Privacy

1. Controller

Controller within the meaning of the General Data Protection Regulation (GDPR) and other national data protection laws is:

Imprint

2. Server log files

When any page on this site is accessed, the hosting provider (Alfahosting GmbH) automatically records information transmitted by your browser to our server: IP address, date and time of the request, requested URL, transferred volume, browser type and version, operating system and referrer URL.

These data are used exclusively to ensure uninterrupted operation and to improve the offering, and are typically anonymised or deleted after 7 days. Legal basis: Art. 6 (1) (f) GDPR (legitimate interest in stable operation).

3. Cookies and similar technologies

This site uses only strictly necessary cookies. There is no tracking, no analytics, no advertising. Legal basis: § 25 (2) no. 2 TTDSG (strictly necessary cookies, no consent required).

You can delete cookies at any time via your browser settings. The site will still work — only the PlanKit purchase flow will need to be restarted.

4. Payment processing via PayPal

When you click "Buy now" in the PlanKit shop, you are redirected to PayPal. You enter your payment details on the PayPal page — these are not collected or stored by me; they are processed exclusively by PayPal.

Provider: PayPal (Europe) S.à r.l. et Cie, S.C.A., 22-24 Boulevard Royal, L-2449 Luxembourg.

For information on which data PayPal collects and how it is processed, see the PayPal privacy policy.

Legal basis for the redirect to PayPal is Art. 6 (1) (b) GDPR (performance of contract). After a successful payment I only receive the confirmation that the payment was made, plus — to the extent you provided them — your name and email address for order processing.

5. Order protection and token storage

To ensure that only you can access the PlanKit download after a successful payment, I create a short-lived token file on the server when you click Buy. It contains:

• A randomly generated token (32 hex characters, no personal reference)
• A timestamp (creation time)
• Your IP address (abuse protection)
• A truncated User-Agent (max. 200 characters)

The file is automatically deleted after no more than 90 minutes, regardless of whether payment was completed.

Legal basis: Art. 6 (1) (f) GDPR (legitimate interest in preventing abuse of the download).

6. Delivery of the PlanKit download

After successful payment a signed, time-limited download URL (valid for 24 hours) is shown on the confirmation page. The ZIP file is served directly from my webspace; no personal data are collected beyond the server log files mentioned in section 2.

7. When you contact me

7.1 Contact form on the homepage

Through the contact form on the homepage you can send me a message. The following data are processed: name, email address, selected subject and message text, plus, for technical purposes, IP address, timestamp and User-Agent (for spam protection).

The form is processed server-side by a PHP script (kontakt-handler.php) with multi-layer spam protection (honeypot field, time check, word filter, rate limiting). Suspicious submissions are recorded in a local log file on the web server and automatically deleted after 14 days. Successfully submitted messages go only to my email inbox.

Legal basis: Art. 6 (1) (b) GDPR (pre-contractual measures) or Art. 6 (1) (f) GDPR (legitimate interest in responding to your inquiry and in spam protection).

7.2 Inquiry by email or phone

If you contact me by email (mail@anne-praetorius.de) or phone, your information (name, email address, phone number, content of the inquiry) is stored for the purpose of processing the inquiry and for any follow-up questions. I will not pass on these data without your consent.

Your data will be deleted once the inquiry has been finally answered — unless legal retention obligations require otherwise (e.g. commercial or tax retention periods of 6 or 10 years).

8. Optional: diagnostic log

In case of technical problems in the PlanKit shop I can temporarily enable a diagnostic log that records additional information about the purchase flow (timestamp, cookie status, truncated User-Agent, IP address). This log is used exclusively for troubleshooting and deleted immediately after the issue is resolved.

Legal basis: Art. 6 (1) (f) GDPR. In normal operation the diagnostic log is disabled.

9. Hosting

The website is hosted by Alfahosting GmbH, Ankerstraße 3b, 06108 Halle (Saale), Germany. A data processing agreement under Art. 28 GDPR is in place with the host. The servers are located in Germany.

For further information about data protection at Alfahosting, see alfahosting.de/datenschutz.

10. Web fonts

This website uses web fonts (Cormorant Garamond, DM Sans, Caveat) for consistent typography. The fonts are self-hosted on the same server as the rest of the website and are delivered directly from our domain. No data is transferred to Google or other third parties when the fonts are loaded.

11. Disclosure to third parties

Your personal data are not disclosed to third parties, except:

• To PayPal for payment processing in the PlanKit shop (see section 4)
• To my hosting provider Alfahosting for technical delivery (see section 9)
• When I am legally obliged to do so (e.g. to law-enforcement authorities)

12. Your rights

You have the right, at any time, to:

• Access the personal data stored about you (Art. 15 GDPR)
• Rectification of inaccurate data (Art. 16 GDPR)
• Erasure of your data (Art. 17 GDPR)
• Restriction of processing (Art. 18 GDPR)
• Data portability in a structured, commonly used format (Art. 20 GDPR)
• Object to the processing (Art. 21 GDPR)
• Lodge a complaint with a supervisory authority (Art. 77 GDPR)

The supervisory authority responsible in Bavaria is the Bavarian State Office for Data Protection Supervision (BayLDA), Promenade 18, 91522 Ansbach, Germany.

For questions or to exercise your rights, just write informally to mail@anne-praetorius.de — I respond within 30 days.

13. Data security

All data are transmitted via an SSL/TLS-encrypted connection (HTTPS). Cookies are set with HttpOnly and Secure attributes and cannot be read by client-side scripts or over unencrypted connections.

Despite all care, complete protection against all forms of third-party access cannot be guaranteed. If you have security concerns, please contact me immediately.

14. Changes to this privacy policy

This privacy policy may be adapted if legal requirements change or if I make changes to the offering that require an adaptation. The current version is always available on this page.

As of: May 2026