Privacy

This privacy notice explains which personal data is processed when you visit cueliszt.com, for what purpose and on what legal basis. It covers this website only. The cueliszt app processes your catalog and your statements locally on your devices and in your private iCloud — that data never reaches our servers.

1. Controller

The controller for data processing on this website within the meaning of Art. 4(7) GDPR is: Jan Grimm, Sponheimer Str. 8, 55595 Mandel, Germany.

Contact for data-protection matters: hello@cueliszt.com.

No data protection officer has been appointed; the statutory conditions requiring one are not met.

2. Principle: as little as possible

This website is built so that it passes no data to third parties without your consent. No content is loaded from external servers — no font CDNs, no embedded videos, no external scripts. Without consent, no analytics take place.

3. Hosting and server logs

This website is hosted by ALL-INKL.COM — Neue Medien Münnich, owner René Münnich, Hauptstraße 68, 02742 Friedersdorf, Germany. The servers are located in Germany. A data-processing agreement pursuant to Art. 28 GDPR is in place with the provider.

When you access the website, the server automatically records technical access data in log files: IP address, date and time of access, the address requested, the amount of data transferred, notification of successful retrieval, browser type and version, operating system and the page previously visited (referrer).

The purpose is the secure and stable operation of the website and the prevention of attacks. The legal basis is Art. 6(1)(f) GDPR; our legitimate interest lies in the functioning and security of the service. The log files are deleted automatically by the host after a short period and are not merged with other data sources.

4. Encrypted transmission

The website is served exclusively over HTTPS; requests over unencrypted connections are redirected to HTTPS. What you send us is therefore protected against interception in transit.

5. Fonts (served locally)

The typeface used (Mona Sans) is loaded exclusively from our own server. There is no connection to third-party servers, in particular not to the Google Fonts CDN. Your IP address is not transmitted to anyone in order to load the font.

6. Consent management

On your first visit, a self-hosted consent banner asks for your choice for the Statistics and Marketing categories. “Accept” and “Reject” are presented as equals; without active agreement everything stays switched off.

Your choice, together with a timestamp and the version of this notice, is stored exclusively in your browser (localStorage). This storage serves to honour your decision and is not transmitted to us or to third parties. The legal basis for the storage is § 25(2) no. 2 TDDDG, as it is strictly necessary to provide the service you requested.

You can change or withdraw your choice at any time via “Cookie settings” in the footer. Withdrawal takes effect immediately: the related cookies are deleted and no further data is collected. The lawfulness of processing carried out up to that point remains unaffected.

If JavaScript is disabled in your browser, no banner appears — and no statistics or marketing service is loaded either.

7. Cookies, statistics and marketing

Technically necessary storage: apart from storing your consent decision as described above, this website sets no cookies of its own.

Without your consent, no statistics or marketing services are loaded and no related cookies are set. We use Google Consent Mode v2; all signals default to “denied” for as long as you do not agree. Only after your consent is Google Tag Manager (container GTM-T6V2QQ4C) loaded, through which the services below are integrated.

Statistics (only after consent): Google Analytics 4 (measurement ID G-623LX02FQ2), provider Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, D04 E5W5, Ireland. The purpose is to measure reach and usage in order to improve the service. Cookies are set and a truncated IP address as well as information about your device, browser and page views are processed. Data retention in GA4 is set to the shortest available setting. The legal basis is your consent under Art. 6(1)(a) GDPR in conjunction with § 25(1) TDDDG. A data-processing agreement is in place with Google.

Marketing: currently not active. We intend to use Google Ads for advertising measurement at a later stage — likewise only after prior consent. This notice will be updated accordingly before any activation. No Meta pixel is used.

Third-country transfer: using the Google services may involve a transfer of personal data to the USA. Google LLC is certified under the EU-US Data Privacy Framework, so an adequacy decision of the EU Commission serves as the basis; standard contractual clauses have been agreed in addition. A residual risk nevertheless remains that US authorities may access the data without effective legal remedies being available. By consenting, you also consent to this transfer (Art. 49(1)(a) GDPR).

