Privacy policy – the long text

Outline

• Person in charge (controller)
• Overview of processing
• Relevant legal bases
• Safety measures
• International data transfers
• General information on data storage and deletion
• Rights of data subjects
• Provision of the online offer and web hosting
• Web analytics (Plausible)
• Embedded videos (YouTube)
• Blogs and publication media
• Contact and request management
• Delivery of form e-mails (Resend)
• Newsletter ("inspirations")

Person in charge (controller)

Marketing Surfer GmbH, Gartenstraße 12a, 85521 Ottobrunn, Germany.
E-mail: contact@silocrusher.com.
Full provider details: https://silocrusher.com/imprint.

Overview of processing

The following overview summarises the types of data processed and the purposes of their processing, and refers to the data subjects.

Types of data processed

• Inventory data.
• Contact details.
• Content Data.
• Usage.
• Meta, communication and procedural data.
• Log.

Categories of data subjects

• Communication partners.
• Users.
• Subscribers (newsletter).

Purposes of processing

• Provision of contractual services and fulfilment of contractual obligations.
• Communication.
• Security Measures.
• Organisational and administrative procedures.
• Feedback.
• Reach measurement (privacy-friendly web analytics).
• Direct marketing (sending our newsletter on the basis of consent).
• Provision of our online offer and user-friendliness.
• Information technology infrastructure.

Relevant legal bases

Relevant legal bases under the GDPR: Below you will find an overview of the legal bases of the GDPR on the basis of which we process personal data. Please note that in addition to the regulations of the GDPR, national data protection regulations may apply in your or our country of residence or domicile. Furthermore, if more specific legal bases are relevant in individual cases, we will inform you of these in the privacy policy.

• Consent (Art. 6 para. 1 sentence 1 lit. a) GDPR) - The data subject has given consent to the processing of their personal data for one or more specific purposes (in particular loading embedded YouTube videos and receiving our newsletter).
• Performance of a contract and pre-contractual enquiries (Art. 6 para. 1 sentence 1 lit. b) GDPR) - Processing is necessary for the performance of a contract to which the data subject is a party or to take steps at the request of the data subject prior to entering into a contract.
• Legitimate interests (Art. 6 para. 1 sentence 1 lit. f) GDPR) - the processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, provided that the interests, fundamental rights and freedoms of the data subject which require the protection of personal data are not overridden.

National data protection regulations in Germany: In addition to the data protection regulations of the GDPR, national regulations on data protection apply in Germany. These include, in particular, the Act on Protection against Misuse of Personal Data in Data Processing (Federal Data Protection Act – BDSG). In particular, the BDSG contains special provisions on the right to information, the right to erasure, the right to object, the processing of special categories of personal data, processing for other purposes and transmission as well as automated decision-making in individual cases, including profiling. In addition, state data protection laws of the individual federal states can be applied.

Note on the applicability of the GDPR and the Swiss Data Protection Act: This data protection notice serves to provide information in accordance with the Swiss Data Protection Act as well as the General Data Protection Regulation (GDPR). For this reason, we ask you to note that due to the broader spatial application and comprehensibility, the terms of the GDPR are used.

Safety measures

In accordance with the legal requirements, taking into account the state of the art, the implementation costs and the type, scope, circumstances and purposes of the processing, as well as the different probabilities of occurrence and the extent of the threat to the rights and freedoms of natural persons, we take appropriate technical and organisational measures to ensure a level of protection appropriate to the risk.

Securing online connections with TLS/SSL encryption technology (HTTPS): In order to protect the data of users transmitted via our online services from unauthorized access, we rely on TLS/SSL encryption technology. If a website is secured by an SSL/TLS certificate, this is signaled by the display of HTTPS in the URL. This serves as an indicator for users that their data is being transmitted securely and encrypted.

International data transfers

Data processing in third countries: If we transfer data to a third country (i.e. outside the European Union (EU) or the European Economic Area (EEA)) or if this happens in the context of the use of third-party services or the disclosure or transmission of data to other persons, bodies or companies, this is always done in accordance with the legal requirements.

Where we use service providers in the USA, we do so in accordance with Chapter V of the GDPR. Our US recipients are: Resend (Plus Five Five, Inc.), which delivers our contact and sign-up form e-mails, and Google LLC, whose YouTube service supplies the videos embedded on our episode pages (contacted only if you choose to load a video). Resend is certified under the EU-US Data Privacy Framework (adequacy decision of the European Commission of 10 July 2023) and its data processing agreement incorporates the EU standard contractual clauses as an additional safeguard; Google is likewise certified under the EU-US Data Privacy Framework.

General information on data storage and deletion

We delete personal data that we process in accordance with the law, as soon as the underlying consents are withdrawn or there are no other legal grounds for the processing. This applies to cases in which the original purpose of processing no longer applies or the data is no longer needed. Exceptions to this regulation exist if legal obligations or special interests require longer storage or archiving of the data.

