This is the English version of our privacy policy; a German version is also available. If you notice any discrepancy between the two, please tell us at info@idastroem.de and we will correct it.
The controller responsible for data processing on this website is:
idastroem GmbH
Sonnenhöhe 27
95473 Creußen
Germany
Phone: +49 9270 99990-20
E-mail: info@idastroem.de
Represented by its managing director Dipl.-Inf. Markus Kräutner. Commercial register: Amtsgericht Bayreuth (Local Court Bayreuth), HRB 7422. VAT ID: DE342027939.
We have not appointed a data protection officer, as we are not required to do so under § 38 (1) BDSG. For any question regarding data protection, please use the contact details above.
This website is deliberately built to collect as little data as possible:
The following sections describe each processing activity in detail.
With regard to your personal data you have the right of access (Art. 15 GDPR), rectification (Art. 16 GDPR), erasure (Art. 17 GDPR), restriction of processing (Art. 18 GDPR), data portability (Art. 20 GDPR) and objection (Art. 21 GDPR).
An informal message to the address above or to info@idastroem.de is sufficient to exercise these rights. We respond without undue delay and at the latest within one month of receiving your request (Art. 12 (3) GDPR). For particularly complex requests this period may be extended by up to two further months; we will inform you of this within the first month.
Withdrawal of consent: Where processing is based on your consent, you may withdraw it at any time with effect for the future. The lawfulness of processing carried out before the withdrawal remains unaffected.
Right to object under Art. 21 GDPR: You have the right to object at any time, on grounds relating to your particular situation, to processing that we base on a legitimate interest under Art. 6 (1) (f) GDPR. We will then no longer process the data concerned unless we can demonstrate compelling legitimate grounds that override your interests, rights and freedoms, or the processing serves to establish, exercise or defend legal claims.
Right to lodge a complaint: Without prejudice to other remedies, you may lodge a complaint with a supervisory authority (Art. 77 GDPR). The authority responsible for us is the Bayerisches Landesamt für Datenschutzaufsicht (BayLDA) in Ansbach, Germany. You may also contact the supervisory authority of your habitual residence or place of work.
Each time a page of this website is requested, and when the measurement software described in section 7 is retrieved from stats.idastroem.de, your browser transmits technically necessary information that our web servers log:
This information is technically necessary to deliver the website. We also use it to isolate faults and to detect and defend against attacks on our systems. It is not merged with any other data source.
Legal basis: Art. 6 (1) (f) GDPR. Our legitimate interest lies in the technically faultless and secure operation of this website.
Retention: Access logs are stored on a rotating basis and continuously overwritten; they are not archived permanently. Longer storage only occurs where a specific security incident requires investigation; we delete the entries concerned once the investigation is complete.
This website runs on a server that we administer ourselves and rent from the following provider:
netcup GmbH
Daimlerstraße 25
76185 Karlsruhe
Germany
The provider processes the access data named under section 4 exclusively on our instructions and only insofar as this is necessary to operate the infrastructure. We have concluded a data processing agreement with the provider pursuant to Art. 28 GDPR.
Legal basis: Art. 6 (1) (f) GDPR. Our legitimate interest lies in the reliable and secure provision of our online offering.
All fonts, images and other design elements of this website are delivered from our own web server (see section 5). Visiting the pages establishes no connection to external providers such as Google Fonts or content delivery networks; your IP address is therefore not transmitted to third parties.
To understand which content is being used, we use Umami, an open-source tool for measuring reach. We operate Umami ourselves at stats.idastroem.de on the infrastructure named under section 5. The measurement data does not leave that server, is not passed on to further third parties and is not transferred to third countries.
Umami works without cookies and places no identifier on your device. The following is recorded: the page requested, the referring page, browser type and version, operating system, device type, screen resolution and the country determined from the IP address.
Your IP address is not stored in the statistics data. It appears only in the server access logs, which are continuously overwritten as described in section 4. In order to group several page views within one visit, Umami calculates a hash value on the server from the IP address, browser identification, hostname and a secret random value. This random value is rotated every 24 hours and the previous one is deleted. Within a single day, page views from the same device can therefore be assigned to the same visit; beyond that day, recognition is no longer possible. Once the random value has been deleted, the original IP address can no longer be reconstructed from the stored values either.
Legal basis: Art. 6 (1) (f) GDPR. Our legitimate interest lies in the statistical evaluation of usage in order to improve this offering.
In our assessment, this form of reach measurement does not require consent under § 25 (1) TDDDG, as no cookies are set and no identifiers are stored on or read from your device. The information processed about browser, operating system and screen size is transmitted by your browser with every page request in any case, or follows directly from rendering the page. Should this assessment change as a result of case law or guidance from the supervisory authorities, we will obtain consent.
Retention: We store measurement data for as long as it is needed for statistical evaluation. Once the daily rotating random value has been deleted, the stored values can no longer be attributed to any person; we therefore do not currently set a fixed deletion period beyond this.
Objection: You can object to reach measurement in three ways.
First, here, permanently for this browser:
To do so we store a single marker in your browser. It serves solely to carry out your objection, contains no identifier and allows no recognition. If you clear your browser data, you will need to disable measurement again.
Second, through your browser’s “Do Not Track” setting, which we evaluate. If it is enabled, no measurement takes place. Not every browser still offers this setting.
Third, by blocking the script stats.idastroem.de/script.js with a content blocker.
As we do not store any persistent identifier, we cannot exclude you from measurement on the server side; the options above therefore take effect in your browser.
Some videos are stored on our own web server (see section 5) and delivered directly from there. Only the access logs described in section 4 are generated; legal basis and retention correspond to the details given there. No transfer to third parties takes place.
