Privacy Policy

Controller

The controller responsible for data processing on this website within the meaning of the General Data Protection Regulation (GDPR) is:

• IRIS KORALLE GmbH
• Brehmstr. 3, 40239 Düsseldorf, Germany
• Telephone: +49 152 33980013
• Email: info@iriskoralle.com

Summary

This website is a purely informational, statically delivered site. We process personal data in only two situations: when our hosting provider delivers the website to you (access data in server log files) and when you contact us by email or telephone.

This website does not set cookies. If you explicitly choose a light or dark design using the switch in the header, only this setting (“light” or “dark”) is saved in your browser’s local storage so that it is kept for your next visit. This information is not transmitted to us or to third parties, is strictly necessary for the function you requested (Section 25(2) no. 2 of the German Telecommunications Digital Services Data Protection Act, TDDDG) and can be deleted at any time in your browser settings. A cookie banner is therefore not required. A further exception: if our hosting provider displays a security check in your browser to protect against automated attacks (such as DDoS attacks), strictly necessary session information may be stored in your browser for up to one hour (Section 25(2) no. 2 TDDDG).

We do not use analytics or tracking services, tracking pixels, social media plugins or embedded third-party content such as maps or videos. This website has no contact forms, no user accounts and no newsletter.

The typeface used (Oxygen) is delivered together with the website by our hosting provider. No connection is made to Google Fonts or any other external font service.

Hosting and server log files

This website is hosted by Vercel Inc., 440 N Barranca Avenue #4133, Covina, CA 91723, USA (“Vercel”) and delivered via Vercel's global server network (content delivery network).

Each time the website is accessed, Vercel automatically processes data that your browser transmits for technical reasons or that arises during delivery (server log files). This includes in particular:

• The IP address of the requesting device and approximate location information derived from it
• The date and time of access
• The requested address (host, path and, where applicable, query parameters) and the HTTP method
• The referrer URL (the previously visited page), if your browser transmits it
• The user agent (browser type and version, operating system)
• The HTTP status code, cache status, request ID and region of the delivering server
• Security-related data such as TLS fingerprints and the result of the firewall check

Purpose, legal basis and retention for hosting

This processing serves to deliver the website, to ensure its stability and security, and to detect and defend against attacks and misuse. The legal basis is Article 6(1)(f) GDPR; our legitimate interest lies in providing our website securely, reliably and efficiently. We do not use this data for analytics or advertising purposes.

Vercel processes this data on our behalf under a data processing agreement (Data Processing Addendum) pursuant to Article 28 GDPR. In addition, Vercel processes certain usage data and metadata as an independent controller in order to operate, secure and improve its services; the legal basis for this is also Article 6(1)(f) GDPR. Further information is available in Vercel's privacy policy: https://vercel.com/legal/privacy-policy

Server log files are stored only for as long as is necessary for the operation and security of the website and are then deleted or anonymised. Vercel does not publish a fixed retention period for this data. For transfers to the USA, see the section “Transfers to third countries”.

Contact by email or telephone

The email and telephone links on this website merely open your own email application or telephone app. We only begin processing your data once your message or call reaches us.

If you contact us by email or telephone, we process the information you provide, in particular your name, your email address or telephone number, the content of your message and technical metadata such as the date and time, in order to handle and respond to your enquiry.

The legal basis is Article 6(1)(b) GDPR where your enquiry concerns a contract to which you are or wish to become a party, or serves to take steps at your request prior to entering into a contract. In all other cases, the legal basis is Article 6(1)(f) GDPR; our legitimate interest lies in responding to enquiries addressed to us.

Our email mailbox is operated via Google Workspace. Our contractual partner is Google Cloud EMEA Limited, 70 Sir John Rogerson's Quay, Dublin 2, Ireland. Google processes emails on our behalf under the Cloud Data Processing Addendum (Article 28 GDPR) and uses sub-processors for this purpose, including Google LLC in the USA. For transfers to third countries, see the section “Transfers to third countries”.

