Privacy policy

Last updated: Darkmatter IT, Massing

https://cp.mam-jahn.de/datenschutz

Contents 18

This is a courtesy translation. Only the German version is legally binding.

The protection of your personal data is important to us. This privacy policy informs you under Art. 13 and 14 of the General Data Protection Regulation (GDPR) about which data we process when you visit our website, use the customer area and in connection with our hosting services, on what basis this is done and what rights you have. It is information and not part of our contracts.

(1) The controller within the meaning of the GDPR is:

  • Darkmatter IT (sole proprietorship), brand “MAM-JAHN”
  • Owner: Marco Andreas Martin Jahn
  • Goethestr. 8, 84323 Massing, Germany
  • Phone: +49 1525 7859999
  • Email: support@mam-jahn.de
  • Website: https://mam-jahn.de

(2) No data protection officer has been appointed, as the statutory requirements for an obligation to appoint one are not met. Please send data protection enquiries to support@mam-jahn.de with the subject “Datenschutz”.

(1) We process personal data on the following bases:

(a) Art. 6(1)(b) GDPR – for the performance of a contract with you or for taking pre-contractual steps (ordering, provisioning, support, billing)

(b) Art. 6(1)(c) GDPR – for compliance with legal obligations (e.g. tax retention, duties to provide information to authorities)

(c) Art. 6(1)(f) GDPR – for the purposes of our legitimate interests, in particular the security and stability of our systems, the defence against attacks and abuse, and the establishment, exercise or defence of legal claims

(d) Art. 6(1)(a) GDPR – your consent, where we obtain it in individual cases (e.g. for newsletters).

(2) For each processing operation we state the relevant basis.

(1) When you access our website, our web server automatically processes: IP address, date and time of access, page accessed, amount of data transferred, referrer URL, browser type and version and operating system.

(2) This data is technically necessary to deliver the website and serves security and error analysis (Art. 6(1)(f) GDPR).

(3) We store log files only for as long as necessary for security and error analysis and delete them afterwards; in the event of security-relevant incidents, individual entries may be kept longer until the matter is resolved.

(4) Our website and the customer area are operated on systems in data centers in Germany. Simply visiting the website involves no transfer to third countries; for service providers to which data may get to third countries, see § 7 para. 4 and § 10.

(5) When you open the website, it reloads prices, offers and operating figures from our own systems (customer area or catalog service). In the process this server receives your IP address and technical browser data and processes them as described in paragraphs 1 to 3.

(1) Our website does not set any cookies. It stores exactly two entries in your browser, solely for display purposes:

(a) in local storage (localStorage), the entry “mj-theme” with your choice of light or dark appearance; it stays until you delete it via the browser settings

(b) in session storage (sessionStorage), the entry “mj-intro”, which remembers that the intro animation has already been shown in this session; it is deleted when you close the tab or browser.

These entries do not leave your device and contain no personal data in the narrower sense. The website creates no further entries.

(2) The following applies separately to the customer area (sign-in, shopping cart, ordering): there we use only technically necessary cookies, namely (a) a session cookie (sign-in, shopping cart, language and currency selection), which is deleted when you close the browser or when the session expires, and (b) if enabled, a cookie to protect forms against misuse. They are necessary to provide the functions you have expressly requested and do not require consent (§ 25(2) no. 2 TDDDG, Art. 6(1)(f) GDPR). The same applies to the entries under paragraph 1.

(3) We do not use cookies for advertising, tracking or analytics purposes and do not embed any analytics services (e.g. Google Analytics).

(4) When you open the payment process, you are redirected to the payment page of our payment service provider Mollie (Mollie B.V., Amsterdam, Netherlands). In the process, your IP address and technical data of your browser are transmitted to Mollie. Mollie may set its own technically necessary cookies for fraud prevention; Mollie is responsible for these (see § 7 para. 4). The redirection is necessary for the secure processing of the payment (Art. 6(1)(b) GDPR, § 25(2) no. 2 TDDDG).

(1) For registration and ordering we process: name, address, email address, phone number (optional), where applicable company and VAT ID, your access data (password only as a hash), the services ordered and the associated technical data (e.g. hostname, assigned IP addresses and, where booked, VPN keys), as well as invoice and payment history. If you activate automatic top-up, we also store a reference to the payment method stored at Mollie and its masked label (e.g. “Visa •••• 4242”). The legal basis is Art. 6(1)(b) GDPR. We do not ask for a date of birth; a phone number is voluntary and is used exclusively to contact you in case of urgent faults.

