The controller’s full contact details are stated in the site notice.
1. Controller and contact
The controller is Timo Braun, IT Dienstleistungen Timo Braun, trading as Host Universe. Current public contact details are stated in the site notice. Privacy requests may be sent to timo.braun@host-universe.com.
2. Website delivery and server logs
When the website is accessed, the server processes in particular the IP address, time, requested resource, referrer, browser identification and status code. This is required for delivery, stability, troubleshooting and defence against abusive access. The legal basis is Art. 6(1)(f) GDPR; our legitimate interest is secure and reliable operation. Security logs are retained only as long as needed for these purposes and for investigating specific incidents.
3. Essential cookies and customer accounts
The application uses essential session and security cookies for login, language selection, session handling and protection against forged requests. The legal basis is Art. 6(1)(b) or (f) GDPR depending on the context. In customer accounts we process master, contact, contract, role, support, security and usage data to initiate and perform contracts, provide booked products and protect access.
4. Audience measurement with Matomo
We operate Matomo on our own infrastructure at matomo.host-universe.com. By default, measurement works without an analytics cookie; Do Not Track is honoured and the IP address is shortened before permanent storage. The legal basis is Art. 6(1)(f) GDPR and our interest in privacy-conscious improvement. The analytics_storage cookie is used only after the voluntary choice to allow recognition, based on Art. 6(1)(a) GDPR. The choice is stored in cookie_consent and can be withdrawn by deleting these cookies.
5. Contact and application forms
For contact and product requests we process the submitted contact, company and message data to review and answer the request. For applications made through the product-request funnel, we additionally store time and IP address to evidence receipt and trace abuse. The legal basis is Art. 6(1)(b) GDPR for pre-contractual communication and otherwise Art. 6(1)(f) GDPR. Requests that do not result in a relationship are deleted when processing and evidence purposes cease.
6. Google reCAPTCHA and Google Fonts
Public forms are protected against automated abuse by Google reCAPTCHA. IP address, browser and interaction data may be transferred to Google. The current public interface also loads font files from Google Fonts. The provider is Google Ireland Limited; processing by affiliated companies outside the EEA cannot be ruled out. The legal basis is Art. 6(1)(f) GDPR and our interests in abuse prevention and consistent presentation. Where required, Google relies on the safeguards provided by law for third-country transfers.
7. Contracts, digital acceptance and billing
To perform contracts we process offers, products, commercial terms, contacts, invoices and payment data. For digital contract acceptance we store the complete document versions, declaration text, name and role of the declarant, customer account, time, IP address, browser identification and cryptographic hashes. This serves conclusion, integrity verification and legal evidence under Art. 6(1)(b) and (f) GDPR. We retain tax and commercial records for the statutory periods.
8. Payment and infrastructure providers
Where necessary for contracts, payments, domains, hosting, backups or product operation, carefully selected providers receive the data required for their role. These may include payment, data-centre, hosting, domain and communications providers. Processors are bound under Art. 28 GDPR. Product-specific providers and locations are identified in the respective contract, processing agreement or subprocessor register.
9. Newsletter
We send newsletters only on the basis of consent. We process email address, name, subscription and unsubscribe data and necessary evidence. Consent can be withdrawn at any time via the unsubscribe link or by message. Limited suppression and evidence data may remain after unsubscribing to prevent further delivery and evidence the former consent.
10. Processing for customer products
For products such as Dispatch, Host Universe may process personal data on behalf of a business customer. The respective customer normally remains controller for recipient, content and business data. Scope, purposes, deletion, security measures and subprocessors are set out in the product-specific processing agreement. Data subjects should first contact the relevant sender or customer; we support that customer in handling requests.
11. Retention
We delete or anonymise personal data when contract, operation, security and evidence purposes cease and no legal obligation applies. Contract and billing records may be retained longer under commercial and tax law. Product-specific shorter periods, for example for message content or diagnostic raw data, are stated in the respective service description or processing agreement.
12. Rights and complaints
Subject to the statutory conditions, data subjects have rights of access, rectification, erasure, restriction, portability and objection, and may withdraw consent for the future. They may also complain to a data protection supervisory authority, in particular the authority responsible for the controller’s place of establishment.