Embedded videos from YouTube and Vimeo are not loaded automatically. As long as you do not start a video yourself, no connection to the providers’ servers is established and no data is transmitted to them, in particular not your IP address.
Instead of the video you first see a placeholder. It names the provider, points out the transfer to the USA and the risks involved there, and refers to this privacy policy. Only when you press the button is the player loaded. With that click you expressly consent to the data processing described below, to the storing of information on your device and to the transfer of your data to the United States.
Legal basis: Art. 6 (1) (a) GDPR and § 25 (1) TDDDG. For the basis of the transfer to the United States, see section 11.
Scope and withdrawal: Your consent applies to the individual video requested and to the current page view. If you reload the page, the placeholder reappears and no further connection is established without another click. We cannot reverse the transfer that has already taken place or cookies set by the provider; you can delete cookies in your browser.
YouTube. The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Once a video is started, your IP address and the page requested are transmitted to the provider, which may use cookies or comparable recognition technologies. If you are logged into Google, your usage behaviour may be associated with your account. Privacy information: https://policies.google.com/privacy
Vimeo. The provider is Vimeo.com, Inc., based in the United States. Once a video is started, your IP address and the page requested are transmitted to the provider, which may use cookies or comparable recognition technologies. We embed Vimeo with the “Do Not Track” parameter (dnt=1); according to the provider, it then refrains from tracking for analytics and advertising purposes. Privacy information: https://vimeo.com/privacy
Regarding the risks of transfer to the USA, see section 11.
If you write to us, we process your sender address, your name and the content of your message in order to handle your enquiry. On some pages we offer a prepared e-mail link for this; the message is composed and sent exclusively in your own e-mail program. There is no contact form on this website, so no form data is transmitted to us.
Our e-mail mailbox is operated by:
ALL-INKL.COM – Neue Medien Münnich, owner René Münnich
Hauptstraße 68
02742 Friedersdorf
Germany
Please note that a different transmission path applies to e-mail than to retrieving this website: an unencrypted e-mail can in principle be read by third parties on its way through the internet. If you wish to send us confidential information, please contact us beforehand.
If you call us, we process your telephone number and the information you provide during the call in order to handle your request. Calls are not recorded. Our telephone connection is operated by:
Gamma Placetel GmbH
Lothringer Straße 56
50677 Köln
Germany
Legal basis: For enquiries relating to an existing or prospective contract, Art. 6 (1) (b) GDPR; otherwise Art. 6 (1) (f) GDPR based on our legitimate interest in answering enquiries. Data processing agreements pursuant to Art. 28 GDPR are in place with the providers named, insofar as they process personal data on our behalf; otherwise the rules on telecommunications secrecy apply.
Retention: We delete your enquiry once it has been dealt with and no statutory retention obligations apply. Business correspondence is retained in accordance with the commercial and tax law requirements of § 257 HGB and § 147 AO. In order to meet tax obligations, we pass the relevant documents to our tax adviser and to the tax authorities.
Voluntary nature: Providing your contact details and the content of your enquiry is neither required by law nor by contract. You are not obliged to provide us with this data. Without it, however, we cannot process your enquiry or reply to you; no further disadvantages arise for you.
On the CRA consulting page we offer a self-check with questions about your products. Your answers are stored exclusively locally in your browser (localStorage) and are not transmitted to us. Storage only begins when you answer the first question and serves solely to preserve your progress; it is strictly necessary for this service you are using (§ 25 (2) no. 2 of the German TDDDG) and therefore does not require consent. You can remove the data yourself at any time via the “Delete saved progress” button; it is also removed when you clear your browser data.
If you send your result by e-mail, this happens exclusively through your own e-mail program; the information under section 9.1 applies.
Newsletter: If you tell us by e-mail that you would like to receive our newsletter on the CRA, we process your e-mail address and your name in order to send the newsletter. The legal basis is your consent (Art. 6 (1) (a) GDPR). You can revoke your consent at any time with effect for the future, for example by informal e-mail or via the unsubscribe note in every newsletter; we will then remove your address from the mailing list. The newsletter is sent via the mailbox named in section 9.1; no data is passed on to third parties.
There is no cross-site tracking, no profiling and no automated decision-making including profiling within the meaning of Art. 22 GDPR. We do not use advertising or retargeting services.
We process only data that you provide to us yourself or that arises technically when this website is accessed. We do not process personal data from external sources for the operation of this website. Should we wish to process your data in future for a purpose other than the one stated in each case, we will inform you beforehand.
Should we use services in future that require consent, we will obtain it in advance and adapt this policy accordingly.
Personal data is transferred to countries outside the EU and the EEA exclusively in the case described under section 8.2, that is, after you have actively started an embedded video from YouTube or Vimeo. Both providers also process data in the United States.
For the United States, an adequacy decision of the European Commission exists (EU-US Data Privacy Framework). It applies to companies certified under that framework. Both Google LLC and Vimeo.com, Inc. are certified; we verified this status in the official list at dataprivacyframework.gov on 29 July 2026. The transfer is therefore based on Art. 45 GDPR. Independently of this, it only takes place after you have loaded the respective video yourself.
We point out that the adequacy decision is subject to judicial review and that authorities in the United States may access data under certain conditions. We have no influence over this processing. Should the decision be annulled or a provider’s certification lapse, we will discontinue the embedding of that service or place it on a different basis and adapt this policy.
This website is delivered exclusively over a TLS-encrypted connection, recognisable by the “https://” in your browser’s address bar. As a result, the content you request cannot readily be read or altered by third parties in transit. This does not apply to e-mail; see the note under section 9.1.
We adapt this policy whenever the technology used on this website or the legal situation changes. The version published here is the applicable one; we will highlight material changes separately. The date of the current version is shown at the top of this page.