(2) To prevent misuse and fraud, we also store the IP address and the time at registration and ordering (Art. 6(1)(f) GDPR). We log sign-ins to the customer area and actions taken there (e.g. ordering, cancellation, restart or reinstallation of a server, changes to master data) with time and IP address, in order to protect your account, detect misuse and be able to trace events (Art. 6(1)(b) and (f) GDPR).

(1) On the servers, in web hosting, on Storage Boxes and, where booked, in VPN accesses you have booked, you alone decide which data is stored there. Where you process personal data of third parties there (e.g. data of your users, visitors or customers), you are the controller; we act as processor under Art. 28 GDPR and access this content only to the extent necessary to provide the service, to resolve faults at your request, to avert danger or because of a legal obligation.

(2) We provide a data processing agreement on request to support@mam-jahn.de.

(3) For the operation of the platform we process technical data of your services (resource utilization, total network traffic, connection metadata in firewall and system logs) on the basis of Art. 6(1)(b) and (f) GDPR; connection logs are stored only for as long as necessary for operation and the defence against misuse. The content of connections (including VPN connections, where booked) is not logged.

(1) Payments are processed exclusively through our payment service provider Mollie. We transmit to Mollie the data required for the payment (amount, invoice number, name and email address); you enter your payment data (e.g. card number, bank details) directly with Mollie or with the payment method you choose; we do not store it. If you activate automatic top-up, Mollie stores the payment method chosen for it; we hold only a reference to this payment method and a masked label (e.g. “Visa •••• 4242”). You can switch off automatic top-up and remove the payment method in the customer area at any time.

(2) The legal basis is Art. 6(1)(b) GDPR.

(3) For bank transfers, we process the data contained on the bank statement or in the payment notification from Mollie (name, IBAN, payment reference) to allocate the payment. Mollie’s privacy notice is available at https://www.mollie.com/de/privacy.

(4) The payment service provider is Mollie B.V., Keizersgracht 126, 1015 CW Amsterdam, Netherlands. Mollie is based in the EU. The payment methods credit and debit card, Apple Pay, Google Pay, PayPal, EPS, bank transfer, Klarna, Pay by Bank and paysafecard are offered through Mollie. If you choose a payment method of a further provider (e.g. PayPal, Klarna, Apple Pay or Google Pay), that provider additionally receives the data required for the payment as part of the payment and processes it under its own responsibility in accordance with its privacy notice. Data may also be transferred to countries outside the EU in the process; the basis is the respective adequacy decision of the EU Commission (e.g. EU-US Data Privacy Framework) or standard contractual clauses have been agreed. When you open the payment process, your IP address and technical data are transmitted to Mollie (see § 4 para. 4).

(5) Mollie and the selected payment methods may carry out fraud and credit checks under their own responsibility.

(6) If you do not want to transmit data to a payment method of a further provider, you can pay by bank transfer.

(7) Support pages: If you make a contribution via a support page (pages under the path “/spenden/” on https://mam-jahn.de), we process the amount, the time, the chosen page, Mollie's payment reference and your email address (stored encrypted, for the payment confirmation and queries) and, if you provide them, your name and a message. The legal basis is Art. 6(1)(b) GDPR. The page owner sees the amount, the time and your name and message if you provide them, but not your email address. Your name and message also appear publicly on the page if the page owner shows the list of supporters; without a name you appear there as “Anonymous”. Messages can be hidden afterwards by the page owner or by us. The data of the contribution is deleted 400 days after payment unless a statutory retention obligation for accounting records prevents this; it is then blocked until the period expires. The title, text and image of a support page are public; the page owner is responsible for them.

(1) If you contact us by email, via the contact form or via the ticket system, we process your details (name, email address, content of the enquiry, time) to handle the enquiry (Art. 6(1)(b) GDPR, for general enquiries Art. 6(1)(f) GDPR). Tickets are stored in the customer area so that you and we can follow the history; we delete closed tickets as soon as they are no longer needed, at the latest when your account is anonymized (§ 11), unless they are needed for ongoing contractual relationships, evidence of contracts or legal claims.

(2) We send transactional emails (order and payment confirmations, invoices, fault and maintenance notices, cancellation confirmations) that are necessary for the performance of the contract. We send emails through our own mail server, not through an external delivery service. You only receive promotional emails if you have agreed to this in the customer area; you can withdraw your consent there at any time.

§ 9 Reports of illegal content (abuse)

(1) You can report illegal or abusive content and activities on services provided by us (e.g. spam, phishing, malware, attacks, copyright infringements) to us by email to support@mam-jahn.de; details are given at https://mam-jahn.de/dsa/.

