Preamble
This privacy policy is intended to inform you about the types of your personal data (hereinafter referred to briefly as “data”) that we process, the purposes for which we process them, and the extent of such processing. This privacy policy applies to all processing of personal data carried out by us, both in the context of providing our services and in particular on our websites, in mobile applications, and within external online presences, such as our social media profiles (hereinafter collectively referred to as the “online offering”).
The terms used are gender-neutral.
Date: January 16, 2026.
Controller
sinahsstories – Sinah Kesenheimer
c/o Online-Impressum.de #5671
Europaring 90
53757 Sankt Augustin
Email: info@sinahsstories.com
Imprint: https://sinahsstories.com/impressum/
Overview of Processing Activities
The following overview summarizes the types of data processed and the purposes of their processing, with references to the categories of data subjects affected.
Types of Data Processed
-
Inventory data.
-
Contact data.
-
Content data.
-
Contractual data.
-
Usage data.
-
Metadata, communication, and procedural data.
-
Log data.
Categories of Data Subjects
-
Prospects.
-
Communication partners.
-
Users.
Purposes of Processing
-
Communication.
-
Security measures.
-
Reach measurement.
-
Affiliate tracking.
-
Organizational and administrative procedures.
-
Feedback.
-
Provisioning of our online offering and user-friendliness.
-
Profiles with user-related information.
-
Information technology infrastructure.
-
Public relations.
Relevant Legal Bases
GDPR Legal Bases
The following provides an overview of the legal bases under the GDPR on which we process personal data. Please note that, in addition to GDPR provisions, national data protection regulations in your or our country of residence or registered office may apply. If other specific legal bases are relevant in individual cases, we will inform you of these in the privacy policy.
-
Consent (Art. 6(1) sentence 1 lit. a GDPR): The data subject has given consent to the processing of their personal data for one or more specific purposes.
-
Contract Performance and Pre-Contractual Inquiries (Art. 6(1) sentence 1 lit. b GDPR): Processing is necessary for the performance of a contract to which the data subject is a party or for taking steps at the data subject’s request prior to entering into a contract.
-
Legitimate Interests (Art. 6(1) sentence 1 lit. f GDPR): Processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject that require protection of personal data.
National Data Protection Regulations in Germany
In addition to GDPR data protection regulations, national data protection rules apply in Germany. These include, in particular, the Federal Data Protection Act (Bundesdatenschutzgesetz – BDSG). The BDSG contains specific provisions on the right of access, the right to erasure, the right to object, processing of special categories of personal data, processing for other purposes, and transfer as well as automated individual decision-making, including profiling. Furthermore, data protection laws of the individual federal states may apply.
Security Measures
We implement appropriate technical and organizational measures in accordance with statutory requirements, considering the state of the art, implementation costs, nature, scope, circumstances, and purposes of processing, as well as the varying likelihood and severity of risks to the rights and freedoms of natural persons, to ensure a level of protection appropriate to the risk.
These measures include, in particular, safeguarding the confidentiality, integrity, and availability of data by controlling physical and electronic access to the data, as well as access thereto, input, disclosure, ensuring availability, and segregation. We have also established procedures to ensure awareness of data subject rights, data erasure, and responses to data security incidents. Furthermore, we integrate data protection into the development or selection of hardware, software, and processes, following the principles of data protection by design and by default.
Securing Online Connections via TLS/SSL Encryption Technology (HTTPS)
To protect user data transmitted via our online services from unauthorized access, we use TLS/SSL encryption technology. Secure Sockets Layer (SSL) and Transport Layer Security (TLS) form the cornerstone of secure data transmission on the internet. These technologies encrypt information exchanged between the website or app and the user’s browser (or between two servers), thereby protecting data from unauthorized access. TLS, as the more advanced and secure successor to SSL, ensures all data transmissions meet the highest security standards. A website secured by an SSL/TLS certificate is indicated by HTTPS in the URL, signaling to users that their data is transmitted securely and encrypted.
Transmission of Personal Data
In the course of our processing of personal data, such data may be disclosed or transmitted to other entities, companies, legally independent organizational units, or persons. Recipients of this data may include, for example, service providers tasked with IT services or providers of services and content integrated into a website. In such cases, we observe all statutory requirements and, in particular, conclude appropriate contracts or agreements with recipients of your data that serve to protect such data.
