Status: August 2026

 

Website privacy policy and, at the same time, information for data subjects pursuant to Article 13 and Article 14 of the EU General Data Protection Regulation (GDPR).

 

This privacy policy provides you with an overview of the processing of your personal data in the context of the use of the offers and online services within the website on spanflug.de and all associated domains (the “Website”). It also informs you about your rights under the GDPR. Personal data is understood to be all information that makes it possible to identify you as a person.

Affected data: Personal data is only collected if you provide it to us yourself or if the data is technically required to be processed for the provision of our Website and services. Any processing of your personal data going beyond the scope of the statutory grounds for permission only takes place on the basis of your express consent.

 

There is no legal or contractual obligation to provide us with the personal data specified in this privacy policy, and you can generally use our Website without providing personal data. However, it may be necessary to provide personal data if you use certain functionalities of our Website or conclude a contract with us.

 

No automated decision-making (Art. 22 GDPR): Fully automated decision-making, including profiling, that produces legal effects concerning you or similarly significantly affects you does not take place.

General information on the use of cookies

 

Cookies can be used on our Website to provide content and functions. Cookies are small text files that are stored on your computer to recognise you. Details on the cookies used can be found below under the respective processing purposes.

 

We use transient cookies (which are deleted when you close your browser, e.g. session cookies) as well as persistent cookies (which are automatically deleted after a predefined period). Session cookies store a so-called session ID with which various requests from your browser can be allocated to the joint session.

 

Legal basis: The storage of information in the end user’s terminal equipment, or access to information already stored in the terminal equipment, takes place pursuant to Section 25 (1) TDDDG (German Telecommunications-Telemedia Data Protection Act) on the basis of your consent, unless the use of cookies is permitted under Section 25 (2) TDDDG (strictly necessary). The subsequent processing of personal data is governed by Art. 6 (1) (b) GDPR (performance of a contract) or Art. 6 (1) (f) GDPR (legitimate interest) for technically necessary cookies, and otherwise by Art. 6 (1) (a) GDPR (consent).

 

Withdrawal of consent: You can withdraw your consent at any time with effect for the future by calling up the cookie notice on our Website again (bottom left of the page) and changing your selection, or by sending an e-mail to info@spanflug.de. You can also delete cookies at any time via the security settings of your browser, or block them in principle. If you block them entirely, it may not be possible to use all functions of our Website.

 

Automatically collected usage data (server log files)

 

When you visit our Website, the following data is automatically transmitted to our web servers and stored in server log files:

• Date and time of the visit and duration of use
• IP address of your device
• Referral URL (the website from which you were referred)
• Sub-pages of the Website visited
• Device information (device type, browser type and version, operating system and any installed plug-ins)

 

Legal basis: Art. 6 (1) (f) GDPR. Our legitimate interest lies in ensuring IT security, the proper operation of the Website, performance analysis, error analysis and the prevention and detection of misuse. These server log files are deleted at regular intervals when the data is no longer required for the aforementioned purposes.

Cloudflare Turnstile

 

We use the Cloudflare Turnstile service from Cloudflare, Inc. (“Cloudflare”) on our Website to verify that entries on our Website (e.g. in forms) are made by a natural person. This serves to protect our Website from malicious automated access (bots). In doing so, technical information (e.g. IP address, browser and device information, time of access and interaction data) is processed. This data may also be stored in log files.

 

When this service is used, data may be transferred to Cloudflare servers in the USA as a third country. Cloudflare is certified under the EU-US Data Privacy Framework; in addition, EU Standard Contractual Clauses pursuant to Art. 46 (2) (c) GDPR are in place.

 

Legal basis: Art. 6 (1) (f) GDPR (legitimate interest in protection against misuse and bot attacks).

 

Newsletter

 

We process the data provided when subscribing to the newsletter (in particular your e-mail address) exclusively for sending the newsletter. Subscription takes place using the opt-in procedure. To document your consent, we store the time of subscription and confirmation as well as the IP address used.

 

You can unsubscribe from the newsletter at any time – either via the link provided for this purpose in each newsletter or by an informal message to info@spanflug.de. After you unsubscribe, we will delete your data unless you have expressly consented to the further use of your data.

