Privacy Policy

§1 Information on the collection of personal data (1) In the following, we provide information about the processing of personal data when using our website. Personal data is all data that can be related to you personally, e.g. name, address, e-mail addresses, user behavior. In this way, we would like to inform you about our processing operations and at the same time comply with the legal obligations, in particular those arising from the EU General Data Protection Regulation (GDPR). (2) The entity pursuant to Art. 4 (7) GDPR is: ānbāsan UG (haftungsbeschränkt) Flughafenstraße 59 70629 Stuttgart Germany e-mail: contact@anbasan.com If you have any questions about data protection, please contact the aforementioned contact. (3) When you contact us by e-mail or via a contact form, the data you provide (your e-mail address, your name and telephone number if applicable) will be stored by us in order to answer your questions. We delete the data collected in this context - if the inquiry is assigned to a contract - after the contract period has expired. Otherwise, we delete the resulting data after the storage is no longer required, at most after three years after the data has been created at the end of the general limitation period or restrict the processing if there are statutory retention obligations. (4) If we use contracted service providers for individual functions of our offer or wish to use your data for advertising purposes, we will always carefully select and monitor these service providers and inform you in detail below about the respective processes. In doing so, we will also state the specified criteria for the storage period. §2 Your rights (1) You have the following rights vis-à-vis the responsible contact with regard to your personal data:

Right to information
Right to rectification or erasure
Right to restriction of processing
Right to opt-out of processing
Right to data transfer
Right to opt out of advertising and to withdraw consent.

(2) You also have the right to complain to a data protection supervisory authority about the processing of your personal data by us. Contact data protection supervisory authority: Competent authority: State Commissioner for Data Protection and Freedom of Information Baden-Württemberg, Königstraße 10a, 70173 Stuttgart; e-mail: poststelle@lfdi.bwl.de poststelle@lfdi.bwl.de §3 Processing of personal data when visiting our website When using the website for information purposes, i.e. simply viewing it without registering and without providing us with any other information, we process the personal data that your browser transmits to our server. The data described below is technically necessary for us to display our website to you and to ensure stability and security and must therefore be processed by us. The legal basis is Art. 6 para. 1 sentence 1 lit. f GDPR:6

IP address
Date and time of the request
Time zone difference to Greenwich Mean Time (GMT)
Content of the request (page visited)
Access status/HTTP status code
Amount of data transferred
Previously visited page
Browser
Operating system
Language and version of the browser software.

§4 Further functions and offers of our website (1) In addition to the purely informational use of our website, we offer various services that you can use if you are interested and use other common functions to analyze or market our offers, which are presented in more detail below. For this purpose, you must generally provide additional personal data or we process such additional data that we use to provide the respective services. The aforementioned data processing principles apply to all data processing purposes described here. (2) In some cases, we use external service providers to process your data. These are carefully selected by us, are bound by our instructions and are regularly monitored. (3) Furthermore, we may pass on your personal data to third parties if we offer participation in promotions, competitions, contracts or similar services together with partners. Depending on the service, your data may also be collected by the partners on their own responsibility. You will receive more detailed information when you provide your data or below in the description of the respective offers. (4) If our service providers or partners are based in a country outside the European Economic Area (EEA), we will inform you of the consequences in the description of the offer. §5 Revocation or objection to the processing of your data (1) If you have given your consent to the processing of your data, you can withdraw this at any time. Such a revocation affects the permissibility of the processing of your personal data after you have given it to us. The permissibility of the processing of your data up to the time of your revocation remains unaffected. (2) Insofar as we base the processing of your personal data on the balancing of interests, you can object to the processing. This is the case if, in particular, the processing is not necessary for the performance of a contract with you, which is described by us in the following description of the functions. When exercising such an objection, we ask you to explain the reasons why we should not process your personal data as we have done. We will then examine the situation and will either adapt or discontinue the data processing or show you our compelling reasons worthy of protection on the basis of which we will continue the processing. (3) You can object to the processing of your personal data for advertising and data analysis purposes at any time. The best way to object to advertising is to contact us using the contact details provided above. §6 Processing of data from your end devices (so-called “cookie policy”) (1) In addition to the processing mentioned under § 3, we use technical tools that can be stored on your end device (e.g. cookies, advertising IDs, HTML5 objects) when you use our website. You can give or withdraw your consent at any time via the Consent Manager; technically necessary cookies are excluded from this and are required for the operation of the website. (2) Types and purposes of cookies/technologies: Necessary cookies (technically required):

Session cookies, which are required for login/authentication, load balancing or security (e.g. CSRF protection). These are deleted at the end of the session.
Other system-relevant cookies or local storage mechanisms without which basic functions would not be possible.
Legal basis: legitimate interest in the operation, security and functionality of the website (Art. 6 para. 1 lit. f GDPR).
Revocation option: These cookies cannot be deactivated if you wish to use the website.

