Privacy Policy

1. Controller

The controller within the meaning of the General Data Protection Regulation (GDPR) and other national data protection laws as well as other data protection provisions is:

Verein zur Vermittlung hauswirtschaftlicher Dienstleistungen Mühldorf-Altötting n. e. V. (Association for the Placement of Household Services Mühldorf-Altötting)
Kirchstraße 16, 84431 Heldenstein
Email: info@hwf-ma.de
Phone: +49 8636 698119

2. Data Protection Officer

The appointment of a data protection officer is not legally required, as fewer than 20 persons are constantly engaged in the automated processing of personal data in our association (§ 38(1) BDSG). If you have any questions regarding data protection, please contact the responsible party mentioned above at info@hwf-ma.de.

3. Overview of Data Processing

In the course of operating this website, we process personal data for the following purposes: provision of the website and ensuring its functionality (server log files), processing of contact inquiries and applications via forms, analysis of website usage with Google Analytics (only with consent), and use of licensed image sources from Unsplash that are optimized during the build and served from our own website. On the service-area page, we also provide an optional external link to Google Maps which only establishes a connection to Google after you actively click it. A detailed description of each processing activity can be found in the following sections.

4. Legal Bases

Where we obtain consent for the processing of personal data, Art. 6(1)(a) GDPR serves as the legal basis. For processing necessary for the performance of a contract or pre-contractual measures, Art. 6(1)(b) GDPR serves as the legal basis. Where processing is necessary for the purposes of our legitimate interests and your interests, fundamental rights and freedoms do not override, Art. 6(1)(f) GDPR serves as the legal basis.

5. Hosting

This website is hosted by STRATO GmbH, Otto-Ostrowski-Straße 7, 10249 Berlin, Germany; the server is located in Germany. A data processing agreement (DPA) pursuant to Art. 28 GDPR has been concluded with the hosting provider, ensuring that data collected via this website is processed on a strictly instructed and data-protection-compliant basis.

6. Server Log Files

The hosting provider of this website automatically collects and stores information in so-called server log files, which your browser automatically transmits. These are: browser type and version, operating system used, referrer URL, hostname of the accessing computer, time of the server request, IP address. This data is not merged with other data sources. The collection of this data is based on Art. 6(1)(f) GDPR. The website operator has a legitimate interest in the technically error-free presentation and optimization of their website. IP addresses in our application-level API log are pseudonymized before storage (SHA-256 with a non-public key), so the original IP cannot be reconstructed from the log contents alone. Server log files are automatically deleted after 14 days.

7. Cookies and Cookie Consent

Our website uses cookies. Cookies are small text files stored on your device. We use a cookie consent tool (vanilla-cookieconsent) that operates in opt-in mode. This means that cookies beyond technically necessary ones are only set when you actively consent. The following cookie categories are used: Necessary cookies (cc_cookie) — These are required for the cookie banner functionality and cannot be disabled. Analytics cookies (_ga, _ga_<MEASUREMENT_ID>, _gid, _gat) — These are only set with your consent and are used for website analysis via Google Analytics. The legal basis for necessary cookies is Art. 6(1)(f) GDPR (legitimate interest). The legal basis for analytics cookies is Art. 6(1)(a) GDPR (consent). You can change your cookie settings at any time via the 'Cookie Settings' link in the website footer.

8. Google Analytics

This website uses Google Analytics, a web analytics service provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (parent company: Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA). We use the measurement ID G-9DL95YCWFW. Google Analytics uses cookies that enable analysis of your use of the website. Usage occurs exclusively with your consent (opt-in via our cookie banner). We use Google Consent Mode v2, so that Google Analytics only collects data once you have consented to analytical cookies. IP anonymization is enabled by default in Google Analytics 4; according to Google, IP addresses are not logged or stored. The legal basis is Art. 6(1)(a) GDPR (consent). You can revoke your consent at any time via the cookie settings. Upon revocation, the analytics cookies (_ga, _ga_<MEASUREMENT_ID>, _gid, _gat) are automatically deleted. Google is certified under the EU-US Data Privacy Framework, ensuring an adequate level of data protection for data transfers to the USA. For more information, see Google's privacy policy at https://policies.google.com/privacy.

9. Contact Form

When you contact us via the contact form, the following data is collected: name, email address, phone number, city, type of inquiry, subject, desired timeframe (optional), message. This data is processed for the purpose of handling your inquiry. The legal basis is Art. 6(1)(b) GDPR (pre-contractual measures) or Art. 6(1)(f) GDPR (legitimate interest in processing inquiries). Emails are sent via our own mail server using SMTP. To protect against abuse, we use a honeypot field that does not process any personal data, as well as rate limiting (max. 5 requests per minute per IP address). Your IP address is temporarily stored in the server's memory and discarded after at most 60 seconds. Additionally, we use ALTCHA, a self-hosted proof-of-work method to protect against automated spam. No cookies are set and no personal data is transmitted to third parties. Processing takes place exclusively on our server. Your data will be deleted after your inquiry has been fully processed, unless statutory retention obligations apply, but no later than 6 months.