 

Legal basis: Art. 6 (1) (a) GDPR (consent). We document the consent on the basis of Art. 6 (1) (f) GDPR.

 

Google Analytics

 

Our Website and application use – on the basis of your consent – Google Analytics, a service provided by Google Ireland Ltd. (Gordon House, Barrow Street, Dublin 4, Ireland; “Google Ireland”), a subsidiary of Google LLC (1600 Amphitheatre Parkway, Mountain View, CA 94043, USA). Google Analytics uses cookies and helps us to analyse user numbers and the behaviour of visitors to our Website.

 

The information generated by the cookie about your use of our Website (ID, browser type/version, operating system used, referrer URL, shortened IP address, time of the server request) is usually transmitted to a Google server in the USA and stored there. Before transmission, your IP address is shortened within the EU or the EEA through activation of IP masking. Only in exceptional cases is the full IP address transmitted to a server in the USA and shortened there.

 

Where data is transferred to the USA, EU Standard Contractual Clauses pursuant to Art. 46 (2) (c) GDPR are used; Google LLC is also certified under the EU-US Data Privacy Framework. The IP address transmitted as part of Google Analytics is not combined with other data held by Google.

 

Legal basis: Art. 6 (1) (a) GDPR in conjunction with Section 25 (1) TDDDG (consent). You can withdraw your consent at any time via our cookie notice.

 

Google Ads

 

We use Google Ads (Google Ireland Ltd.) to display advertisements in search engines and on third-party websites. We can analyse which search terms have led to the display of our advertisements and which advertisements are particularly effective.

 

On the basis of your consent, we also use the “Customer Match” function of Google Ads. Here, personal data (e.g. e-mail addresses) that you have previously provided to us is transmitted to Google in pseudonymised (hashed) form and matched there with existing Google user accounts. This allows personalised advertisements to be displayed in Google services (e.g. Google Search, YouTube, Gmail). It is not possible for third parties to identify individual persons. Data processing may also take place on servers in the USA; corresponding EU Standard Contractual Clauses or the EU-US Data Privacy Framework form the basis for the transfer.

 

Legal basis: Art. 6 (1) (a) GDPR in conjunction with Section 25 (1) TDDDG (consent).

 

Microsoft Advertising

 

We use Microsoft Advertising (Microsoft Ireland Operations Ltd., One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, Ireland) to display advertisements in search engines and on third-party websites. We can analyse which search terms have led to the display of our advertisements and which advertisements are particularly effective.

 

Legal basis: Art. 6 (1) (a) GDPR in conjunction with Section 25 (1) TDDDG (consent).

 

HubSpot

 

Our Website uses HubSpot, a service provided by HubSpot, Inc. (25 First Street, Cambridge, MA 02141, USA). In this context, we use the EU hosting option, where HubSpot processes personal data from the EU primarily within the EU (see

https://legal.hubspot.com/de/hubspot-regional-data-hosting-policy). Insofar as an additional transfer to the USA is required (e.g. support, sub-processors), this takes place on the basis of EU Standard Contractual Clauses pursuant to Art. 46 (2) (c) GDPR and under the EU-US Data Privacy Framework.

 

We use HubSpot for the following purposes:

• E-mail marketing (newsletters and automated mailings, e.g. to provide downloads)
• Social media publishing and reporting
• Web analytics reporting (traffic sources, accesses, etc.)
• Contact management (user segmentation and CRM)
• Creation and provision of contact forms

HubSpot has undertaken, within the framework of a data processing agreement (Art. 28 GDPR), to comply with appropriate technical and organisational measures and acts on our behalf in accordance with our instructions.

 

Legal basis: Art. 6 (1) (f) GDPR (legitimate interest in efficient marketing, CRM and reporting) or Art. 6 (1) (a) GDPR in conjunction with Section 25 (1) TDDDG (consent), insofar as cookies or comparable technologies are used.

