operation. They are used exclusively for recovery and are not an archive for business documents subject to statutory retention duties. Where technical constraints mean that individual data can be deleted from backups only when the backup expires, access remains restricted to recovery purposes. When data are restored, deletions already due are applied before normal use resumes.
This period applies to our own operational backups. Documents subject to statutory retention duties are handled separately under the rules described above.
Analytics, external content and other functions
This website currently uses no audience analytics or advertising services. Images and fonts are served locally. No external videos, maps or social media content are embedded. Other websites are accessed only when an external link is followed; the respective provider's notices apply there.
Public online appointment booking, a newsletter and public customer accounts are currently disabled.
Your rights
Subject to the statutory conditions, you have rights of access under Article 15, rectification under Article 16, erasure under Article 17 and restriction of processing under Article 18 GDPR. The right to data portability under Article 20 GDPR applies where its conditions are met, particularly for automated processing based on consent or a contract.
Where processing is based on consent, it may be withdrawn at any time with effect for the future. Withdrawal does not affect the lawfulness of processing before withdrawal.
The contact details above may be used to exercise these rights. Statutory retention duties and other legal exceptions are considered when handling erasure requests.
Right to object
Where processing is based on Article 6(1)(f) GDPR, you may object at any time on grounds relating to your particular situation. We will stop processing the affected data unless we can demonstrate compelling legitimate grounds overriding your interests, rights and freedoms, or the processing is needed to establish, exercise or defend legal claims.
Objections may be sent to legal@mindsetfree.de or the postal address above.
Right to complain
You may complain to a data protection supervisory authority, particularly in the place where you usually live or work or where an alleged infringement occurred.
The authority generally responsible for private businesses in Bavaria is the Bavarian State Office for Data Protection Supervision (Bayerisches Landesamt für Datenschutzaufsicht): Promenade 18, 91522 Ansbach, Germany https://www.lda.bayern.de/de/beschwerde.html
Automated decisions
We do not make solely automated decisions producing legal effects concerning individuals or similarly significantly affecting them. Automatic country detection determines only the language version initially displayed.