Privacy policy

This policy explains the processing of personal data when you visit the website e-widerruf.de, in accordance with art. 13 GDPR.

1. Controller

The controller within the meaning of the GDPR is:

No data protection officer has been appointed; there is no statutory obligation to appoint one.

2. Principles and legal bases

We process personal data only where this is necessary for a functioning, secure provision of the website. The legal bases are in particular:

• art. 6 (1) (b) GDPR – performance of a contract or response to (pre-)contractual enquiries.
• art. 6 (1) (f) GDPR – legitimate interests (e.g. secure delivery of the site, statistical audience measurement).
• art. 6 (1) (c) GDPR – compliance with legal obligations, where such exist.
• art. 6 (1) (a) GDPR – consent, where obtained (not currently required on this website).

3. Hosting and server log files (Cloudflare Pages)

This website is hosted with Cloudflare, Inc., 101 Townsend St, San Francisco, CA 94107, USA (Cloudflare Pages). Cloudflare delivers the site through its content delivery network and protects it against attacks.

When the site is accessed, Cloudflare processes technically necessary access data, in particular: the IP address of the requesting device, date and time, the resource requested and the status code, the volume of data transferred, the referrer URL, and browser type and operating system (user agent). Transmission is TLS-encrypted (HTTPS).

The purpose is the technical provision, stability and security of the website (CDN delivery, DDoS protection). The legal basis is art. 6 (1) (f) GDPR; our legitimate interest lies in the secure and efficient provision of this website. A data processing agreement under art. 28 GDPR is in place with Cloudflare. On third-country transfers, see section 9.

4. Cookies and access to terminal equipment

This website sets no tracking or marketing cookies and neither stores nor reads information on your device beyond what is strictly necessary. Consent-requiring access within the meaning of § 25 (1) TDDDG (formerly TTDSG) does not take place. A cookie consent banner is therefore not required. The audience measurement in use is cookieless (see section 6).

5. Fonts

The fonts used (IBM Plex) are loaded locally from this website's server. There is no connection to Google servers (Google Fonts) and no transfer of personal data to third parties for this purpose.

6. Audience measurement (Cloudflare Web Analytics)

For the statistical evaluation of website use we employ Cloudflare Web Analytics (Cloudflare, Inc.). Measurement is cookieless: no cookies are set, no information is stored on or read from your device, and no cross-device identifiers or personal usage profiles are created.

What is processed is aggregated, largely technical information such as pages visited, referrer, approximate origin at country level, and browser and device type. Any IP address is not used for permanent identification or fingerprinting. The legal basis is art. 6 (1) (f) GDPR; our legitimate interest lies in the needs-based design and optimisation of the website. As there is no access to terminal equipment within the meaning of § 25 TDDDG, no consent is required for this.

7. Contact form and contact by e-mail

Through the contact form you transmit your name, e-mail address, the category you select for your enquiry, the content of your message and – voluntarily – your telephone number. The category serves solely for internal routing and faster handling; it is not used for profiling. We process these details exclusively to handle your enquiry. Transmission goes to a function on our own hosting (Cloudflare Pages); from there the message is delivered to us by e-mail. For delivery we use Brevo (Sendinblue SAS, 106 Boulevard Haussmann, 75008 Paris, France) as a processor; processing takes place within the EU.

Spam protection with Cloudflare Turnstile. To fend off automated submissions, Cloudflare Turnstile is placed in front of the form. Turnstile processes technical details of your visit (including IP address, browser and device information) and verifies server-side that the submission comes from a human. Turnstile works without cookies and without user profiles. The legal basis is art. 6 (1) (f) GDPR; our legitimate interest lies in preventing spam and abuse.

The legal basis for handling your enquiry is art. 6 (1) (b) GDPR for contract-related matters and otherwise art. 6 (1) (f) GDPR. The details are voluntary; without them we cannot answer the enquiry. You can also reach us by e-mail without using the form.

Contact by e-mail

If you contact us by e-mail (kontakt@e-widerruf.de), we process the details transmitted (in particular the e-mail address and the content of the message) exclusively to handle your enquiry. The legal basis is art. 6 (1) (b) GDPR for contract-related enquiries and otherwise art. 6 (1) (f) GDPR (efficient handling of enquiries). The data are deleted once the enquiry has been dealt with conclusively; statutory retention periods remain unaffected.

8. Recipients and external links

Recipients of personal data are the hosting, analytics and spam-protection provider Cloudflare and – solely for sending contact enquiries – the mail delivery provider Brevo (France), in each case as processors under art. 28 GDPR. There is no transfer to further third parties unless we are legally obliged to make one.

This website contains links to external third-party websites. Clicking them takes you off this website; the respective providers alone are responsible for the content and data processing of the linked pages. We have no influence over their processing; their own privacy notices apply.

9. Transfers to third countries (USA)

Cloudflare, Inc. is based in the USA, and processing in the USA may occur. Where personal data are transferred to the USA, this is based on the European Commission's adequacy decision on the EU-US Data Privacy Framework (DPF), to the extent the recipient is certified, and additionally on the EU Standard Contractual Clauses (SCC) under art. 46 GDPR.

10. Storage period

Technical access data (server log files) are processed only for as long as necessary for the provision and security of the website and are then deleted or anonymised. Audience measurement data are held in aggregated form only. Data processed in the course of contacting us are stored until the enquiry has been dealt with. Otherwise, personal data are deleted once the purpose ceases to apply and no statutory retention obligations stand in the way.

11. No automated decision-making

Automated decision-making, including profiling within the meaning of art. 22 GDPR, does not take place.

12. Your rights as a data subject

Subject to the statutory conditions, you have the following rights:

• access to the data processed (art. 15 GDPR),
• rectification of inaccurate data (art. 16 GDPR),
• erasure (art. 17 GDPR),
• restriction of processing (art. 18 GDPR),
• data portability (art. 20 GDPR),
• objection to processing (art. 21 GDPR, see below).

Where processing is based on consent, you may withdraw that consent at any time with effect for the future (art. 7 (3) GDPR); the lawfulness of processing carried out up to the withdrawal remains unaffected. A message to kontakt@e-widerruf.de is enough to exercise your rights.

13. Right to lodge a complaint with a supervisory authority

Without prejudice to any other remedy, you have the right to lodge a complaint with a data protection supervisory authority. For the controller's place of establishment this is the Thuringian Commissioner for Data Protection and Freedom of Information (TLfDI), Häßlerstraße 8, 99096 Erfurt, Germany. You may also turn to the supervisory authority of your habitual residence or place of work.

14. Currency and changes

We adapt this privacy policy as soon as the legal position or the actual processing changes. The version published on this page at the time applies.

As at: August 2026