 

Vimeo

 

On the basis of your consent, our Website embeds videos from Vimeo (operator: Vimeo Inc., 330 West 34th Street, 5th Floor, New York, New York 10001, USA). When you actively play an embedded video, data is transmitted to Vimeo. Vimeo is then informed which of our web pages you have visited, along with your IP address. If you are logged in to Vimeo, Vimeo can assign your surfing behaviour to your account; you can prevent this by logging out of Vimeo before visiting our Website.

 

We use Vimeo’s Do Not Track function, so that Vimeo does not set any cookies for analytics or advertising purposes.

 

Data may be transferred to the USA. This takes place on the basis of the EU-US Data Privacy Framework or the EU Standard Contractual Clauses. Further information can be found at https://vimeo.com/privacy

 

Legal basis: Art. 6 (1) (a) GDPR in conjunction with Section 25 (1) TDDDG (consent).

 

Hotjar

 

On the basis of your consent, we use the web analytics service of Hotjar Ltd. (Level 2, St Julian’s Business Centre, 3, Elia Zammit Street, St Julian’s STJ 1000, Malta; “Hotjar”). Hotjar uses cookies and comparable technologies to analyse the behaviour of visitors to our Website, to create so-called heatmaps and to evaluate individual sessions (click and scroll behaviour).

 

For this purpose, Hotjar processes information such as device and browser information, geographic location (at country level), preferred language, IP address (in anonymised form), mouse movements, mouse clicks, scrolling behaviour and keyboard inputs (unless in form fields with excluded data). This does not make it possible to identify you. Hotjar also offers an opt-out option at

https://www.hotjar.com/legal/compliance/opt-out

 

Hotjar has undertaken, within the framework of a data processing agreement (Art. 28 GDPR), to comply with appropriate technical and organisational measures.

 

Legal basis: Art. 6 (1) (a) GDPR in conjunction with Section 25 (1) TDDDG (consent). You can withdraw your consent at any time via our cookie notice.

Payment (Stripe Checkout)

 

For processing online payments, we use the payment service provider Stripe in our web application. The controller for the data processing in connection with the payment transaction in respect of users from the EEA is Stripe Payments Europe Limited, 1 Grand Canal Street Lower, Grand Canal Dock, Dublin, Ireland (parent company: Stripe, Inc., 354 Oyster Point Boulevard, South San Francisco, CA 94080, USA).

 

Responsibility: Stripe is the independent controller for the processing of your payment data within the meaning of Art. 4 No. 7 GDPR. Stripe decides independently on the purposes and means of processing – in particular to fulfil its own regulatory obligations (e.g. anti-money laundering, fraud prevention, financial supervisory law). To this extent, there is no processing on our behalf within the meaning of Art. 28 GDPR. Information on data processing by Stripe can be found in Stripe’s privacy policy at https://stripe.com/de/privacy.

 

Legal basis: Art. 6 (1) (b) GDPR (performance of a contract) for the status information that we receive from Stripe and that is required to process your order.

You can exercise the following rights under the GDPR in relation to your personal data:

• your right to information or access pursuant to Art. 15 GDPR
• your right to rectification pursuant to Art. 16 GDPR
• your right to erasure pursuant to Art. 17 GDPR
• your right to restriction of processing pursuant to Art. 18 GDPR
• your right to data portability pursuant to Art. 20 GDPR
• your right to object to processing pursuant to Art. 21 GDPR (no specific form required)
• your right to withdraw a given consent with effect for the future pursuant to Art. 7 (3) GDPR – the lawfulness of processing carried out up to the withdrawal remains unaffected.

Withdrawal of consent: Insofar as the processing is based on consent, you can withdraw it at any time – e.g. by calling up our cookie notice again (bottom left of the page) or by an informal message to info@spanflug.de.

 

For all data protection inquiries, please contact us by e-mail at info@spanflug.de, or at the contact address of the controller given above, or our external Data Protection Officer.

 

Right to lodge a complaint with the supervisory authority: You also have the right to lodge complaints with the data protection supervisory authority responsible for us: Bayerisches Landesamt für Datenschutzaufsicht (BayLDA), Promenade 18, 91522 Ansbach, https://www.lda.bayern.de.

This privacy policy is updated regularly in order to keep it up to date. Please check at regular intervals for any changes.

 

 

© 2018 – 2026 Spanflug Technologies GmbH