Privacy policy

1. General information and scope

We take the protection of your personal data seriously and strictly comply with the rules of the EU General Data Protection Regulation (GDPR) and the German Federal Data Protection Act (BDSG). This privacy policy informs you in accordance with Art. 13 and Art. 14 GDPR about what data is processed when you visit our website jd-media.net and use our services, for what purposes and on what legal basis.

Personal data is any information relating to an identified or identifiable natural person (Art. 4 No. 1 GDPR).

2. Data controller

The data controller within the meaning of Art. 4 No. 7 GDPR is:

JD Media GmbH · Nördliche Münchner Str. 9c · 82031 Grünwald near Munich · Germany

Represented by Managing Director Jasko Demic

Phone: +49 89 250039400

Email: kontakt@jd-media.net

3. Contact for data protection matters

We are not obligated to appoint a data protection officer under § 38 BDSG. For all questions regarding data protection, to exercise your data subject rights or to report a data breach, you can reach us directly at:

Email: datenschutz@jd-media.net

4. Legal bases for processing

Insofar as we obtain the data subject's consent for processing personal data, Art. 6 (1) (a) GDPR serves as the legal basis. For processing of data necessary for the performance of a contract or pre contractual measures, Art. 6 (1) (b) GDPR serves as the legal basis. For processing necessary to fulfil legal obligations Art. 6 (1) (c) GDPR. For processing based on legitimate interests of our company or a third party Art. 6 (1) (f) GDPR.

• Art. 6 (1) (a) GDPR, consent (e.g. newsletter, contact form)
• Art. 6 (1) (b) GDPR, contract performance and pre contractual measures
• Art. 6 (1) (c) GDPR, legal obligation (e.g. commercial and tax retention periods)
• Art. 6 (1) (f) GDPR, legitimate interest (technically functional website operation, reach measurement, IT security)
• § 25 (2) (2) TDDDG. Storage of information strictly necessary for technical reasons (not relevant for our website as no cookies are set)

5. Hosting and data security

This website is hosted on our own bare metal servers in the Nessus GmbH data center in Vienna (Austria, AS47692). These are servers located within the European Union. There is no third country transfer to the USA or other non EU countries. We do not use US cloud hyperscalers (AWS, Google Cloud, Microsoft Azure).

All data transmissions between your browser and our servers are TLS-encrypted (HTTPS, TLS 1.2 or higher). Data at rest on the servers is secured with LUKS full disk encryption.

The legal basis is Art. 6 (1) (f) GDPR. Our legitimate interest is the secure and reliable operation of our website.

6. Data collection when visiting the website (server logfiles)

Each time our website is accessed, our web server automatically collects information that your browser transmits to us. This data is temporarily stored in a so called logfile.

The following data is recorded:

• IP address of the requesting device
• Date and time of the request
• Requested URL and HTTP status code
• Browser and operating system used (user agent)
• Referrer (previously visited page, if transmitted)
• Volume of data transferred

7. Cookies

This website generally does not set cookies. No technically non essential cookies, no tracking cookies and no marketing cookies are used.

For this reason no cookie banner is shown on this website. Consent under § 25 TDDDG (German Telecommunications Digital Services Data Protection Act) is not required, as no storage requiring consent takes place on your device.

If this changes in the future (e.g. by integrating a booking tool), we will update this privacy policy and add an appropriate consent option.

8. Contact form and contact by email

When you send us inquiries via the contact form or by email, your details from the form including the contact data you provide will be stored by us for the purpose of processing the inquiry and for follow up questions.

The following data is collected in the contact form (mandatory fields marked with *):

• Salutation, first and last name *
• Email address *
• Subject / inquiry and message *
• Optional: phone number, preferred callback time, how you heard about us

9. Newsletter (double opt in)

If you would like to subscribe to our newsletter, we need your email address as well as information that allows us to verify that you are the owner of the email address provided and that you agree to receive the newsletter. Registration takes place using the double opt in procedure.

The following data is processed when registering for the newsletter and stored in the media_newsletter_subscribers table on our servers:

• Email address
• Language (DE/EN) for appropriate addressing
• IP address at registration and at confirmation (proof of consent)
• Browser identifier (user agent)
• Time of registration and confirmation

10. Web analytics with Plausible Analytics (self hosted)

On this website we use Plausible Analytics in our own self hosted instance at analytics.jd-media.net (servers in Vienna/Austria). Plausible is a data minimal, cookie free analytics solution that does not transmit personal data to third parties.

