PRIVACY STATEMENT

Stephan Schoen (the ‘controller' or ‘I' or ‘me'), as the operator of the internet presence https://stephan-schoen.com/ (my ‘Website”), is pleased to have you visit my Website. In the following, I will inform you about the processing of personal data during the use of my Website.

I. Definitions

My privacy statement uses terms that are defined in the EU General Data Protection Regulation (‘GDPR’). I would like to clarify these terms as follows, so that the privacy statement is drafted in a readable and understandable manner:

(1) Personal data

Under the GDPR, ‘personal data’ means any information relating to an identified or identifiable natural person. This means information such as, e.g., your name, your date of birth, your address, your e-mail address, your IP address or your telephone number, and your user behavior. Conversely, information not directly associated with your actual identity – e.g., generally preferred websites of all users or the number of users of a site – is not designated as personal data.

(2) Data subject

The ‘data subject’ is each identified or identifiable natural person whose personal data are being processed by the controller for the processing.

(3) Processing

‘Processing’ is any operation or set of operations performed on personal data or on sets of personal data, whether or not by automated means, such as the collection, recording, organization, structuring, storage, adaption or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure, or destruction.

(4) Restriction of processing

‘Restriction of processing’ means the marking of stored personal data with the aim of limiting the processing thereof in the future;

(5) Controller or controller for the processing

‘Controller’ or ‘controller for the processing’ means the natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of the processing of personal data. If the purposes and means of such processing are determined by Union or Member State law, then the controller or the specific criteria for its nomination may be provided for by Union or Member State law.

(6) Processor

‘Processor’ means a natural or legal person, public authority, agency, or other body, which processes data on behalf of the controller.

(7) Recipient

‘Recipient’ means a natural or legal person, public authority, agency, or another body, to which the personal data are disclosed, whether a third party or not. However, public authorities which may receive personal data in the framework of a particular inquiry in accordance with Union or Member State law shall not be regarded as recipients.

(8) Third party

‘Third party’ means a natural or legal person, public authority, agency or body other than the data subject, controller, processor and persons who, under the direct authority of the controller or processor, are authorized to process personal data.

(9) Consent

‘Consent’ of the data subject means any freely given, specific, informed and unambiguous indication of the data subject’s wishes by which he or she, by a statement or by a clear affirmative action, signifies agreement to the processing of personal data relating to him or her.

II. The controller for the processing of data

The controller [Article 4 (7) GDPR]:

Stephan Schoen

Vaihinger Straße 102 B

70567 Stuttgart

E-mail: stephan.schoen.art@gmail.com

Homepage: https://stephan-schoen.com/

III. Principles for processing personal data

(1) Extent of the processing of personal data

As a general principle, I collect and use personal data of the users only to the extent that such becomes necessary for the provision of a functional website. The collection and use of your personal data shall regularly take place only after your consent. However, an exception shall apply in such cases in which, for factual reasons, obtaining a consent in advance is not possible and the processing of the data is nevertheless permitted by law.

(2) Legal basis for the processing of personal data

The data transferred or collected from you shall be collected, used, processed, stored, and, as the case may be – insofar as prescribed by law or contractually necessitated – shared with third parties – exclusively within the scope of the applicable data protection laws (the GDPR, the Federal Data Protection Act (Bundesdatenschutzgesetz ‑ BDSG) and the Telemedia Act (Telemediengesetz –TMG).

From Article 6 GDPR, various legal principles follow for the processing of your personal data, upon which principles respective reference is made in this privacy statement:

Article 6(1) lit. a GDPR is the legal basis for the processing operations of personal data, if a consent of the data subject is present.
Article 6(1) lit. b GDPR is the legal basis of the processing of personal data that becomes necessary to comply with a contract to which the data subject is a party to. This legal basis is also based on those processing operations that are necessary to carry out pre-contractual measures.
If I have to carry out processing of personal data for the purpose of fulfilling a legal obligation of my company, then the legal basis for this purpose shall be Article 6(1) lit. c.
Article 6(1) lit. d GDPR shall serve as the legal basis if vital interests of the data subject of the data processing or of another natural person make processing of their personal data necessary.
If the processing of personal data is necessary to safeguard a legitimate interest of my company or of a third party, and, in so doing, the interests, fundamental rights, and fundamental freedoms of the data subject do not outweigh this primary interest of my company or of a third party, then this processing shall be effected upon the legal basis of Article 6(1) lit. f GDPR.