In particular, data that must be retained for commercial or tax reasons, or the storage of which is necessary for legal prosecution or to protect the rights of other natural or legal persons, must be archived accordingly. If there is more information about the retention period or deletion periods of a date, the longest period is always decisive.

Retention and deletion of data: The following general deadlines apply to retention and archiving under German law: 10 years for books and records, annual financial statements and accounting-relevant organisational documents (sec. 147 AO, sec. 257 HGB); 8 years for accounting documents such as invoices; 6 years for other retention-relevant business documents; and 3 years for data needed to consider potential warranty and contractual claims, in line with the regular statutory limitation period (secs. 195, 199 BGB).

Rights of data subjects

Rights of data subjects under the GDPR: As data subjects, you have various rights under the GDPR, which result in particular from Art. 15 to 21 GDPR:

• Right to object: You have the right to object at any time, on grounds relating to your particular situation, to the processing of personal data concerning you that is carried out on the basis of Art. 6 (1) (e) or (f) GDPR; this also applies to profiling based on these provisions. If the personal data concerning you is processed for the purpose of direct marketing, you have the right to object at any time to the processing of the personal data concerning you for the purpose of such advertising; this also applies to profiling, insofar as it is related to such direct advertising.
• Right to withdraw consent: You have the right to revoke consent at any time.
• Right of access: You have the right to request confirmation as to whether the data in question is being processed and to access this data, as well as to obtain further information and a copy of the data in accordance with the legal requirements.
• Right to rectification: In accordance with the legal requirements, you have the right to request the completion of the data concerning you or the correction of the inaccurate data concerning you.
• Right to erasure and restriction of processing: In accordance with the legal requirements, you have the right to demand that data concerning you be deleted immediately, or alternatively to demand a restriction of the processing of the data in accordance with the legal requirements.
• Right to data portability: You have the right to receive data concerning you that you have provided to us in a structured, commonly used and machine-readable format in accordance with the legal requirements, or to request that it be transmitted to another controller.
• Complaint to supervisory authority: Without prejudice to any other administrative or judicial remedy, you have the right to lodge a complaint with a supervisory authority, in particular in the Member State of your habitual residence, your place of work or the place of the alleged infringement, if you believe that the processing of personal data concerning you violates the requirements of the GDPR.

Provision of the online offer and web hosting

We process users' data in order to be able to provide them with our online services. For this purpose, we process the user's IP address, which is necessary to transmit the content and functions of our online services to the user's browser or device.

• Types of Data Processed: Usage Data (e.g., page views and dwell time, device types and operating systems used, interactions with content and features); Meta, communication and procedural data (e.g. IP addresses, times, identification numbers, persons involved); Log data (e.g. log files regarding the retrieval of data or access times).
• Data subjects: Users (e.g. website visitors, users of online services).
• Purposes of processing: Provision of our online offer and user-friendliness; Information technology infrastructure; Security Measures.
• Legal basis: Legitimate interests (Art. 6 para. 1 sentence 1 lit. f) GDPR).

Further information on processing processes, procedures and services:

• Collection of access data and log files: Access to our online offer is logged in the form of so-called "server log files". The server log files can include the address and name of the websites and files accessed, date and time of access, data volumes transferred, notification of successful access, browser type and version, the user's operating system, referrer URL and, as a rule, IP addresses and the requesting provider. The server log files can be used for security purposes, e.g. to avoid overloading the servers and to ensure their stability; Legal basis: Legitimate interests (Art. 6 para. 1 sentence 1 lit. f) GDPR). Deletion of data: Log file information is stored for a maximum period of 30 days and then deleted or anonymized. Data whose further retention is necessary for evidentiary purposes is exempt from deletion until the respective incident has been finally clarified.
• IONOS: Services in the field of the provision of information technology infrastructure and related services (e.g. storage space and/or computing capacities); Service provider: IONOS SE, Elgendorfer Str. 57, 56410 Montabaur, Germany; Legal basis: Legitimate interests (Art. 6 para. 1 sentence 1 lit. f) GDPR); Website: https://www.ionos.de; Privacy Policy: https://www.ionos.de/terms-gtc/terms-privacy. A data processing agreement (Art. 28 GDPR) is in place.

Web analytics (Plausible)

We use Plausible Analytics to understand, in aggregate, how our site is used. Plausible is privacy-friendly: it sets no cookies and stores no persistent identifiers, collects no cross-site or cross-device data, and does not store your raw IP address or user-agent string. To count unique visits, these are used only transiently to generate an identifier hashed with a salt that changes every day, so visitors cannot be recognised across days or across websites. We serve the measurement script from our own domain and relay the measurement events from our own server to Plausible's EU infrastructure (path /pa/), so the measurement is first-party. No individual visitor can be identified.