International Data Transfers
Processing in Third Countries
If we transfer data to a third country (i.e., outside the European Union (EU) or the European Economic Area (EEA)) or this occurs in connection with the use of third-party services or the disclosure or transmission of data to other persons, entities, or companies (evident from the provider’s postal address or explicit reference in the privacy policy to data transfers to third countries), we do so in full compliance with legal requirements.
For data transfers to the USA, we primarily rely on the Data Privacy Framework (DPF), recognized as a secure legal framework by an adequacy decision of the EU Commission dated July 10, 2023. In addition, we have concluded standard contractual clauses with the respective providers that comply with EU Commission requirements and establish contractual obligations for the protection of your data.
This dual safeguard ensures comprehensive protection of your data: The DPF serves as the primary layer of protection, while the standard contractual clauses provide additional security. Should changes arise under the DPF, the standard contractual clauses act as a reliable fallback. This ensures your data remain adequately protected even in the event of potential political or legal changes.
For each service provider, we inform you whether they are DPF-certified and whether standard contractual clauses are in place. Further information on the DPF and a list of certified companies can be found on the website of the U.S. Department of Commerce at https://www.dataprivacyframework.gov/ (in English).
For data transfers to other third countries, corresponding safeguards apply, particularly standard contractual clauses, explicit consents, or legally required transfers. Information on third-country transfers and applicable adequacy decisions can be found in the EU Commission’s information portal: https://commission.europa.eu/law/law-topic/data-protection/international-dimension-data-protection_en?prefLang=de.
General Information on Data Storage and Deletion
We delete personal data that we process in accordance with statutory provisions as soon as the underlying consents are revoked or no further legal bases for processing exist. This applies when the original processing purpose ceases or the data is no longer required. Exceptions exist where statutory obligations or overriding interests necessitate longer retention or archiving of the data.
In particular, data subject to retention for commercial or tax purposes, or necessary for asserting legal claims or protecting the rights of other natural or legal persons, must be archived accordingly.
Our privacy notices provide additional information on retention and deletion specific to certain processing activities. Where multiple retention periods or deletion deadlines are specified for a data category, the longest period applies. Data retained not for the original purpose but due to statutory requirements or other reasons are processed solely for the purposes justifying their retention.
Retention and Deletion Periods
The following general retention and archiving periods apply under German law:
-
10 years: Retention period for books and records, annual financial statements, inventories, management reports, opening balance sheets, and related work instructions or organizational documents (§ 147(1) no. 1 in conjunction with (3) AO, § 14b(1) UStG, § 257(1) no. 1 in conjunction with (4) HGB).
-
8 years: Accounting documents such as invoices and expense receipts (§ 147(1) nos. 4 and 4a in conjunction with (3) sentence 1 AO, and § 257(1) no. 4 in conjunction with (4) HGB).
-
6 years: Other business documents, including received commercial or business correspondence, copies of sent commercial or business correspondence, and other documents relevant for taxation (e.g., time sheets, operational settlement sheets, cost calculation documents, price markings, payroll documents unless they are accounting documents, and cash register tapes) (§ 147(1) nos. 2, 3, 5 in conjunction with (3) AO, § 257(1) nos. 2 and 3 in conjunction with (4) HGB).
-
3 years: Data required to address potential warranty or damage claims, similar contractual claims and rights, and related inquiries, based on prior business experience and standard industry practices, retained for the regular statutory limitation period of three years (§§ 195, 199 BGB).
Period Start
Unless a period begins on a specific date, and provided it is at least one year, it commences at the end of the calendar year in which the triggering event occurred. For ongoing contractual relationships involving data storage, the triggering event is the effective date of termination or other end of the legal relationship.
Rights of Data Subjects
Rights under the GDPR
As a data subject, you have various rights under the GDPR, particularly under Articles 15 to 21:
-
Right to Object: You have the right to object, on grounds relating to your particular situation, at any time to processing of personal data concerning you which is based on Article 6(1)(e) or (f) GDPR; this also applies to profiling based on those provisions. Where personal data are processed for direct marketing purposes, you have the right to object at any time to processing of personal data concerning you for such marketing, including profiling to the extent that it is related to such direct marketing.
