Controller

No data protection officer has been appointed: we do not permanently employ at least 20 people on the automated processing of personal data (§ 38 (1) BDSG), and the conditions of Art. 37 (1) GDPR are not met either.

What data do we collect?

When visiting the website

When this website is accessed, our hosting provider Raidboxes GmbH (Hafenstraße 32, 48153 Münster) automatically records technical access data in server log files: full IP address, time of access, page accessed, referrer URL and the browser identifier (user agent), from which browser and operating system can be derived. These log files are deleted automatically after 7 days. The legal basis is Art. 6 (1) (f) GDPR (legitimate interest in the secure and functional operation of the website). A data processing agreement pursuant to Art. 28 GDPR is in place with Raidboxes. According to Raidboxes, the server location is Germany. Raidboxes uses sub-processors; the current list is provided by Raidboxes under the data processing agreement.

Fonts

The fonts used on this website (Google Fonts) are stored and delivered locally on our own server. No connection to Google servers takes place and no data is transmitted to Google.

Light or dark appearance

On our website you can switch between a light and a dark presentation. We remember your choice in the local storage of your browser, so that the page looks the way you set it on your next visit. This entry contains nothing but the information “light” or “dark”, does not leave your browser and is not read out by us. The legal basis is § 25 (2) no. 2 TDDDG, as you request this function yourself and expressly.

Newsletter sign-up form

The sign-up form for our newsletter is embedded technically via our service provider Brevo. This form only loads after you have consented to the use of non-essential content via our cookie banner — without this consent no connection to Brevo is established and no data is transmitted. If you consent, your browser transmits technical data (including your IP address) to Brevo when the form loads.

When you sign up, the form transmits your email address to Brevo. Stored there is when the contact was created and whether you confirmed the sign-up via the confirmation link (double opt-in) — this allows us to demonstrate your consent. Providing your email address is voluntary but a prerequisite for receiving the newsletter. No further form fields and no open or click tracking of the newsletter emails are used. Brevo logs technical dispatch events (delivery, non-delivery, unsubscribe, spam complaints) so that we can ensure delivery; the legal basis is Art. 6 (1) (f) GDPR.

Order, payment processing and access code (support contribution)

If you pay a support contribution (early adopter contribution) via the support button, we process additional data for this. When you order we collect your email address, the contribution you chose, the resulting number of prepaid months and the resulting permanent monthly price, the access code assigned to you, your customer account data including a user ID for unambiguous assignment, a marker indicating whether it is a purchase for yourself or a gift, and the order number and date.

If you mark your order as a gift, we additionally collect the email address of the person receiving the gift, to whom we send the access code; you as the paying person still receive the invoice. You remain the sole contracting party of the support contribution (§ 328 BGB). If the person receiving the gift creates their own customer account to redeem the code, we process the same data set as for an account from a purchase for oneself; the separate Right of Withdrawal and pre-contractual information in Part Happly to this, as a separate contract is concluded between us and the person receiving the gift.

This data is stored in our shop system (WooCommerce with the Germanized plugin), which runs as a WordPress plugin on the same Raidboxes instance as the website — no separate hosting location.

The payment is processed by the payment service provider Mollie (Mollie B.V., Keizersgracht 126, 1015 CW Amsterdam, Netherlands). In doing so Mollie processes your payment data (name, address, payment data, order amount and — if provided — your telephone number and, depending on the payment method chosen, logistics data) as a data controller in its own right, not as our processor — in particular for its own purposes such as fraud prevention and fulfilling its own statutory obligations. According to Mollie the processing takes place within the European Economic Area; no transfer to third countries takes place. You can find information on data processing by Mollie in Mollie's own privacy policy at https://www.mollie.com/de/legal/privacy.

The legal basis for our processing of your order and payment data is the performance of the contract concluded with you (Art. 6 (1) (b) GDPR) and our commercial and tax retention obligations (Art. 6 (1) (c) GDPR).

The access code assigned to you is stored linked to your customer account until you have redeemed your consideration or your claim becomes time-barred. We also send you an order confirmation with the applicable GTC and the Right of Withdrawal as a PDF attachment.

If you use the electronic withdrawal function (§ 356a BGB, see Right of Withdrawal), we process the data provided for it (name, contract identifier, contact address) as well as the date and time of receipt, in order to send you an automated acknowledgement of receipt. The legal basis for this is our statutory obligation under § 356a BGB (Art. 6 (1) (c) GDPR) and the performance of the contract (Art. 6 (1) (b) GDPR).

Registering an account without a purchase

You can also register on the website without paying a support contribution. In doing so we collect your email address, your password and your user name. The registration is confirmed by double opt-in: you receive an email with a confirmation link, and the registration only takes effect when you click it. This account also receives a user ID for unambiguous assignment (as with a customer account from a purchase).

