Privacy notice

Controller

casa del dessert GmbH Tiefkühlspezialitäten
Weilimdorfer Straße 80, 70839 Gerlingen, Deutschland
Phone 07156 433097, info@casadeldessert.de

In short

This site runs without advertising. We do count how often which page is opened on which day — without a cookie and without an identifier; in the stored figures we do not recognise individual visitors (see “Reach measurement”). The typeface is served from our own server. Exactly one third-party service is embedded — the map on the location page — and it only loads when you explicitly ask for it; if you load it, Google can recognise you.

Server log files

When you open the site, our hosting provider processes technically necessary access data: IP address, date and time, the address requested, the volume of data transferred, the retrieval status and the browser identification.

The legal basis is Art. 6 (1) (f) GDPR. Our legitimate interest is the secure and uninterrupted operation of the website and the prevention and investigation of attacks. Access logs are rotated daily and automatically deleted after seven days.

Reach measurement

We want to know which of our pages are read and by which route enquirers find us. For that, your browser reports two details to our own address on this domain on every page view: the page you opened and the address you came from. On the first view that is the page you came from; on every further view it is merely our own address. We ask for nothing more — no identifier, no cookie, no fingerprint. Technically, as with every request on the internet, your browser also transmits your IP address and your browser identification; what happens with those is set out further down in this section.

No analytics service is involved; your browser opens no connection to a third-party server for this. Our server passes the two details on to our own customer portal; only there are they coarsened, before anything is counted. Also passed on are the browser identification your browser sends anyway and the address of this website, so that the figures are attributed to the right site. Your IP address is not among them: the report does not travel from your device to the portal but from our server, and the portal sees only that server as the sender. At the portal the browser identification serves solely to separate search engine robots from real page views; it is checked and not stored.

The address opened is matched against a fixed list of the twelve public addresses of this website — six pages in a German and an English version, counted separately; which version you read therefore remains in the figure. Query strings and anchors are cut off beforehand, and anything not on the list counts as “other page” in the respective language.

The origin is reduced to one of five classes: opened directly, from another page of this website, from our main site casa del dessert, from a search engine, or other. The full referring address is never stored; for the classification only its host name is looked at, and only for a moment.

What is stored is not one entry per visit but a daily counter. The table has five columns — day, which of our two websites, page, origin class and the number of views. For each day, each page and each origin class there is exactly one row; every further page view only increases the number in it. There is no column for IP address, cookie, identifier, session, browser identification, fingerprint or the time of an individual page view — there was a column holding the time the row was last changed, and we removed it, because in a row holding the value one it would have held the time of that single page view. The day is stamped by our own systems in Central European Time; no value from your device is used for it.

That is the difference between counting and watching, and it can be verified: whether a page was opened once each by ten different people on a given day, or ten times by you, is not recorded in that row — both produce the same number. We could not trace your path through the website from it, nor connect your next visit to this one; not because we would not want to, but because the row holds nothing to anchor that to. What is held for seven days in the access logs is described above under “Server log files” and is unaffected by this.

While counting, we briefly use your IP address as the key of an abuse brake, so that nobody can inflate the figures artificially — at most thirty reports per address within one minute and forty in total. It is held in memory only, is not written to any storage medium, does not enter the statistics and is not passed on to the portal; the clean-up removes it at most two minutes after your last page view, and at the latest when the service is next restarted. Like any other access, the report also appears in the access logs described above under “Server log files”, which are deleted after seven days — your IP address is held there for that time.

The legal basis is Art. 6 (1) (f) GDPR. Our legitimate interest is to see which content of this website is needed and by which route enquirers reach us, in order to improve the site; without these figures we simply would not know. In our view your interests do not override this, because the stored figures contain no feature pointing to you, no profiles arise, and we can neither recognise nor contact you.

We do not obtain consent for this, and we state the facts on which we base that. § 25 (1) TDDDG requires consent for storing information on your device and for accessing information already stored there. Nothing is stored here — no cookie, no entry in local storage, session storage, a browser database or the cache. What is read is only what the page currently displayed knows about itself anyway: its own address and the address from which you opened it — the latter your browser transmits on a page view even without any action by us. Whether this reading already amounts to access to information in your terminal equipment within the meaning of that provision is assessed differently and has not been settled conclusively. On balance we consider the measurement exempt from consent; that is also why it does not appear in the consent window — that window covers only what must not run at all without your agreement, namely the map. Conversely this means: if you choose “Reject all” there, that concerns the map; it does not change this counting.

The figures are evaluated in our own customer portal, and only accounts with administrator rights can view them there — and even then only as totals: the overall figure for the period, the daily values, the twenty most-viewed pages and the distribution across the five origin classes. There is no query down to an individual visitor. The portal is operated by the same casa del dessert GmbH, with the same address and the same commercial register number (Stuttgart Local Court HRB 207113); that is not a different controller and therefore not a recipient within the meaning of Art. 4 (9) GDPR. Which service providers operate servers for us is set out under “Recipients of your data”.

Retention: there is no deletion period for these daily figures; they are meant to remain comparable as a time series over years. That presupposes that they contain no reference to a person — which, after what is described above, is what we assume. Should that change, we will delete the stock rather than adjust the reasoning.

You may nevertheless object to the processing, informally to info@casadeldessert.de — what we then do, and where such an objection meets a technical limit, is set out in full under “Right to object” at the end of this notice. You can also prevent the report on your own device: it is triggered by a small script that does not run without JavaScript, and a content blocker that rejects requests to /api/beacon has the same effect. The texts of this site remain readable that way; the enquiry form, the map and the consent window do, however, need JavaScript.