(2) In doing so, we process your name and contact details, if you provide them, the content of the report including evidence (e.g. log excerpts, addresses, timestamps, screenshots) and the time of receipt.

(3) We use this data to examine the report, clarify the facts, take measures (e.g. request for comment, blocking, termination) and document the handling.

(4) We forward the content of the report to the customer concerned to the extent necessary for clarification; we only pass on your contact details if this is indispensable for clarification or we are legally obliged to do so. In the case of indications of criminal offences, we may involve the competent authorities.

(5) The legal bases are Art. 6(1)(c) GDPR in conjunction with Art. 16 of Regulation (EU) 2022/2065 (Digital Services Act) and Art. 6(1)(f) GDPR (secure and lawful operation of our services).

(6) We store reports and the documentation of their handling for as long as necessary for handling, evidence and possible legal claims, and delete them afterwards.

(1) We only disclose personal data to the extent necessary to perform the contract, you have consented, or we are legally obliged to do so.

(2) Recipients may be: data center and network operators (see paragraph 3), payment service providers (§ 7), Discord (see paragraph 4), our tax adviser, and domain registrars and registries if you order a domain (they require the transmission of holder data).

(3) dataforest GmbH operates the data center and network connectivity for us. The upstream DDoS filtering processes IP addresses and connection data of the traffic to our systems in the process. dataforest has no access to your content.

(4) Discord receives data only if you use the Discord link on our website or use our service bot on Discord; processing there is under Discord’s own responsibility in accordance with its privacy notice, and data may reach third countries (e.g. the USA).

(5) Service providers that process data on our behalf are bound by contracts under Art. 28 GDPR.

(6) A transfer to countries outside the EU or the EEA only takes place if an adequacy decision or suitable safeguards (standard contractual clauses) exist for it, or if it is necessary for the performance of the contract (e.g. registering a domain with a non-European registry). We do not sell data.

(1) We store personal data only for as long as necessary for the respective purpose: account and contract data for the duration of the contractual relationship and 30 days beyond, after which we anonymize the account unless a statutory retention obligation prevents this. Invoices and accounting records and the master data required for them are kept for the statutory periods (currently as a rule 8 years, § 147 AO, § 257 HGB); commercial and business letters 6 years. For server log files, support tickets and abuse reports, the statements in §§ 3, 8 and 9 apply: they are deleted as soon as they are no longer needed.

(2) After expiry, the data is deleted or anonymized, unless legal claims require longer retention.

(3) You can have your customer account deleted at any time via support, as soon as no service is running and no claims are outstanding; data subject to a statutory retention obligation is then blocked until the period expires, and the rest is anonymized.

(1) You have the following rights towards us: access to the data stored about you (Art. 15 GDPR); rectification of inaccurate data (Art. 16 GDPR); erasure (Art. 17 GDPR); restriction of processing (Art. 18 GDPR); data portability (Art. 20 GDPR); withdrawal of consent given, with effect for the future (Art. 7(3) GDPR).

(2) You also have the right to object at any time, on grounds relating to your particular situation, to processing based on Art. 6(1)(f) GDPR (Art. 21 GDPR); you can object to direct marketing without giving reasons.

(3) An email to support@mam-jahn.de is sufficient to exercise your rights.

(4) You can also view and change much of your data (master data, contact data, email settings) yourself in the customer area.

(1) You have the right to lodge a complaint with a data protection supervisory authority if you believe that the processing of your personal data violates the GDPR (Art. 77 GDPR).

(2) The supervisory authority responsible for us is: Bayerisches Landesamt für Datenschutzaufsicht (BayLDA), Promenade 18, 91522 Ansbach, www.lda.bayern.de. You can also contact the supervisory authority of your place of residence.

(1) We use technical and organizational measures in line with the state of the art to protect your data against loss, manipulation and unauthorized access (Art. 32 GDPR): transport encryption (TLS) for the website, customer area and email delivery, two-factor authentication for the customer area, firewalls and access restrictions, separate networks for management and customer systems, regular security updates, and encrypted, geographically separated backups of our own systems.

(2) Despite all measures, absolute security cannot be guaranteed.

(1) Providing the data named in § 5 is necessary for the conclusion and performance of a contract; without it we cannot provide the services.

(2) All other details are voluntary.

(3) There is no automated decision-making including profiling within the meaning of Art. 22 GDPR; automated checks during ordering (e.g. plausibility of the details) only lead to a manual follow-up check by us.

(1) We adapt this privacy policy when the legal situation, our services or the service providers used change.

(2) The current version is available at https://mam-jahn.de/datenschutz/; the date of the last update is shown at the top.

(3) For material changes that affect you as a customer, we additionally inform you by email.