An account registered in this way currently offers no function of its own beyond the mere registration; it is being prepared for a later purchase or for the shop/app launch. The legal basis and consumer protection rights for this registration — including the Right of Withdrawal — follow from Part I: as a precaution we treat this account as a separate contract about digital content (§ 327 (3) BGB).

Voluntary mention as a supporter

You can optionally agree via a checkbox to be named with your name in our public supporter list on the website. Only your name is published; your user ID is never shown publicly, but only internally in your own account profile.

The legal basis is your consent (Art. 6 (1) (a) GDPR). You can revoke it at any time with effect for the future; your name will then be removed from the list. The revocation does not affect the lawfulness of the publication carried out up to that point.

Contacting us by email or telephone

If you contact us by email or telephone, we process the data arising from this (email address or telephone number, the content of your enquiry) solely in order to deal with your request. The legal basis is Art. 6 (1) (f) GDPR (legitimate interest in responding), and for contract-related enquiries Art. 6 (1) (b) GDPR. We delete this data as soon as your enquiry has been dealt with conclusively. Business correspondence subject to commercial or tax retention obligations is kept for the statutory period: commercial letters six years, accounting documents eight years (§ 257 (4) HGB, § 147 (3) AO).

Analysis and reach measurement

We do not use any tools to analyse your usage behaviour and no advertising or reach trackers (for example Google Analytics, Meta Pixel); this also applies to the ordering path. Our newsletters also contain no open or click tracking. For the pre-sale a deliberately data-minimising, aggregated count without personal reference is planned, not individual tracking.

No advertising, no data trading, no commissions on trades. Data is collected and processed solely to improve the platform, and never passed on to third parties (except where strictly necessary for technical reasons).

What do we use your data for?

For the secure operation of the website, the display of the newsletter sign-up form, sending information about the progress and news of h_OURs, dealing with your enquiries, demonstrating the consents given, permanently observing unsubscribes and processing your order and the associated payment, if you pay a support contribution. We do not sell your data and do not pass it on for advertising purposes. Recipients are the processors named below, who process your data only on our instructions, and the sub-processors they engage, and in the case of payment processing also the payment service provider Mollie as a controller in its own right (see below). Beyond that we only pass on data where we are legally obliged to do so.

Cookies and local storage

Without your consent we do not set any cookies that are not technically necessary. As soon as you have made a choice in the consent banner — agreement or refusal — we store that decision in a technically necessary cookie (name: real_cookie_banner-*, storage period: 1 year). Under § 25 (2) no. 2 TDDDG no consent is required for this. Further cookies of our content management system only arise for logged-in editors and do not concern visitors to this website. Non-essential content — namely the Brevo newsletter form — is only loaded after your consent via our cookie banner. You can revoke your consent at any time with effect for the future (Art. 7 (3) GDPR). A click on “Cookie settings” in the footer of this website is enough. The revocation does not affect the lawfulness of the processing carried out up to that point.

In addition, our shop system (WooCommerce) stores technically necessary details for the cart and the ordering process — a session identifier and the contents of your cart — as soon as you put something in the cart. These details are required for the ordering process you requested (§ 25 (2) no. 2 TDDDG) and are stored partly as a cookie, partly in the local storage of your browser. Your setting for the light or dark appearance is also held in local storage (hours-farbe, see above). You will find the current full overview in our cookie banner under “Cookie settings”. Our payment service provider Mollie sets no cookies of its own on the payment page.

Processors and recipients

• Raidboxes GmbH, Hafenstraße 32, 48153 Münster (web hosting and email accounts). A data processing agreement pursuant to Art. 28 GDPR is in place.

• Brevo GmbH, Köpenicker Str. 126, 10179 Berlin (email dispatch and form embedding). The processing arrangement forms part of Brevo's terms of use (Data Processing Agreement). According to Brevo, the primary data processing takes place on servers in the EU; where further service providers are used (among others for hosting/infrastructure and support), transfers to the USA and to India may occur. For the USA the transfer relies on the certification of Sendinblue, Inc. (dba Brevo USA) under the EU-U.S. Data Privacy Framework, for which the EU Commission established an adequate level of protection by decision of 10 July 2023. In addition, according to Brevo, the EU Commission's standard contractual clauses apply to this transfer and to transfers to countries without an adequacy decision — in particular India. You can obtain a copy of the safeguards on request at datenschutz@h-oursapp.com.

In addition we use Mollie (Mollie B.V., Keizersgracht 126, 1015 CW Amsterdam, Netherlands) for payment processing. Towards us Mollie is not a processor, but a data controller in its own right for the data it processes for its own purposes. A data processing agreement under Art. 28 GDPR is not the right instrument for this; the reference to Mollie's own privacy policy stands.