-
Right to Withdraw Consent: You have the right to withdraw any given consents at any time.
-
Right of Access: You have the right to request confirmation as to whether relevant data are being processed and to obtain access to such data, along with further information and a copy of the data, in accordance with statutory requirements.
-
Right to Rectification: In accordance with statutory requirements, you have the right to request completion of your data or rectification of inaccurate data concerning you.
-
Right to Erasure and Restriction of Processing: In accordance with statutory requirements, you have the right to request immediate erasure of data concerning you or, alternatively, restriction of processing of the data in accordance with statutory requirements.
-
Right to Data Portability: You have the right to receive data concerning you which you have provided to us in a structured, commonly used, and machine-readable format, or to request transmission thereof to another controller, in accordance with statutory requirements.
-
Right to Lodge a Complaint with a Supervisory Authority: Without prejudice to any other administrative or judicial remedies, you have the right to lodge a complaint with a supervisory authority, particularly in the Member State of your habitual residence, place of work, or place of the alleged infringement, if you consider that the processing of personal data relating to you infringes the GDPR.
Further Notes on Processing Activities, Procedures, and Services
Provision of Online Offering on Rented Storage Space
For the provision of our online offering, we use storage space, computing capacity, and software rented or otherwise obtained from a corresponding server provider (also referred to as a “web hoster”).
Legal basis: Legitimate interests (Art. 6(1) sentence 1 lit. f GDPR).
Collection of Access Data and Logfiles
Access to our online offering is logged in the form of so-called “server logfiles.” Server logfiles may include the address and name of the retrieved web pages and files, date and time of retrieval, amount of data transferred, notification of successful retrieval, browser type and version, user’s operating system, referrer URL (previously visited page), and typically IP addresses and the requesting provider. Server logfiles may be used for security purposes, e.g., to prevent server overload (particularly in cases of abusive attacks, so-called DDoS attacks), and to ensure the utilization and stability of servers.
Legal basis: Legitimate interests (Art. 6(1) sentence 1 lit. f GDPR).
Deletion of data: Logfile information is stored for a maximum of 30 days and then deleted or anonymized. Data whose further retention is necessary for evidentiary purposes are exempt from deletion until the respective incident is finally clarified.
Email Dispatch and Hosting
The web hosting services we use also encompass the dispatch, receipt, and storage of emails. For these purposes, recipient and sender addresses, as well as further information related to email dispatch (e.g., involved providers) and the content of respective emails, are processed. The aforementioned data may also be processed for spam detection purposes. Please note that emails are generally not encrypted when sent over the internet. While emails are typically encrypted during transport, they are not (unless end-to-end encryption is used) on the servers from which they are sent and received. We therefore cannot accept responsibility for the transmission path of emails between sender and recipient on our server.
Legal basis: Legitimate interests (Art. 6(1) sentence 1 lit. f GDPR).
Use of Cookies
“Cookies” refer to technologies that store and retrieve information on users’ devices. Cookies may be used for various purposes, such as ensuring the functionality, security, and comfort of online offerings, as well as creating analyses of visitor flows. We use cookies in accordance with legal requirements. Where necessary, we obtain users’ prior consent; otherwise, we rely on our legitimate interests. This applies when storing and retrieving information is essential to provide expressly requested content and functions, such as storing settings and ensuring the functionality and security of our online offering. Consent may be withdrawn at any time. Clear information is provided on the scope and types of cookies used.
Notes on Legal Bases for Data Protection
Whether we process personal data using cookies depends on consent. If consent is given, it serves as the legal basis. Without consent, we rely on our legitimate interests, as explained in this section and in the context of the respective services and procedures.
Storage Duration
The following types of cookies are distinguished based on storage duration:
-
Temporary Cookies (also: Session or Sitzungscookies): These are deleted at the latest after a user leaves the online offering and closes their device (e.g., browser or mobile app).
-
Persistent Cookies: These remain stored even after the device is closed. For example, login status can be saved, and preferred content displayed directly upon revisit. Similarly, user data collected via cookies may be used for reach measurement. Unless explicitly informed of the type and duration of cookies (e.g., during consent collection), users should assume they are persistent with a duration of up to two years.