We delete your information once your enquiry has been fully dealt with and further storage is no longer necessary. Where the correspondence is subject to statutory retention obligations, we retain it for the statutory period, counted from the end of the calendar year: six years for commercial and business letters and eight years for accounting vouchers (Section 257 of the German Commercial Code, HGB; Section 147 of the German Fiscal Code, AO). The legal basis in this respect is Article 6(1)(c) GDPR.

External links

This website contains a link to the website of our brand MAVALOIR (https://mavaloir.com) and a link that opens our location in Google Maps. No data is transmitted to a linked website unless you click the link. Only when you click it does your browser connect to the linked website; data processing there is governed by the privacy information provided on that website.

Recipients of personal data

We use the following service providers in connection with this website and with contact enquiries, to the extent necessary for the purposes described. We disclose personal data to other third parties only where we are legally obliged to do so or where this is necessary for the establishment, exercise or defence of legal claims.

• Vercel Inc., USA: hosting and delivery of the website (processor; independent controller for its own usage data and metadata)
• Google Cloud EMEA Limited, Ireland, with sub-processors including Google LLC, USA: operation of our email mailbox (processor)

Transfers to third countries

Vercel Inc. and Google LLC are based in the USA. Personal data may therefore be processed in the USA when their services are used.

Both companies are certified under the EU-U.S. Data Privacy Framework. Transfers to the USA are therefore based on the European Commission's adequacy decision of 10 July 2023 (Implementing Decision (EU) 2023/1795, Article 45 GDPR). You can view the certifications at https://www.dataprivacyframework.gov/list.

Where the adequacy decision does not apply in an individual case, or where sub-processors process data in other third countries, the agreements with Vercel and Google provide for the European Commission's standard contractual clauses as appropriate safeguards (Article 46(2)(c) GDPR). You can request a copy of these safeguards from us using the contact details above.

Retention period

We store personal data only for as long as is necessary for the relevant purpose or as required by statutory retention periods. The criteria and periods for each processing activity are described in the relevant sections. Once the purpose no longer applies and no retention obligations exist, the data is deleted.

Your rights

Subject to the statutory requirements, you have the following rights. To exercise them, an informal message to info@iriskoralle.com or to our postal address stated above is sufficient.

• Access to the data processed about you (Article 15 GDPR)
• Rectification of inaccurate data or completion of incomplete data (Article 16 GDPR)
• Erasure of your data (Article 17 GDPR)
• Restriction of processing (Article 18 GDPR)
• Data portability (Article 20 GDPR)
• Objection to processing (Article 21 GDPR, see below)
• Lodging a complaint with a supervisory authority (Article 77 GDPR, see below)

Right to lodge a complaint with a supervisory authority

Without prejudice to any other remedy, you may lodge a complaint with a data protection supervisory authority, in particular in the EU Member State of your habitual residence, place of work or place of the alleged infringement (Article 77 GDPR). The supervisory authority competent for us is:

• Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen (State Commissioner for Data Protection and Freedom of Information of North Rhine-Westphalia)
• Kavalleriestr. 2-4, 40213 Düsseldorf, Germany
• Postal address: Postfach 20 04 44, 40102 Düsseldorf, Germany
• Telephone: +49 211 38424-0
• Email: poststelle@ldi.nrw.de
• Website: https://www.ldi.nrw.de

Provision of data and automated decision-making

You are under no statutory or contractual obligation to provide us with personal data. However, the website cannot be delivered without the connection data transmitted for technical reasons when it is accessed, in particular the IP address. Without your contact details, we cannot respond to your enquiry.

No automated decision-making, including profiling, within the meaning of Article 22 GDPR takes place.

SSL/TLS encryption

This website is delivered exclusively via a TLS-encrypted connection (HTTPS). Data transmitted between your browser and the server is therefore encrypted and cannot easily be read by third parties. You can recognise an encrypted connection by “https://” in your browser's address bar.

Changes to this privacy policy

We will update this privacy policy if the website, the services used or the legal requirements change. The current version published on this website applies.