Preference and statistics cookies (only with consent):

Cookies/technologies that enable us to analyze usage data (e.g. page views, dwell times, interactions) in order to make the website more user-friendly. This also includes Google Analytics (see § 7).
Legal basis: Consent (Art. 6 para. 1 lit. a GDPR).
Storage period: Specified in the consent list depending on the provider; personal links are deleted or anonymized after the retention period specified in the tool has expired.
Revocation option: Via the Consent Manager or browser settings or opt-out add-ons (e.g. Google Analytics Opt-out Browser Add-on)

Marketing/targeting cookies (only with consent):

Technologies for streaming interest-based content or advertising based on your surfing behavior.
We only use these if you have expressly consented to this.
Legal basis: Consent (Art. 6 para. 1 lit. a GDPR).
Revocation option: As above via Consent Manager or directly via the provider opt-out options.

(3) We use a consent manager that blocks the loading of scripts/cookies for statistical or marketing purposes until you have given your consent. You can change or revoke your selection at any time. We document the date/time of consent and revocation. Technically necessary cookies are also set without consent, as they are essential for operation. (4) Specific cookie lists are linked to the respective sites (to the provider) or listed here: Google Ads Cookies (Product(s)/Google Ads). The information includes the name of the cookie/technology, provider, purpose, and storage period. (5) If you refuse consent to statistics or marketing cookies, you can continue to use the website; however, some analysis functions and personalized offers will not be active. §7 Use of external services and tools (1) We use various third-party services on our website to provide functions, conduct email marketing or analyze our offering. Below we explain the most important services MailPoet and Google Analytics. For each service, we state the purpose, data categories, legal basis, storage duration, responsibilities, third country transfer and rights of data subjects. 7.1 Mailpoet (1) Provider and role. The controller of the website is ānbāsan UG, while Automattic Inc, 60 29th Street #343, San Francisco, CA 94110, USA acts as data processor. A Data Processing Agreement (DPA) with Automattic Inc. has been concluded or can be requested (2) Purpose of the processing

Sending newsletters and email campaigns directly from the WordPress backend.
Collection of opening and click statistics to optimize and improve our newsletter offers.

(3) Data categories

Upon registration: e-mail address, if applicable name (first and last name).
Documentation of consent: IP address and timestamp of registration/confirmation (double opt-in).
Technical metadata: Browser and operating system information, hosting environment (depending on MailPoet/WordPress hosting configuration).
Behavioral data: Opening time of the newsletter, click events on links in the newsletter (tracking pixel/link tracking).

(4) Legal bases

Consent (Art. 6 para. 1 lit. a GDPR): The e-mail address and name are collected with your express consent when you subscribe to the newsletter (double opt-in).
Proof of consent (Art. 6 para. 1 lit. c GDPR): Storage of IP address and time stamp in order to document consent in a legally compliant manner.
Legitimate interest (Art. 6 para. 1 lit. f GDPR): Processing of opening and click data in order to optimize our offer in a user-friendly manner. A balancing of interests was carried out: The optimization of our service does not outweigh your interests, as the data is evaluated in pseudonymized aggregated form.
Legal storage obligations: If, in individual cases (e.g. accounting evidence), certain data must be stored for longer, this will be justified separately.

(5) Storage period

E-mail address/name: Until you unsubscribe. After revocation (unsubscription), the personal data will be deleted, unless there is another legal basis (e.g. statutory retention period) to the contrary.
IP address/time stamp (proof of consent): Only as long as necessary (usually approx. 30 days), then erasure.
Opening/click data: Stored in pseudonymized or aggregated form; personal links are removed after logout. Aggregated reports (e.g. total opening rates) may remain longer, provided that no conclusions can be drawn about individuals.
Backups/caches (Automattic): Deleted data remains temporarily in backups/caches until the regular deletion routine; typical period at Automattic: a few weeks to months

(6) Third country transfer Data is processed on servers in the USA. Automattic is a participant in the EU-US Data Privacy Framework (status: according to Automattic information) and uses standard contractual clauses (SCC) for data transfers to third countries to ensure a European level of data protection. We would like to point out that the legal assessment of EU-US transfer mechanisms may change; we regularly check whether additional technical/organizational measures are necessary. (7) Rights of data subjects

You can request information about your data stored by us at any time and request correction or deletion. The easiest way to revoke your newsletter consent is to use the unsubscribe link in every email or by sending a contact request to contact@anbasan.com. After revocation, the data will be deleted, unless statutory retention obligations exist.
We log consent and unsubscription data in order to fulfill our obligation to provide evidence.

(8) Miscellaneous

Privacy Notice Automattic: Privacy

7.2 Google Analytics (GA4) (1) Provider and role: As the operator of the website, we are responsible for data processing. Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Ireland) acts as a processor or, in certain aspects, as a (joint) controller if Google pursues its own purposes. A data processing agreement (Data Processing Amendment) is in place with Google in accordance with the Google Terms (see Google Analytics Terms). (2) Purpose of processing Analysis of user behavior on the website (e.g. page views, length of stay, interactions) in order to improve the website and make it more user-friendly. (3) Data categories

Technical data: Browser and device information, screen resolution, operating system.
Session data: page views, events, dwell time, bounce rate.
IP address: is automatically anonymized (IP anonymization is activated by default in GA4, EU data is first routed via EU servers
Other identifiers: device IDs, user ID functions only if activated and covered by consent.