10. Application Form

You can apply to us via our application form. The following data is collected: name, email address, phone number (optional), message, and — if you upload it — your CV/résumé as a PDF file (max. 5 MB). Processing is carried out for the purpose of conducting the application process. The legal basis is Art. 6(1)(b) GDPR (pre-contractual measures to initiate a placement or contractual relationship); as the advertised activity is performed on a self-employed contractual basis, no employment relationship arises, so § 26 BDSG (German Federal Data Protection Act) does not apply. Emails are sent via our own mail server using SMTP; an uploaded CV/résumé is transmitted as an email attachment and is not permanently stored on the web server. The same protective measures as for the contact form apply (honeypot, rate limiting, ALTCHA proof-of-work). In the event of a rejection, your application data will be deleted no later than 6 months after the conclusion of the application process, unless further legitimate interests prevent deletion.

11. Submission Backup (SMTP Failure Safety Net)

To prevent data loss in the event of a temporary outage of our mail server, form submissions from the contact and application forms are additionally stored in a backup file on our server. The backup is created regardless of whether the email was transmitted successfully — it ensures that your inquiry is not lost even if SMTP fails. The following data is stored: timestamp of the submission, the form endpoint addressed, your IP address, the status of the mail transmission (sent / failed), and the contents of the form fields you submitted (name, email address, phone number, city where applicable, message). For applications, only the file name of any uploaded CV is stored, not the file itself. The backup file is located outside the publicly accessible web area and cannot be accessed via the internet. The legal basis is Art. 6(1)(f) GDPR (legitimate interest in the reliable delivery and processing of your inquiries). Entries are automatically deleted no later than 90 days after submission (monthly rotation with irreversible deletion of archived logs).

12. External Content and External Links

We use photos licensed from Unsplash (Unsplash Inc., 500-460 Sainte-Catherine Street West, Montreal, QC H3B 1A7, Canada) on this website. The image files embedded on the pages are technically optimized during the build and then served from our own web server. Simply opening a page therefore does not cause your browser to establish a direct connection to Unsplash. Unsplash is named here solely as the source and licensor of the photos. In addition, on the service-area page we provide an optional external link to Google Maps (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland; parent company: Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA). This link is not loaded automatically. Only when you click it does your browser establish a connection to Google and transmit, in particular, your IP address and technically required metadata. The legal basis for presenting the link and using licensed image sources is Art. 6(1)(f) GDPR (legitimate interest in a comprehensible presentation of our services and service area). For more information, see Unsplash's privacy policy at https://unsplash.com/privacy and Google's privacy policy at https://policies.google.com/privacy.

13. SSL/TLS Encryption

This website uses SSL or TLS encryption for security reasons and to protect the transmission of confidential content, such as inquiries you send to us as the site operator. You can recognize an encrypted connection by the browser's address bar changing from 'http://' to 'https://' and by the lock icon in your browser bar.

14. Data Retention and Deletion

We store personal data only as long as necessary for the respective processing purpose or as required by statutory retention obligations. The following retention periods apply: Server log files: 14 days. Contact inquiries: 6 months after completion of processing. Applications: 6 months after conclusion of the application process. Submission backup: 90 days. Cookie consent (cc_cookie): 182 days. Google Analytics cookies: Until revocation of consent, maximum 14 months. After the respective period expires, data is routinely deleted.

15. Your Rights as a Data Subject

You have the following rights with regard to your personal data vis-à-vis the controller:

• Right of access (Art. 15 GDPR) — You may request information about the personal data we process about you.
• Right to rectification (Art. 16 GDPR) — You may request the correction of inaccurate data or the completion of your data.
• Right to erasure (Art. 17 GDPR) — You may request the deletion of your data, provided no statutory retention obligations apply.
• Right to restriction of processing (Art. 18 GDPR) — Under certain conditions, you may request the restriction of processing of your data.
• Right to data portability (Art. 20 GDPR) — You may request to receive the data you have provided to us in a structured, commonly used and machine-readable format.
• Right to object (Art. 21 GDPR) — You may object to the processing of your data at any time if the processing is based on Art. 6(1)(f) GDPR.

To exercise your rights, please contact the responsible party mentioned above.

16. Right to Withdraw Consent (Art. 7(3) GDPR)

Where processing is based on your consent, you have the right to withdraw that consent at any time. The lawfulness of the processing carried out on the basis of the consent until the withdrawal remains unaffected. For cookie consents, you can withdraw via the cookie settings in the footer.

17. Right to Object (Art. 21 GDPR)

If your personal data is processed on the basis of legitimate interests pursuant to Art. 6(1)(f) GDPR, you have the right to object to the processing of your personal data pursuant to Art. 21 GDPR, insofar as there are grounds relating to your particular situation. We will then no longer process the personal data unless we can demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms, or the processing serves the establishment, exercise or defense of legal claims.

18. Right to Lodge a Complaint with a Supervisory Authority

You have the right to lodge a complaint with a data protection supervisory authority regarding the processing of your personal data pursuant to Art. 77 GDPR. The supervisory authority responsible for us is: Bavarian State Office for Data Protection Supervision (BayLDA), Promenade 18, 91522 Ansbach, Germany, Phone: +49 (0) 981 180093-0, Email: poststelle@lda.bayern.de, Website: https://www.lda.bayern.de.

19. Changes to This Privacy Policy

We reserve the right to adapt this privacy policy to ensure it always complies with current legal requirements or to implement changes to our services. The new privacy policy will apply to your next visit.