Your data. Handled responsibly.

1. Data controller

The controller responsible for processing personal data on this website is:

2. Hosting and server logs

This website is hosted with lima-city. The hosting provider is TrafficPlex GmbH, Konsul-Smidt-Str. 90, 28217 Bremen, Germany. When you access the website, technically necessary access data may be processed, including your IP address, date and time of access, requested resource, browser and system details, and potentially referrer, error and security logs. The exact fields recorded and retention periods will be checked with the hosting provider before publication.

Where necessary, processing is based on Article 6(1)(f) GDPR to provide a secure, stable and functional website. Our legitimate interest is the secure and reliable operation of the website. A data processing agreement under Article 28 GDPR is in place with the hosting provider.

3. Enquiries and contact form

When you use the contact form, I process your name, email address, selected subject and message to respond to your enquiry and, where relevant, discuss a proposed project. You may also contact me directly by email. These details are not used for advertising.

The legal basis is Article 6(1)(b) GDPR where an enquiry concerns entering into or performing a contract. For other enquiries, Article 6(1)(f) GDPR applies (legitimate interest in responding to messages). The information requested is used solely to handle your enquiry.

The contact form is active. Messages are sent from the server to the ToRo-Media email inbox over an encrypted SMTP connection. Hosting and email delivery are provided through lima-city (TrafficPlex GmbH). Messages may be stored in the email inbox. They are deleted when no longer needed to handle the enquiry, unless statutory retention requirements or legitimate reasons justify longer storage. A single fixed retention period cannot be specified for all types of enquiries.

4. Cookies and session data

Language cookie “toro_language”: After you actively choose a language, this cookie remembers German or English for up to 365 days. Based on our previous technical review, it uses HttpOnly and SameSite=Lax.

Session cookie (e.g. “PHPSESSID”): The contact page uses a PHP session to protect against unwanted form submissions (CSRF) and limit how frequently messages can be sent. A session cookie may be set. Its exact lifetime depends on server configuration.

Where cookies are strictly necessary for a function you expressly request or for form security, accessing your device does not require prior consent under section 25(2) of the German TDDDG. Related personal data processing is based on Article 6(1)(f) GDPR or, where applicable, Article 6(1)(b). The final legal assessment remains subject to review.

5. Third-party services

Under the current technical design, no analytics or advertising services, externally embedded maps or videos, or fonts loaded from third-party servers are intentionally used. If this changes, this policy will be updated.

6. Your rights

Subject to applicable conditions, you have the right of access (Article 15 GDPR), rectification (Article 16), erasure (Article 17), restriction of processing (Article 18), data portability (Article 20) and objection to processing based on legitimate interests (Article 21). You may withdraw consent at any time with effect for the future.

7. Right to lodge a complaint

You may lodge a complaint with a data protection supervisory authority if you believe your personal data is being processed in breach of the GDPR (Article 77 GDPR).

8. Encryption and updates

The website is intended to be served exclusively over HTTPS. We update this privacy policy whenever technical processes, services or legal requirements change.

Before the business website goes live, the technical details regarding HTTPS, server logs, retention periods and the contact form will be reviewed.