General Notes on Withdrawal and Objection (Opt-out)
Users may withdraw given consents at any time and object to processing in accordance with legal requirements, including via their browser’s privacy settings.
Data categories processed: Metadata, communication, and procedural data (e.g., IP addresses, timestamps, identification numbers, involved parties).
Data subjects: Users (e.g., website visitors, users of online services).
Legal bases: Legitimate interests (Art. 6(1) sentence 1 lit. f GDPR); Consent (Art. 6(1) sentence 1 lit. a GDPR).
Further Notes on Processing Activities, Procedures, and Services
Processing of Cookie Data Based on Consent
We deploy a consent management solution to obtain, record, manage, and revoke users’ consents for using cookies or the procedures and providers specified therein. This process handles consents, particularly for cookies and comparable technologies used to store, retrieve, and process information on users’ devices. Consents are obtained for using cookies and related processing, including specific processings and providers named in the consent management procedure. Users may manage and revoke consents. Consent declarations are stored to avoid repeated queries and provide proof of consent per legal requirements. Storage occurs server-side and/or in a cookie (so-called opt-in cookie) or similar technologies to associate consent with a specific user or device. Absent specific details on consent management providers, general notes apply: Consent storage lasts up to two years, generating a pseudonymous user identifier stored with the consent timestamp, scope details (e.g., cookie categories and/or service providers), and browser, system, and device information.
Legal basis: Consent (Art. 6(1) sentence 1 lit. a GDPR).
Blogs and Publication Media
We use blogs or similar means of online communication and publication (hereinafter “publication medium”). Reader data are processed for the purposes of the publication medium only to the extent necessary for its presentation, communication between authors and readers, or security reasons. Otherwise, reference is made to the information on processing visitor data to our publication medium within these privacy notices.
Data categories processed: Inventory data (e.g., full name, residential address, contact information, customer number, etc.); Contact data (e.g., postal and email addresses or telephone numbers); Content data (e.g., textual or visual messages and contributions, along with related information such as authorship or creation date); Usage data (e.g., page views and dwell time, click paths, usage intensity and frequency, device types and operating systems used, interactions with content and functions); Metadata, communication, and procedural data (e.g., IP addresses, timestamps, identification numbers, involved parties).
Data subjects: Users (e.g., website visitors, users of online services).
Purposes of processing: Feedback (e.g., collecting feedback via online forms); Provision of our online offering and user-friendliness.
Retention and deletion: Deletion in accordance with the details in the “General Information on Data Storage and Deletion” section.
Legal bases: Legitimate interests (Art. 6(1) sentence 1 lit. f GDPR).
Contact and Inquiry Management
When contacting us (e.g., by post, contact form, email, telephone, or via social media) and in the context of existing user or business relationships, the details of inquiring persons are processed to the extent necessary to respond to contact requests and any requested measures.
Data categories processed: Contact data (e.g., postal and email addresses or telephone numbers); Content data (e.g., textual or visual messages and contributions, along with related information such as authorship or creation date); Metadata, communication, and procedural data (e.g., IP addresses, timestamps, identification numbers, involved parties).
Data subjects: Communication partners.
Purposes of processing: Communication; Organizational and administrative procedures; Feedback (e.g., collecting feedback via online forms); Provision of our online offering and user-friendliness.
Retention and deletion: Deletion in accordance with the details in the “General Information on Data Storage and Deletion” section.
Legal bases: Legitimate interests (Art. 6(1) sentence 1 lit. f GDPR); Contract performance and pre-contractual inquiries (Art. 6(1) sentence 1 lit. b GDPR).
Further Notes on Processing Activities, Procedures, and Services
Contact Form
When contacting us via our contact form, email, or other communication channels, we process the personal data transmitted to us to respond to and handle the respective inquiry. This typically includes details such as name, contact information, and any further information provided that is necessary for appropriate processing. These data are used exclusively for the stated purpose of contact and communication.
Legal bases: Contract performance and pre-contractual inquiries (Art. 6(1) sentence 1 lit. b GDPR); Legitimate interests (Art. 6(1) sentence 1 lit. f GDPR).