• Provider: Plausible Insights OÜ, Västriku tn 2, 50403 Tartu, Estonia. All analytics data is processed and stored within the EU.
• Types of data processed: aggregated usage data (pages viewed, referrer source, approximate country, device/browser type). No personal profiles.
• Purpose: reach measurement and improvement of our content.
• Legal basis: Legitimate interests (Art. 6 para. 1 sentence 1 lit. f) GDPR). As no cookies or device storage are used, no consent under § 25 TDDDG is required.
• More information: https://plausible.io/data-policy.

Embedded videos (YouTube)

Our episode pages embed videos from YouTube in the extended data-protection mode ("youtube-nocookie"). We load these videos only after you actively click to play ("click-to-load"): until then, no connection to YouTube/Google is established and no data is sent. Once you click to load a video, your IP address and technical data are transmitted to YouTube/Google, including a transfer to the USA, and YouTube may set cookies on your device.

• Provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (parent company Google LLC, USA).
• Types of data processed: usage data (which video, interactions); meta and communication data (IP address, device and browser information).
• Purpose: display of the embedded video content.
• Legal basis: your consent (Art. 6 para. 1 sentence 1 lit. a) GDPR and § 25 TDDDG), given by clicking to load the video. You can withhold consent simply by not loading the video, and withdraw it at any time with effect for the future by not loading further videos.
• Third-country transfer: to Google LLC, USA, based on the EU-US Data Privacy Framework (Google is certified) and/or EU Standard Contractual Clauses.
• More information: Google Privacy Policy, https://policies.google.com/privacy.

Blogs and publication media

We use blogs or comparable means of online communication and publication (hereinafter referred to as "publication medium"). Readers' data will only be processed for the purposes of the publication medium to the extent necessary for its presentation and communication between authors and readers or for security reasons.

• Types of data processed: Content data (e.g., textual or pictorial news and posts); Usage data (e.g., page views and dwell time, device types and operating systems used, interactions with content and features); Meta, communication and procedural data (e.g. IP addresses, times).
• Data subjects: Users (e.g. website visitors, users of online services).
• Purposes of processing: Provision of our online offer and user-friendliness.
• Legal basis: Legitimate interests (Art. 6 para. 1 sentence 1 lit. f) GDPR).

Contact and request management

When contacting us (e.g. by contact form or e-mail) as well as in the context of existing user and business relationships, the information of the enquiring persons will be processed insofar as this is necessary to answer the contact requests and any requested measures. The e-mail delivery of the form contents to our mailbox is handled by Resend (see "Delivery of form e-mails" below).

• Types of data processed: Inventory data (e.g. full name); Contact details (e.g. e-mail address); Content data (e.g. the message you send us); Meta, communication and procedural data (e.g. IP addresses, times).
• Data subjects: Communication partners.
• Purposes of processing: Communication; organisational and administrative procedures; Feedback.
• Legal basis: Legitimate interests (Art. 6 para. 1 sentence 1 lit. f) GDPR); Performance of a contract and pre-contractual enquiries (Art. 6 para. 1 sentence 1 lit. b) GDPR).

Delivery of form e-mails (Resend)

When you use our contact or sign-up form, the data you enter is delivered to our mailbox as an e-mail via the e-mail service Resend, which acts as our processor.

• Provider: Resend (Plus Five Five, Inc.), San Francisco, USA.
• Types of data processed: the form contents (e.g. name, e-mail address, message) and technical delivery data.
• Purpose: reliable delivery of your enquiry / sign-up notification to us, and delivery of the newsletter confirmation e-mail.
• Legal basis: for the contact form, performance of a contract and pre-contractual enquiries and our legitimate interest (Art. 6 para. 1 sentence 1 lit. b) and f) GDPR); for the newsletter sign-up, your consent (Art. 6 para. 1 sentence 1 lit. a) GDPR).
• Third-country transfer: to the USA. Resend is certified under the EU-US Data Privacy Framework, and its data processing agreement incorporates the EU standard contractual clauses.
• More information: https://resend.com/legal/privacy-policy.

Newsletter ("inspirations")

If you sign up via our form, we use your e-mail address (and your name, if provided) to send you our occasional "inspirations" newsletter (around 1–2 e-mails per month).

• Types of data processed: contact details (name, e-mail address); the fact and time of your sign-up and confirmation, and the IP address used, as proof of consent.
• Purpose: sending the newsletter and documenting your consent.
• Legal basis: your consent (Art. 6 para. 1 sentence 1 lit. a) GDPR). You may withdraw it at any time with effect for the future – via the unsubscribe link in every newsletter or by e-mailing us. Withdrawal does not affect processing already carried out.
• Procedure (double opt-in): after signing up you receive a confirmation e-mail, and your address is added only once you click the confirmation link. Sign-up and confirmation are logged to document your consent (§ 7 UWG).
• Delivery: the newsletter and the confirmation e-mail are sent via Resend (see above).
• Retention: until you unsubscribe / withdraw your consent.