Your enquiry via the form

We process the details you enter: company, contact person and email address as required fields, plus — optionally — phone, number of pallets, desired period, temperature requirement, type of goods and your message.

The purpose is to handle your enquiry and prepare a possible contract — Art. 6 (1) (b) GDPR. For follow-up questions and business correspondence we additionally rely on Art. 6 (1) (f) GDPR; our legitimate interest is answering business enquiries.

Required are company, contact person, email address and your confirmation that you have read this notice. These details are neither a statutory nor a contractual obligation. Without them, however, we cannot handle your enquiry — no further disadvantage arises for you (Art. 13 (2) (e) GDPR).

When you submit the form we also briefly process your IP address in order to limit abuse (at most five enquiries per address within ten minutes). The legal basis is Art. 6 (1) (f) GDPR; our legitimate interest is protection against automated bulk sending. For this check the address is held in memory only and goes into neither a file nor a database; the clean-up removes it at most twenty minutes after your last enquiry, and at the latest when the service is next restarted. Like any other access, the act of sending additionally appears in the access logs described above under “Server log files”, which are deleted after seven days.

Retention: enquiries that do not lead to business are deleted no later than six months after the last correspondence. If a business relationship arises, the statutory retention periods apply: ten years for commercial books, annual accounts and invoices (§ 257 (4) HGB, § 147 (3) AO), eight years for accounting vouchers, six years for commercial letters received and sent.

Recipients of your data

This website runs on a server operated by ZAP-Hosting GmbH, Hafenweg 8, 48155 Münster, Germany; a data processing agreement pursuant to Art. 28 GDPR is in place with ZAP-Hosting. The enquiry email is sent on our behalf by Resend, operated by Plus Five Five, Inc., 2261 Market Street #5039, San Francisco, CA 94114, USA, which in turn uses the Amazon Simple Email Service. There, the Art. 28 GDPR processing agreement forms part of the contractual terms; for the transfer to the USA this involves, the company is certified under the EU-US Data Privacy Framework, and the standard contractual clauses under Art. 46 (2) (c) GDPR apply in addition.

Your enquiry goes into our own customer portal, where we handle it; it is operated by the same casa del dessert GmbH, at the same address and under the same commercial register number, and the same six-month period applies to the enquiry stored there. Every report of the reach measurement, from which the daily counter is built, goes to the same place (see “Reach measurement”). Only if the portal cannot be reached do we fall back on our email mailbox, which we operate via Google Workspace. The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland; it processes the mailbox contents as a processor on our behalf. This may involve a transfer to Google LLC in the USA, covered by the European Commission’s adequacy decision of 10 July 2023 (EU-US Data Privacy Framework) and, in addition, by standard contractual clauses under Art. 46 (2) (c) GDPR.

Beyond that we do not pass your details on — except to Google if you load the map (see below), and except where we are legally obliged to do so.

Consent and withdrawal

We ask where it actually matters: the map on the location page only loads once you allow it there — before your click, not a single request goes to Google. There is no consent banner on your first visit, because nothing on this site other than the map requires consent. The site is fully usable without consent and nothing depends on it. If you would rather decide item by item, “Consent in detail” opens an overview in which rejecting and accepting are offered side by side with equal weight.

Your decision is stored under the key “tk-consent” in your browser’s local storage — status, time and the version number of the list of choices, with no personal data. That number increases as soon as the list of services requiring consent changes; earlier decisions then expire and we ask again. It is only written once you have decided, never on a mere page view. This storage does not require consent under § 25 (2) no. 2 TDDDG, because your wish could not otherwise be honoured; it is never transmitted to us. After six months we ask again.

You may withdraw your consent at any time with effect for the future — via “Change consent” in the footer of every page, or by clearing your browser data. The map is then unloaded immediately. This does not affect the lawfulness of processing carried out before the withdrawal (Art. 7 (3) GDPR).

Google Maps on the location page

The map is only loaded once you have consented. Before that it is not even present in the page source — so not a single request goes to Google, no preview image and no connection warm-up.

After consent, your browser connects to Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Your IP address as well as device, browser and map usage data are transmitted in the process; Google may store and read information on your device. The sole purpose is to display our location.

The legal basis is your consent under Art. 6 (1) (a) GDPR and § 25 (1) TDDDG.

Google may transfer data to Google LLC in the USA. An adequacy decision of the European Commission of 10 July 2023 is in place for the USA (Implementing Decision (EU) 2023/1795, EU-US Data Privacy Framework); in addition, Google relies on standard contractual clauses under Art. 46 (2) (c) GDPR. For details see Google’s privacy notice at policies.google.com/privacy.

Without consent you see the postal address and a link to route planning at that spot — so you lose no information, only the embedded view.

Fonts

The Archivo typeface used here is served from our own server. No fonts and no other content are loaded from third-party servers when you open the site — the only exception is the map, and only after your consent. Conversely, on each page view your browser sends a short report to our own address, from which the count is built (see “Reach measurement”); that too goes to no third-party server.

Your rights

You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and objection (Art. 21). An informal message to info@casadeldessert.de is enough.

You also have the right to lodge a complaint with a supervisory authority — with the authority responsible for us as well as with the authority of your place of residence or work.

No automated decision-making

Automated decision-making, including profiling, within the meaning of Art. 22 GDPR does not take place.

Competent supervisory authority

Der Landesbeauftragte für den Datenschutz und die Informationsfreiheit Baden-Württemberg
Postfach 10 29 32, 70025 Stuttgart
Heilbronner Straße 35, 70191 Stuttgart
Phone 0711 615541-0, poststelle@lfdi.bwl.de