1. Controller
The controller responsible for the processing of personal data on this website within the meaning of Art. 4 No. 7 GDPR is:
Alchemist Media Labs GmbH
Friedrich-Kirsten-Str. 7b
22391 Hamburg
Germany
Hamburg Local Court (Amtsgericht Hamburg), HRB 192318
Represented by the management
Email: everscreen@alchemist.ml
2. Data Protection Officer
We have appointed a data protection officer. You can reach them at:
3. General information on data processing
We process personal data of the users of our website only to the extent necessary to provide a functional website and our content and services, or where you have given your consent.
The legal bases are in particular Art. 6(1)(a) GDPR (consent), Art. 6(1)(b) GDPR (contract and pre-contractual measures), Art. 6(1)(c) GDPR (legal obligation) and Art. 6(1)(f) GDPR (legitimate interests).
Where information is stored on or read from your device, for example through cookies or comparable technologies, this is done on the basis of your consent pursuant to § 25(1) of the German Telecommunications Digital Services Data Protection Act (TDDDG). Consent is not required where the storage or access is strictly necessary for us to provide the digital service you have expressly requested (§ 25(2) No. 2 TDDDG).
Personal data is deleted as soon as the purpose for storing it no longer applies and no statutory retention obligations stand in the way, for example under § 257 of the German Commercial Code (HGB) or § 147 of the German Fiscal Code (AO).
4. Hosting and server log files
This website is hosted externally. The hosting provider processes the data on our behalf on the basis of a contract pursuant to Art. 28 GDPR.
When you access the website, your browser automatically transmits information that is stored in server log files:
- IP address of the requesting device
- Date and time of access
- Page or file accessed
- Referrer URL
- Browser type and version
- Operating system
- Amount of data transferred and HTTP status code
The processing is based on Art. 6(1)(f) GDPR. Our legitimate interest lies in the technically error-free and secure provision of the website and in defending against attacks. The log files are deleted after 30 days unless they are needed for longer to investigate a specific security incident.
5. SSL/TLS encryption
For security reasons, this website uses SSL or TLS encryption (Art. 32 GDPR). You can recognize an encrypted connection by the “https://” in your browser's address bar.
6. Cookies and consent management
We use cookies and comparable technologies. On your first visit to the website, a consent banner asks which categories you agree to. Services that are not technically necessary are only loaded after you have given your consent.
Your selection is stored in the “cookie_consent” cookie so that the banner does not appear again on every page view. The legal basis is § 25(2) No. 2 TDDDG in conjunction with Art. 6(1)(c) GDPR, as we are required to demonstrate consent under Art. 7(1) GDPR. Storage period: [duration].
You can withdraw or change your consent at any time with effect for the future by opening the cookie settings via the [“Cookie settings”] link in the footer (Art. 7(3) GDPR). The lawfulness of the processing carried out until the withdrawal remains unaffected.
An overview of the cookies used, including provider, purpose and storage period, can be found in the cookie settings.
7. Contact by email
If you contact us by email, we process your email address, your name (if provided) and the content of your message in order to handle your inquiry.
The legal basis is Art. 6(1)(b) GDPR where your inquiry is aimed at concluding or performing a contract, and otherwise Art. 6(1)(f) GDPR. Our legitimate interest lies in responding to incoming inquiries.
We delete the data once your inquiry has been fully dealt with, unless statutory retention obligations apply.
8. Newsletter and waiting list (rapidmail)
You can sign up for our waiting list or newsletter on our website to be informed about product news. Your email address is a mandatory field.
We use the double opt-in procedure: after signing up, you receive an email with a confirmation link. You are only added to the mailing list once you have confirmed. We store the time of sign-up and confirmation as well as the IP address in order to be able to demonstrate consent (Art. 7(1) GDPR in conjunction with Art. 6(1)(c) and (f) GDPR).
The legal basis for sending the newsletter is your consent pursuant to Art. 6(1)(a) GDPR and § 7(2) No. 2 of the German Act against Unfair Competition (UWG). You can withdraw your consent at any time via the unsubscribe link in every email or by sending us a message.
For sending, we use rapidmail, a service of rapidmail GmbH, Augustinerplatz 2, 79098 Freiburg im Breisgau, Germany [provider details to be verified, see open items no. 7]. rapidmail processes the data on our behalf on the basis of a contract pursuant to Art. 28 GDPR. The data is stored on servers in Germany.
Where activated, we analyze whether newsletters are opened and which links are clicked in order to improve our content. This analysis is covered by your consent.
After you unsubscribe, we delete your email address from the mailing list. We may store it on a suppression list in order to prevent future mailings and to be able to prove that consent was previously given (Art. 6(1)(f) GDPR).
9. Google Tag Manager
We use Google Tag Manager, provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (“Google”).
Google Tag Manager is a tool we use to embed and manage tracking and analytics code (“tags”) on the website. It does not itself create user profiles or set its own cookies for analytics purposes. When it loads, however, your IP address is transmitted to Google, and a transfer to Google LLC in the USA cannot be ruled out.