(3) Data erasure and storage period

As soon as the purpose of the storage of the respective personal data of the data subject is no longer applicable, said data shall be erased or blocked. However, storage beyond this date can be made if such is intended by European or national directives, regulations, statutes, or other rules and regulations to which we as the controller for the data processing are subject to. The data shall also be blocked or erased if a storage period prescribed by the standards set forth elapses, unless a necessity for further storage of such data exists for entering into a contractual agreement or for fulfilling a contractual agreement.

IV. General data processing in connection with the provision of my Website and the creation of log files

The extent and the nature of the collection and use of your data are distinguished by whether you visit my Website only to retrieve information or to make use of my offers – such as registration for the contact form or e-mail contact:

(1) Visiting my Website

Generally, it is not necessary for you to provide me with personal data for the purely informational use of my Website. Rather, during your visit to my Website, in the server log data files I automatically collect, use, and store information that is transferred to me by the respectively used browser. The server I use is provided by Wix.com Ltd. (‘Wix').

Wix will use this information, on my behalf, to make the use of my Website possible and to render further services connected to website use and internet use. For this purpose, I entered into a data processing agreement with Wix.

(2) Data collected

The following data shall be collected:

information about your browser (e.g., Mozilla Firefox, Microsoft Internet Explorer, Apple Safari, Google Chrome);
the operating system used by you,
your IP address and Hostname,
date and time of your access,
length of your stay,
websites/URLs from which your system gains access to my Website,
search engine and keyword you used,
number of pages viewed by you,
last page visited before exiting my Website.

Data is stored in the log files of the system. The internet protocol address (IP address) is anonymized at the end of the day on which the data were collected. No storage of these data together with other personal data of the user shall take place.

(3) Legal basis

The legal basis for this temporary storage of the data and of the log files is Article 6(1) lit. f GDPR, because my legitimate interests in this storage, as set forth below, outweigh your interests, fundamental rights, and fundamental freedoms: the IP address is regarded as an item of personal data. The temporary storage of the IP address by the system is necessary to enable a transfer of my Website to your browser. For this purpose, the IP address has to be stored. The storage in log files ensures the functionality of my Website. In addition, the data assists me in optimizing my Website and ensures the security of my information technology systems. In this connection, your data will not be exploited for any marketing purposes. Since the IP address is already anonymized at the end of the day on which the said data were recorded, your interests have been appropriately considered.

(4) Duration of the storage

The data shall be erased as soon as they are no longer necessary for attaining the purpose of their collection. To the extent that the data have been stored in log files, the IP address is anonymized, so that any assignment to your person is no longer possible. The log files are then erased after 1 month.

(5) Opportunity to object and to remove

The recording of data for setting up my Website and the storage of data in log data files are mandatory and necessary for the operation of my Website. Hence, there does not exist any opportunity for you to object in this regard.

(6) More Information regarding the processing of data by Wix

Third-Party information: Wix.com Ltd., Nemal St. 40, 6350671 Tel Aviv, Israel, E-Mail: privacy@wix.com. Terms of Use: https://de.wix.com/about/terms-of-use, as well as Privacy Policy: https://de.wix.com/about/privacy.

V. Contact form on the Website and e-mail contact

My Website contains information about how you can quickly establish contact/communication.

(1) Description and extent of the data processing

You can contact me via e-mail or through a contact form, the personal data (e-mail address and, as applicable, additional voluntarily supplied details such as first name and last name) transferred by you will be automatically stored.

Your consent shall be obtained in the course of the dispatching procedure for the processing of the data and this privacy statement will be referred to. I use an SSL encryption for the contact form.

As an alternative to the contact form, it is possible to establish contact through the e-mail address provided. In this case, your personal data transferred with the e-mail will be stored for purposes of processing the inquiry or the established contact. However, please observe that unencrypted e-mails that are sent over the internet are not sufficiently protected in every instance from unauthorized notice by third parties during the course of transportation.

In this connection, no sharing of the data with third parties shall take place. The data shall be used exclusively for processing the conversation.

