Privacy notice

2. Hosting and server logs

The website is hosted by lima-city. The technical hosting and mail provider is TrafficPlex GmbH, Konsul-Smidt-Str. 90, 28217 Bremen, Germany.

Whenever the website is accessed, the host processes data including the IP address, date and time, requested domain and URL, HTTP method and version, status code, volume of data, browser and device data, technical operating data, and information used to detect attacks and misuse. This may include request IDs, rate-limit, blocking or challenge data, and technical fingerprints.

These data are used to deliver the website, maintain stability, diagnose faults, and protect the service against attacks and misuse. The legal basis is point (f) of Article 6(1) GDPR. The legitimate interests are the secure and reliable operation of this website.

According to lima-city, these technical access data are retained for up to 90 days.

Technical privacy information from lima-city

3. Language choice and URL parameters

If no language has been selected and no language cookie exists, the application reads the browser’s language preference once to choose German or English. The application does not store that preference separately, although it may be available to the host as part of the technical request.

An explicit language choice is sent in the URL as the “lang” parameter. It may therefore appear in browser history and server logs. Personal information should not be entered in the URL.

4. Technically necessary cookies

The website only uses cookies for security and explicitly selected convenience features. They are not used for advertising, audience measurement or cross-site tracking.

• _lcpIs currently set by lima-city for bot, security and misuse protection. According to the host, the value is the same for everyone and contains no individual identifier. The current response header gives 20 March 2034 as the expiry date; the host may change it.
• dbt_spracheStores the selected version: German, English, German Easy Language or English Easy Read. One year after the last page request containing a language parameter.
• dbt_hinweisOnly remembers that the humorous website notice was dismissed for the current browser session. Until the browser session ends.

The website’s two own cookies are set as HttpOnly and SameSite=Lax, and as Secure over HTTPS. “Close on this page only” does not store an additional notice cookie.

Storage is based on section 25(2)(2) TDDDG where it is necessary for secure delivery or an explicitly requested setting. Where personal data are processed, point (f) of Article 6(1) GDPR also applies. The legitimate interests are secure operation, retaining the chosen language, and implementing the requested dismissal for the session.

5. Naturalisation and passport form

The passport form accepts names, birth details, “Diabetes since” as an exact date or a year, sex, diabetes type, glucose target range and an optional photograph. On the device, the sector entry is automatically set to the same value as the diabetes type. Some of this information may constitute health data.

These details are processed solely by JavaScript on your device. The photograph is cropped there and inserted into the PDF together with the other details. There is no upload or server-side application, and the website does not transmit or store these details.

The file name contains a sanitised version of the surname; the PDF metadata contain the passport number and a document description. After downloading, this information may be visible in download lists, synchronised folders or backups.

The generated PDF and any subsequent printout are outside our technical control. Depending on your device settings, downloads or print jobs may be processed by synchronisation, backup or printing services that you use.

6. Contact by email

The website has no contact form. If you send an email, we process your sender address, message, possible attachments and the communication data required to answer it.

For ordinary enquiries, the legal basis is point (f) of Article 6(1) GDPR; the legitimate interest is responding to enquiries. Where a message is handled to meet a legal obligation, point (c) of Article 6(1) GDPR applies. Messages are generally deleted after they have been dealt with, unless a statutory retention duty or necessary legal defence requires continued storage.

The lima-city mail service processes routing, connection and security data as well as technically required content data and may use spam, malware and misuse filters. According to the provider, technical transport and security data are retained for no more than 14 days; the message itself remains in the mailbox until it is deleted under the rule above.

We do not request health data or other special categories of personal data by email. Please do not send such information. Special-category data sent without request are not evaluated for their content and are deleted as soon as technically possible unless a legal duty or necessary legal defence requires otherwise.

7. Other functions and external content

Search, filters, map selection, recipe windows and enlarged images operate only in the currently open document and do not store inputs.

No analytics or advertising services, marketing pixels, social-media plugins, third-party fonts or external media are embedded. Static files such as scripts, the flag and the coat of arms are loaded from diabetien.de.

External websites are contacted only when you select a corresponding link. From that point, the other provider’s privacy terms apply.

8. Recipients and transfers

TrafficPlex GmbH processes hosting access data and, for the email service, transport, security and content data to the extent required. According to the provider’s published contractual information, regular processing for the hosting services takes place in the European Union or European Economic Area. An email reply is delivered through the infrastructure of the mail provider chosen by the sender; if it is outside the European Economic Area, the requested communication may be transmitted there.

9. Whether data must be provided

• Technical connection and access data are required to deliver the website. Without this processing, the page cannot be provided.
• Language choice and remembering the humorous notice are voluntary. Without a stored choice, the automatic or default language is used; without the notice cookie, the notice appears again in a new session.
• Information in an email is voluntary. It is usually not possible to reply without a reachable sender address.
• Passport details are voluntary and are not transmitted to the website operator.

10. Your rights

Subject to the applicable legal conditions, you have the following rights in particular:

• access to your personal data under Article 15 GDPR,
• rectification under Article 16 GDPR,
• erasure under Article 17 GDPR,
• restriction of processing under Article 18 GDPR,
• data portability under Article 20 GDPR where its conditions are met.

To exercise your rights, send a message to the email address above. The website operator does not make decisions based solely on automated processing within the meaning of Article 22 GDPR and does not create advertising profiles. The host’s security systems may automatically classify or block requests.

12. Right to lodge a complaint

Under Article 77 GDPR you may lodge a complaint with a data-protection supervisory authority. The following authority is particularly relevant to the controller’s place of establishment:

Submit a complaint to the HBDI

13. Security and updates

The website is delivered over encrypted HTTPS and follows the principle of data minimisation. Absolute security of electronic processing cannot be guaranteed. This notice will be reviewed when functions, service providers or legal requirements change.