We only load Google Tag Manager after you have given your consent. The legal basis is Art. 6(1)(a) GDPR and § 25(1) TDDDG. Services embedded via Tag Manager are only triggered if you have consented to the respective category.
Google LLC is certified under the EU-US Data Privacy Framework. Transfers to the USA are therefore covered by an adequacy decision of the European Commission (Implementing Decision C(2023) 4745 of 10 July 2023, Art. 45 GDPR).
Further information: https://policies.google.com/privacy
10. Google Analytics 4
With your consent, we use Google Analytics 4, a web analytics service provided by Google (provider as in section 9).
Google Analytics enables us to analyze how our website is used, for example pages viewed, time spent, where visitors come from, approximate location (at country or city level), device, browser and interactions. For this purpose, cookies or identifiers are stored on your device, in particular “_ga” and “ga[ID]”, with a storage period of up to [24 months – to be adjusted to the actual configuration].
According to Google, IP addresses are not logged or stored in Google Analytics 4. Google does, however, use the IP address briefly to derive location data.
We have concluded a data processing agreement with Google pursuant to Art. 28 GDPR. Data retention in Google Analytics is set to [X] months. [Google Signals and the link to Google Ads are deactivated. – to be confirmed or adjusted]
The legal basis is your consent pursuant to Art. 6(1)(a) GDPR and § 25(1) TDDDG. You can withdraw your consent at any time via the cookie settings.
For data transfers to the USA, see section 9.
Further information: https://support.google.com/analytics/answer/6004245
11. Meta Pixel
With your consent, we use the Meta Pixel of Meta Platforms Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland (“Meta”).
The Meta Pixel allows us to track the behavior of visitors after they have reached our website by clicking on an advertisement on Facebook or Instagram (conversion measurement). It also allows us to show targeted advertising to visitors of our website on Meta's platforms (remarketing) and to build audiences for advertising campaigns. For this purpose, cookies or identifiers are stored on your device, in particular “_fbp” (storage period up to 90 days), and data such as your IP address, browser information, pages viewed and triggered events are transmitted to Meta. If you are logged in to a Meta service, Meta can attribute the visit to your user account.
[If “Advanced Matching” is activated: In addition, data you enter on our website, such as your email address, is transmitted to Meta in hashed form in order to match it with Meta user accounts.]
We and Meta are joint controllers for the collection of data on our website and its transmission to Meta (Art. 26 GDPR; see CJEU, judgment of 29 July 2019, C-40/17 – Fashion ID). We have concluded an agreement with Meta on this (“Controller Addendum”), available at https://www.facebook.com/legal/controller_addendum. Under this agreement, Meta is in particular responsible for fulfilling data subject rights with regard to the data stored by Meta; you may, however, also exercise your rights against us. Any further processing after transmission is the sole responsibility of Meta.
The legal basis is your consent pursuant to Art. 6(1)(a) GDPR and § 25(1) TDDDG. You can withdraw your consent at any time via the cookie settings.
Data may be transferred to Meta Platforms, Inc. in the USA. Meta Platforms, Inc. is certified under the EU-US Data Privacy Framework (adequacy decision, see section 9).
Further information: https://www.facebook.com/privacy/policy
Ad preferences at Meta: https://www.facebook.com/adpreferences
12. Recipients of personal data
We only pass on personal data where this is described in this policy, permitted by law, or where you have given your consent. Recipients are in particular our hosting provider, rapidmail, Google and Meta as well as, where we are obliged to do so, tax advisors and public authorities.
13. No automated decision-making
We do not carry out automated decision-making, including profiling, within the meaning of Art. 22 GDPR.
14. Your rights
Under the GDPR, you have the following rights:
- Right of access (Art. 15 GDPR)
- Right to rectification (Art. 16 GDPR)
- Right to erasure (Art. 17 GDPR)
- Right to restriction of processing (Art. 18 GDPR)
- Right to data portability (Art. 20 GDPR)
- Right to withdraw consent given, with effect for the future (Art. 7(3) GDPR)
- Right to lodge a complaint with a supervisory authority (Art. 77 GDPR)
The supervisory authority responsible for us is:
Der Hamburgische Beauftragte für Datenschutz und Informationsfreiheit (Hamburg Commissioner for Data Protection and Freedom of Information)
Ludwig-Erhard-Straße 22, 7. OG, 20459 Hamburg, Germany
You may also contact the supervisory authority at your place of residence or work.
15. Right to object under Art. 21 GDPR
Where we process your data on the basis of Art. 6(1)(f) GDPR, you have the right to object at any time on grounds relating to your particular situation (Art. 21(1) GDPR). We will then no longer process the data unless we can demonstrate compelling legitimate grounds that override your interests, rights and freedoms, or the processing serves the establishment, exercise or defense of legal claims.
Where your data is processed for direct marketing purposes, you may object at any time without giving reasons (Art. 21(2) and (3) GDPR).
16. Changes to this privacy policy
We will amend this privacy policy when our data processing or the legal situation changes. The version published on the website at any given time applies.