(2) Legal basis for the data processing

The legal basis for the processing of the data is, if and to the extent that your consent is present, Article 6(1) lit. a GDPR or Article 6(1) lit. f GDPR.

If the e-mail contact has the aim of entering into a contract, then the additional legal basis for the processing is Article 6(1) lit. b GDPR.

(3) Purpose of the data processing

Processing of the personal data from the contact form or from an e-mail sent to me shall serve solely for the purpose of processing the communication which also provides the requisite legitimate interest in the processing of the data whenever such data are processed upon the basis of Article 6(1) lit. f GDPR.

(4) Duration of the storage

The data shall be stored until you request that I erase them, you withdraw your consent to the storage, or the data are no longer necessary for the purpose of the collection thereof. Both for the personal data from the contact form as well as for data that are sent via e-mail, data collection is no longer necessary whenever the respective conversation is closed. The conversation is closed if it can be inferred from the circumstances that the matter at hand has been conclusively resolved.

(5) Objection and elimination opportunity

At any time, you have the opportunity to withdraw your consent to the processing of the personal data and you can object to the storage of personal data. In such a case, however, the conversation cannot be continued. All personal data that have been stored in the course of establishing contact via e-mail or via use of the contact form shall be erased by me within a period of 7 days after receipt of the objection.

Such shall be without prejudice to mandatory provisions of law – including, but not limited to, retention periods.

VI. Google Analytics

I use ‘Google Analytics’, a web analysis service of Google Inc. (‘Google’).

(1) Description and extent of the data processing

The information produced regarding your use of my Website (including your IP address) is usually transferred to a server of Google in the USA and stored there. However, I have activated IP anonymization. On this website, your IP address will be abbreviated first by Google within Member States of the European Union or in other contracting states of the Agreement on the European Economic Area. Only in exceptions will your full IP address be transferred to a server of Google in the USA and abbreviated there. For the exceptional cases in which personal information is transferred to the US, Google has submitted to the EU-US Privacy Shield, https://www.privacyshield.gov/EU-US Framework. Google will also transfer this information to third parties if this is required by law or to the extent that third parties process these data on behalf of Google.

Your consent shall be obtained when you first visit my Website and stored as a cookie (‘cookieconsent_status’) and this privacy statement will be referred to.

(2) Legal basis for the data processing

The legal basis for the processing of the data is Article 6(1) lit. a GDPR and Article 6(1) lit. f GDPR. The legal basis for the use of Google Analytics, in the exceptional case where data is transferred to the US, is Article 6(1) lit. f GDPR.

(3) Purpose of the data processing

Google will use this information, on my behalf, to evaluate your use of my Website in order to compile reports on the website activities and to render further services connected to website use and internet use for me. For this purpose, I entered into a data processing agreement with Google. The processing of anonymous user data enables me to analyze the surfing behavior of my users. By analyzing the data obtained, I am able to compile information about the use of the individual components of my Website. This helps me to constantly improve my Website and its user-friendliness. However, the anonymization of the IP address does not allow the usage behavior to be assigned to an individual person.

(4) Duration of storage/right of objection and elimination opportunities

You as the user have full control of the use of cookies. Cookies are stored on the user’s computer and transferred from it to my Website. By changing the settings in your internet browser, you can deactivate or restrict the transfer of cookies yourself. Cookies already stored can be erased at any time. This can also be done automatically. If cookies are deactivated for my Website, however, you might no longer be able to use all of my Website’s function to the fullest extent.

You may erase cookies once set again at any time on your own by calling up the corresponding menu item in your web browser or deleting the cookies from your hard disc. For details on this, see the help menu of your web browser. You may also prevent saving of the cookies by making the corresponding settings in your browser software. Moreover, you can prevent the cookie from recording data it generates and which pertains to your use of the website (including the IP address) at Google as well as the processing of this data by Google, by downloading and installing the available browser plugin under the following link: http://tools.google.com/dlpage/gaoptout?hl=de.

If you are using a mobile application – such as a tablet or Smartphone – the browser plugin will not work. However, you can nevertheless prevent recording of your data by Google Analytics by deactivating Google Analytics. This will set an opt-out cookie that will permanently prevent recording of your data during future visits to this Website. For more details on this, see https://support.google.com/analytics/answer/6004245?hl=de.