Legal bases

• Website visit (log files): Art. 6 (1) (f) GDPR (legitimate interest)
• Loading the newsletter form: Art. 6 (1) (a) GDPR / § 25 (1) TDDDG (consent via the cookie banner)
• Newsletter sign-up and dispatch: Art. 6 (1) (a) GDPR (consent)
• Retention of unsubscribed contacts on the suppression list: Art. 6 (1) (f) GDPR (legitimate interest in permanently observing and being able to demonstrate your unsubscribe)
• Technically necessary cookies and storage entries, including the setting for light or dark appearance: § 25 (2) no. 2 TDDDG (no consent required) in conjunction with Art. 6 (1) (f) GDPR (functional provision of the website)
• Demonstrating newsletter consent (double opt-in status and date the contact was created): Art. 6 (1) (f) GDPR (legitimate interest in demonstrating consent, Art. 7 (1) GDPR)
• Logging technical dispatch events when sending the newsletter: Art. 6 (1) (f) GDPR (legitimate interest in reliable delivery)
• Dealing with enquiries by email or telephone: Art. 6 (1) (f) GDPR, and for contract-related enquiries Art. 6 (1) (b) GDPR
• Order, payment processing, access code: Art. 6 (1) (b) GDPR (performance of a contract), Art. 6 (1) (c) GDPR (commercial and tax retention obligations)
• Electronic withdrawal function (§ 356a BGB): Art. 6 (1) (c) GDPR (legal obligation), Art. 6 (1) (b) GDPR (performance of the contract)
• Voluntary mention as a supporter: Art. 6 (1) (a) GDPR (consent)

Retention periods

• Server log files: 7 days
• Consent cookie: 1 year
• Setting for light or dark appearance: until you clear your browser storage
• Newsletter: your email address on the distribution list until you unsubscribe. If you do not confirm the sign-up, we delete the record after 30 days.
• Suppression list entry at Brevo (only your email address is stored): for as long as we operate the newsletter. If you object to this storage as well, we delete the entry; we can then no longer technically prevent renewed contact.
• Demonstrating consent (date the contact was created and double opt-in status): three years from the end of the year in which you unsubscribed, based on the limitation periods of §§ 195, 199 BGB
• Enquiries by email or telephone: until conclusively dealt with; commercial letters six years, accounting documents eight years (§ 257 (4) HGB, § 147 (3) AO)
• Technical logs arising at Brevo (access data when the form is loaded, dispatch events): 6 months
• Order and invoice data: 7 years
• Access code: until the consideration is redeemed or until your claim becomes time-barred by law
• Voluntary mention as a supporter: until you revoke it
• Acknowledgement of receipt for the electronic withdrawal function: three years from the end of the year of receipt, based on the limitation periods of §§ 195, 199 BGB

Your rights

You have the right to information (Art. 15 GDPR), rectification (Art. 16 GDPR), erasure (Art. 17 GDPR), restriction of processing (Art. 18 GDPR), data portability (Art. 20 GDPR) and objection (Art. 21 GDPR), where the respective legal conditions are met. You can revoke consent you have given at any time (Art. 7 (3) GDPR). The revocation does not affect the lawfulness of the processing carried out up to that point. An email to datenschutz@h-oursapp.com is enough to exercise these rights. Beyond that you can lodge a complaint with any data protection supervisory authority (Art. 77 (1) GDPR), in particular the authority of your place of residence, your workplace or the place of the alleged infringement. The authority responsible for us is: Der Landesbeauftragte für Datenschutz und Informationsfreiheit Mecklenburg-Vorpommern, Werderstraße 74a, 19055 Schwerin, www.datenschutz-mv.de.

Right to object to processing based on legitimate interests

Where we process your data on the basis of Art. 6 (1) (f) GDPR — this concerns the server log files, the consent cookie, the suppression list entry after an unsubscribe, dealing with enquiries by email or telephone, demonstrating the consents given and logging technical dispatch events — you have the right to object to this processing at any time on grounds relating to your particular situation. An email to datenschutz@h-oursapp.com is enough. We will then stop processing the data concerned unless we can demonstrate compelling legitimate grounds that override your interests, rights and freedoms, or the processing serves to assert, exercise or defend legal claims.

Unsubscribing from the newsletter

You can unsubscribe at any time via the unsubscribe link in every email or by email to datenschutz@h-oursapp.com. After unsubscribing, your email address remains on a suppression list at Brevo so that you receive no further newsletters from us and we can demonstrate your unsubscribe. Only the email address is stored there; if you object to this storage as well, we delete the entry.

Automated decision-making

No automated decision-making, including profiling within the meaning of Art. 22 GDPR, takes place.

How current this privacy policy is

This privacy policy replaces version 1.1 and bears version 2.0 as of 17.09.2026. If we change our offering or the services we use, we will adapt it. You can always find the current version at h-oursapp.com/datenschutz.