8. Waitlist and newsletter

If you join the waitlist or the newsletter, we process your email address in order to send you the information you requested. Dispatch is handled by CleverReach GmbH & Co. KG, Schafjückenweg 2, 26180 Rastede, Germany. The data is processed on servers in Germany; a data-processing agreement pursuant to Art. 28 GDPR is in place with CleverReach.

We use the double-opt-in procedure: after signing up you receive an email containing a confirmation link. Only after you click that link are you added to the list. If you do not confirm, the entry is discarded after a short period.

To evidence your consent, your IP address, the page previously visited (referrer), your browser identification (user agent) and the time of the request are transmitted to CleverReach alongside your email address and stored there. This logging serves the accountability obligation under Art. 5(2) and Art. 7(1) GDPR and the evidentiary requirement of § 7 UWG.

The legal basis is your consent under Art. 6(1)(a) GDPR. You may withdraw it at any time — via the unsubscribe link at the end of every email or informally to our contact address. After withdrawal your data is deleted from the list; the record of consent is retained for as long as it is needed to defend against claims.

9. Contact form and email

Details submitted through the contact form (name, email address, message) are received on our server and forwarded by email to our mailbox. They are not stored permanently in a database. The same applies if you contact us by email directly.

The purpose is to handle your enquiry. The legal basis is Art. 6(1)(b) GDPR where the enquiry relates to entering into or performing a contract, otherwise Art. 6(1)(f) GDPR (legitimate interest in responding to enquiries).

Abuse prevention: to fend off automated bulk submissions we use a form field invisible to you, a minimum completion time and a cap on submissions per sender. For that cap your IP address is not stored in clear text but only as a non-descriptive check value together with timestamps, which expires after one hour at the latest. No captcha service is used. The legal basis is Art. 6(1)(f) GDPR.

Your enquiry and our reply are deleted as soon as they are no longer required and no statutory retention obligations prevent it.

10. Support requests

Requests to support@cueliszt.com — including those sent through the “Report a problem” form — arrive in our mailbox hosted in Germany, where they are read and answered. We process your email address and whatever details you provide in your message.

The purpose is to handle your request. The legal basis is Art. 6(1)(b) GDPR for enquiries relating to an existing or prospective contractual relationship, otherwise Art. 6(1)(f) GDPR.

We are preparing an automated ticketing workflow for this channel, which will involve further service providers. It is not in use at present. This notice will be extended to cover the recipients, purposes and retention periods involved before it goes live.

11. Recipients of your data

We pass on your data only where this is necessary for the purposes stated above or where you have consented. Current recipients are: our host (ALL-INKL.COM, Germany) for operation and email, CleverReach (Germany) for newsletter dispatch and — only after your consent — Google (Ireland/USA) for analytics.

No transfer to a third country takes place other than in the case described in section 7. Data is never sold.

12. No automated decision-making

No automated decision-making, including profiling, within the meaning of Art. 22 GDPR takes place.

13. Your rights

You have the right to obtain information about the data stored about you (Art. 15 GDPR), to rectification of inaccurate data (Art. 16), to erasure (Art. 17), to restriction of processing (Art. 18) and to data portability (Art. 20).

Right to object: where we process data on the basis of a legitimate interest (Art. 6(1)(f) GDPR), you have the right to object to that processing at any time on grounds relating to your particular situation (Art. 21 GDPR).

You may withdraw any consent given at any time with effect for the future, without affecting the lawfulness of processing carried out up to that point.

An informal message to hello@cueliszt.com is enough to exercise your rights.

14. Right to lodge a complaint

You have the right to lodge a complaint with a data-protection supervisory authority about the processing of your personal data. The authority responsible for us is: Der Landesbeauftragte für den Datenschutz und die Informationsfreiheit Rheinland-Pfalz, Hintere Bleiche 34, 55116 Mainz (https://www.datenschutz.rlp.de). You may also contact the supervisory authority of your habitual residence.

15. Changes to this privacy notice

We update this notice when the processing described here changes — for instance when a new service is added. The version published here at the time applies.