(5) More Information regarding the processing of data by Google

Third-Party information: Google Dublin, Google Ireland Ltd., Gordon House, Barrow Street, Dublin 4, Ireland, Fax: +353 (1) 436 1001. Terms of Use: http://www.google.com/analytics/terms/de.html, as well as Privacy Policy: https://policies.google.com/privacy?hl=de&gl=de.

VII. Use of Cookies

I only use so-called ‘cookies” on my Website in order to obtain your consent to apply Google Analytics services. For detailed information, please see above (VI. (4)).

The legal basis for the processing of personal data with the use of cookies is Article 6(1) lit. f GDPR, and with the presence of the user’s consent thereto, Article 6(1) lit. a GDPR.

VIII. Your rights as the data subject

If I process your personal data, then you are the data subject within the meaning of the GDPR, and you are entitled, as against me in the capacity of controller, to the following rights:

(1) Right to information

You can request from me a confirmation as to whether personal data that concern you are being processed by me.

If such a processing is present, then you can request from me further access to the following information:

the purposes for which the personal data are processed,
the categories of personal data that are being processed,
the recipients or the categories of recipients to whom the personal data concerning you has been disclosed or is still being disclosed,
the planned duration of storage of the personal data concerning you or, in the event that specific details for such are not possible, criteria for setting the duration of storage;
the existence of a right to rectification or erasure of the personal data concerning you, and of a right to restriction of the processing by the controller or of a right to object against this processing;
the existence of a right to lodge a complaint with a supervisory authority, and
all available information about the source of the data, if the personal data are not collected from you as the data subject.

You have the right to request access to information concerning whether the personal data concerning you are transferred into a third country or to an international organization. In this connection, you can request to be provided with information about the appropriate safeguards in connection with the transfer, in accordance with Article 46 GDPR.

(2) Right to rectification

You have a right towards me, as the controller, to rectification and/or completion, insofar as the personal data concerning you and processed by me is incorrect or incomplete. I shall have to perform the rectification without undue delay.

(3) Right to restriction of processing

You can request the restriction of the processing of the personal data concerning you under the following conditions:

(a) if you dispute the accuracy of the personal data concerning you for a period of time that enables the controller to review the accuracy of the personal data,

(b) the processing is unlawful, and you refuse the erasure of the personal data and instead request the restriction of the use of the personal data;

(c) I no longer require the personal data for the processing purposes, but you require the data, however, to assert, exercise, or defend legal claims, or

(d) if you have lodged a complaint against the processing in accordance with Article 21(1) GDPR and it is not yet determined whether the legitimate reasons being asserted by me outweigh your reasons.

If the processing of the personal data concerning you was restricted, then these data may be processed – apart from the storage thereof – only with your consent or for the purpose of the asserting, exercising, or defending of legal claims or for the purpose of protecting the rights of another natural or legal person or for reasons of an important public interest of the Union or of a Member State.

If the restriction of the processing under the aforementioned conditions was restricted, then you shall be provided with information by me before the restriction is lifted.

(4) Right to erasure

(4.a) Erasure duty

I am obligated to erase the personal data concerning you without undue delay if one of the following reasons is applicable:

1. The personal data concerning you are no longer necessary for the purposes for which they were collected or were otherwise processed.

2. You withdraw your consent upon which the processing in accordance with Article 6(1) lit. a or Article 9(2) lit. a GDPR was based, and there is no other legal basis for the processing.

3. You lodge an objection against the processing, in accordance with Article 21(1) GDPR, and there do not exist any overriding legitimate reasons for the processing, or you lodge an objection against the processing in accordance with Article 21(2) GDPR.

4. The personal data concerning you were processed unlawfully.

5. The erasure of the personal data concerning you is necessary to fulfill a legal obligation under European Union law or the law of the Member State to which I am subject to.

6. The personal data concerning you were collected with regard to information society services offered in accordance with Article 8(1) GDPR.

(4.b) Information to third parties

If I have made the personal data concerning you public and if I am obligated in accordance with Article 17(1) GDPR to erase it, then I shall take such reasonable measures, taking into consideration available technology and the costs of implementation, also of a technical nature, in order to inform other data processing controllers who process your personal data that you, as the data subject, have requested from them the erasure of all links to these personal data or of copies or duplicates of these personal data.