(4) Legal bases

Consent (Art. 6 para. 1 lit. a GDPR): Before activation, cookies/scripts are only loaded with your express consent (Consent Manager). No Google Analytics tracking is carried out without consent.
Legitimate interest (Art. 6 para. 1 lit. f GDPR): Only for technically necessary purposes (e.g. basic stability measurements without profiling) if consent is not required for this. Detailed analyses are only carried out with consent. A balancing of interests has been documented: The interest in website optimization is relevant, but we maintain data protection by anonymizing IP, minimizing data and only collecting it with consent.

(5) Consent process

Use of a consent manager: The analytics script is only loaded and tracking cookies are only set after your active consent.
Documentation of consent including timestamp and selection.
Revocation at any time via Consent Manager or additionally via opt-out add-on: Google Analytics Opt-out

(6) IP anonymization & EU data processing GA4 automatically anonymizes IP addresses so that no full IP is stored. Data from EU devices is first processed via Google servers in the EU before being forwarded to other regions (7) Storage period In the GA settings, the data retention period is limited to 14 months; after this period, personal identifiers are deleted or anonymized. Aggregated statistics may remain longer, without reference to individuals (8) Third country transfer Google processes data partly in the USA; transfers are made on the basis of standard contractual clauses (SCC) and the EU-US Data Privacy Framework. We would like to point out that despite technical measures, there may be a residual risk, particularly in light of current discussions on data protection law. Additional measures (e.g. consent mode, server-side tracking) are being examined in order to further minimize risks. (9) Rights of data subjects

Information, rectification, erasure, restriction: Your rights also apply to data processed via Google Analytics. You can request information about the data stored about you (via us or directly from Google in accordance with their procedures).
Withdrawal of consent: Possible at any time via Consent Manager or opt-out add-on.

(10) Miscellaneous

Google Analytics Privacy & Terms: GA Privacy Terms
Opt-out-Add-on: Google Analytics Opt-out

7.3  Google Ads Conversion Tracking (1) Provider and role: ānbāsan UG is responsible for this website. Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, acts as a data processor within the meaning of the GDPR. A Data Processing Agreement (DPA) in accordance with Art. 28 GDPR has been concluded with Google and can be requested. (2) Purpose of processing

Analysis of user behavior on the website (e.g., page views, length of stay, interactions) in order to improve the website and make it more user-friendly.
Optimization of our advertising budget by calculating the cost-benefit factor (ROI) and continuous improvement of our online marketing measures.
Adapting website content and ad relevance to the interests of users.

(3) Data categories

Cookie identifiers and campaign parameters (e.g., _gac, conversion, _gads).
Timestamp of the ad click and conversion.
Device and browser metadata (user agent, operating system, IP address in truncated form, if applicable).
Pseudonymized interaction and transaction data (e.g., product purchase, form submission, newsletter opt-in).

Note: No directly identifiable personal data such as names or email addresses are transmitted to Google; we only receive aggregated reports. (4) Legal basis

Consent (Art. 6(1)(a) GDPR): Setting conversion cookies and reading data after express consent via our cookie banner.
Legitimate interest (Art. 6(1)(f) GDPR): Processing of anonymized statistics for the economic optimization of our advertising. A balancing of interests shows that this use does not outweigh your rights, especially since the data is pseudonymized.

(5) Consent process

Use of a consent manager: The Google Ads script is only loaded and tracking cookies are only set after you have given your active consent.
Documentation of consent including timestamp and selection.
Revocation at any time via consent manager.

(6) Storage period

Cookies Conversion and _gac: up to 90 days; Cookies __gads: up to 13 months (Google default setting).
Aggregated conversion reports: 24 months, followed by automatic deletion or further storage only in statistically aggregated form without personal reference.
Server log data at Google: usually 26 months; IP addresses are anonymized after a maximum of 9 months.

(7) Third-country transfer Data may be processed on servers belonging to Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA. Google participates in the EU-US Data Privacy Framework (as of July 2025) and thus guarantees a recognized level of data protection. In addition, standard contractual clauses (SCC) pursuant to Art. 46 (2) GDPR apply. We regularly review whether additional technical/organizational measures are necessary. (8) Rights of data subjects

You may request access to your stored data at any time, have incorrect information corrected, or revoke your consent with future effect. The easiest way to deactivate tracking is via the unsubscribe/cookie banner or your browser settings.
You also have the right to erasure, restriction of processing, data portability, and to lodge a complaint with a data protection supervisory authority.

(9) Miscellaneous Google Ads settings: Google Ads Settings A complete list of cookies can be found on Google Cookies with the filter “Product(s)” under the item “Google Ads.” Google Privacy Policy: Google Privacy Policy By using our website after giving your consent, you agree to the data processing described above.