The following data is collected in aggregated, anonymous form:

• Page visited (URL path)
• Referrer (where you came from, e.g. google.com)
• Browser and operating system type (e.g. Chrome on Windows)
• Device type (desktop, tablet, smartphone)
• Country (derived anonymously from your IP address; your IP address is not stored)

Which interactions are recorded

In addition to plain page views, we use Plausible to record anonymous interaction events, that is which features of our website are used and how often. These events are purely non personal counts as well and do not allow any conclusions about individual people.

• Clicks on buttons and controls (e.g. opening menu items, switching language, expanding content)
• Playing the introduction videos and operating the player (e.g. start, pause, close)
• Use of interactive elements such as carousels, tabs and expandable sections
• Submitting forms with a purely categorical status only (e.g. successful or failed) and the selection options you chose, such as enquiry type or platform
• Clicks on outbound external links and downloads of files

The contents of your form entries, in particular name, e-mail address, phone number or message text, are never transmitted to the analytics. Only anonymous categories are stored.

What is NOT collected

• No cookies, no fingerprinting and no storage technologies set for analytics purposes on your device
• No IP addresses (only used in memory to derive country and immediately discarded)
• No device identifiers or fingerprints
• No session or cross page profiling
• No transfer to third parties (servers located in Austria / EU, no US transfers)

Legal basis

Since neither the page views nor the interaction events set cookies or personal identifiers, no consent under § 25 TDDDG is required. Statistical evaluation takes place on the basis of our legitimate interest in economically sustainable reach measurement and in improving our offering pursuant to Art. 6 (1) (f) GDPR.

Storage period

Aggregated, anonymous statistical data is stored indefinitely. Since no personal identifiers are included, individual records cannot be deleted (there is no link to a person). More information at plausible.io/data policy.

11. Bot protection with Cloudflare Turnstile (contact form)

Our contact form is protected against automated abuse (spam bots, crawlers) by Cloudflare Turnstile. Provider: Cloudflare, Inc., 101 Townsend St, San Francisco, CA 94107, USA, represented in the EU by Cloudflare Germany GmbH, Rosental 7, 80331 Munich, Germany.

When submitting the form, Turnstile silently checks in the background whether the request comes from a human or a bot. The browser evaluates technical signals (e.g. browser properties, hardware profile, mouse movement). No cookies are set and no CAPTCHA images are displayed; in rare suspicious cases a simple checkbox confirmation may appear.

• Your IP address (for risk assessment, loaded only briefly into memory)
• Technical browser and device characteristics (user agent, hardware profile, screen resolution)
• Interaction signals (mouse movements, click behavior within the widget area)
• An encrypted token as the result of the verification
• No cookies are set and no cross site tracking profile is created

12. Processors and external service providers

Insofar as we have personal data processed by service providers, this is done exclusively on the basis of data processing agreements pursuant to Art. 28 GDPR. We currently use the following service providers based in the EU:

• Nessus GmbH, Vienna/Austria: server hosting (bare metal, AS47692)
• All-Inkl.com Neue Medien Münnich, Friedersdorf/Germany: email mailboxes and SMTP delivery (kontakt@jd-media.net)

13. Transfer to third countries

There is no transfer of your personal data to recipients in third countries outside the EU/EEA. We do not use US cloud services, US CDN providers or US tracking tools.

Our web analytics (Plausible) also runs self hosted on our EU servers.

14. Storage period and deletion

We process and store your personal data only for as long as is necessary to fulfil the respective processing purpose. Where statutory retention obligations exist (e.g. § 257 HGB, § 147 AO), we retain the data for the duration of these obligations.

Once the purpose ceases to apply or the retention periods expire, the data is routinely deleted.

15. Your rights as a data subject

Under the GDPR you have the following rights:

• Right of access to your stored personal data (Art. 15 GDPR)
• Right to rectification of inaccurate or incomplete data (Art. 16 GDPR)
• Right to erasure of your stored personal data (Art. 17 GDPR)
• Right to restriction of data processing (Art. 18 GDPR)
• Right to data portability in a structured, commonly used and machine readable format (Art. 20 GDPR)
• Right to object to processing (Art. 21 GDPR), particularly for processing based on legitimate interests
• Right to revoke consent at any time with effect for the future (Art. 7 (3) GDPR)
• Right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR)

16. Obligation to provide personal data

The provision of your data is neither required by law nor by contract. You are not obliged to provide personal data. However, we can only provide certain services (e.g. processing a contact request, sending the newsletter) if you provide us with the data required for this purpose.

17. Automated decision making / profiling

Automated decision making including profiling pursuant to Art. 22 (1) and (4) GDPR does not take place.

18. Updates to this privacy policy

We reserve the right to amend this privacy policy if the legal situation changes or if we introduce new features on our website. The version published here at the time of your visit applies.