(4.c) Exceptions

The right to erasure shall not exist to the extent that the processing is necessary:

to exercise the right to free expression and to information,
to fulfill a legal obligation which requires the processing under the law of the European Union or of the Member States to which I am subject to, or to perform a task in the public interest or in the exercise of official authority which was transferred to the controller;
for reasons of public interest in the realm of public health in accordance with Article 9(2) lit. h and i as well as Article 9(3) GDPR,
for purposes of archival, scientific, or historical research in the public interest, or for statistical purposes in accordance with Article 89(1) GDPR, to the extent that the right to erasure presumably makes the realization of the objectives of this processing impossible or seriously impairs it, or
to assert, exercise, or defend legal claims.

(5) Right to provision of information

If you have asserted the right to rectification, erasure, or restriction of the processing, then I shall be obligated to disclose this rectification or erasure of the data or restriction of the processing to all recipients to whom the personal data concerning you was disclosed, unless such proves impossible or is associated with disproportionate expense. You have against me the right to be provided with information about these recipients.

(6) Right to data portability

You have the right to receive in a structured, commonly used, and machine-readable format the personal data concerning you which you have provided me. Moreover, you have the right to transfer these data to another controller without any hindrance from me as the controller to whom the personal data were provided, insofar as

the processing is based upon a consent in accordance with Article 6(1) lit. a GDPR or Article 9(2) lit. a GDPR or an agreement in accordance with Article 6(1) lit. b GDPR, and
the processing is made with the aid of automated procedures.

In the exercise of this right, furthermore, you have the right to have the personal data concerning you transferred directly from me as one controller to another controller, to the extent this is technically feasible. Such shall not be allowed to deleteriously affect the freedoms and rights of other persons.

The right to data portability shall not apply to any processing of personal data that is necessary for the performance of a task which is in the public interest or in the exercise of official authority that was transferred to me as the controller.

(7) Right to object

You have the right to object, on grounds relating to your particular situation, at any time to processing of personal data concerning you, based on Article 6(1) lit. e or f GDPR, including profiling based on those provisions.

I shall no longer process the personal data concerning you unless I can demonstrate compelling legitimate grounds for the processing which override your interests, rights, and freedoms, or the processing serves the establishment, exercise, or defense of legal claims.

If personal data concerning you are processed for direct marketing purposes, you shall have the right to object at any time to processing of personal data concerning you for such marketing, which includes profiling to the extent that it is related to such direct marketing. If you object to processing for direct marketing purposes, then the personal data concerning you shall no longer be processed for such purposes.

Notwithstanding Directive 2002/58/EC, in connection with the use of the information society services, you have the opportunity to exercise your right to object by automated means using technical specifications.

If you would like to make use of your right to object, then it shall be sufficient to send an e-mail to info@stephan-schoen.com.

(8) Right to withdraw the data protection consent declaration

You have the right to withdraw your data protection consent declaration at any time. Withdrawal of the consent shall be without prejudice to the processing effected due to the consent up to the withdrawal.

If you would like to make use of your right to withdraw, then it shall be sufficient to send an e-mail to info@stephan-schoen.com.

(9) Right to lodge a complaint with a supervisory authority

Notwithstanding any judicial or administrative-law remedy, you have the right to lodge a complaint with a supervisory authority, including, but not limited to, in the Member State of your residence, your workplace, or the location of the alleged violation, if you are of the view that the processing of the personal data concerning you violates the GDPR.

The supervisory authority at which the complaint was lodged will provide you, as the complaining party, information about the status and outcomes of the complaint, including the possibility of a legal remedy pursuant to Article 78 GDPR.

Please direct any inquiries you may have in connection with the rights of data subjects to info@stephan-schoen.com.

Please note that for access queries not made in writing, I may request, for protection of the persons whose data are stored, that it be verified that you are really the person about whose personal data access is being requested.

Please also note that I cannot store any personal data of visitors to my Website or derive any direct personal connection, insofar as you have not previously volunteered personal data, e.g., using the contact form.

IX. Subject to change

I reserve the right to adapt this privacy statement and to continually adapt it to the respectively applicable provisions, in the same manner as my offers on this Website.

Status: January 2025