Privacy Policy

This is a convenience translation. In case of doubt, the German version shall prevail.

Introduction

With the following privacy policy, we would like to inform you about which types of your personal data (hereinafter also referred to as “data”) we process, for which purposes and to what extent. The privacy policy applies to all processing of personal data carried out by us, both in the context of providing our services and in particular on our websites, in mobile applications and within external online presences, such as our social media profiles (hereinafter collectively referred to as the “online offering”).

The terms used are not gender-specific.

Last updated: October 12, 2026

Table of contents

Controller

Dr. Patrick House
Rathenaustraße 182 a
22337 Hamburg
Germany

Email address: kontakt@epilepticon.de
Legal notice: www.epilepticon.de/en/legal-notice

Overview of processing operations

The following overview summarizes the types of data processed and the purposes of their processing and refers to the data subjects.

Types of data processed

  • Contact data
  • Content data
  • Usage data
  • Meta/communication data
  • Consent status

Categories of data subjects

  • Communication partners
  • Users

Purposes of processing

  • Contact requests and communication
  • Security measures
  • Managing and responding to inquiries
  • Feedback
  • Provision of our online offering and user-friendliness
  • Information technology infrastructure
  • Consent management

Relevant legal bases

Below you will find an overview of the legal bases of the GDPR on the basis of which we process personal data. Please note that, in addition to the provisions of the GDPR, national data protection regulations may apply in your or our country of residence or domicile. Should more specific legal bases be relevant in individual cases, we will inform you of these in the privacy policy.

  • Performance of a contract and pre-contractual inquiries (Art. 6 (1) sentence 1 (b) GDPR) – Processing is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract.
  • Legitimate interests (Art. 6 (1) sentence 1 (f) GDPR) – Processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data.

In addition to the data protection provisions of the General Data Protection Regulation, national data protection regulations apply in Germany. These include in particular the Act on Protection against Misuse of Personal Data in Data Processing (Federal Data Protection Act – BDSG). The BDSG contains in particular special provisions on the right of access, the right to erasure, the right to object, the processing of special categories of personal data, processing for other purposes and transmission, as well as automated individual decision-making, including profiling. It also governs data processing for the purposes of the employment relationship (Section 26 BDSG), in particular with regard to the establishment, performance or termination of employment relationships and the consent of employees. Furthermore, the data protection laws of the individual German federal states may apply.

Security measures

In accordance with the legal requirements and taking into account the state of the art, the costs of implementation and the nature, scope, context and purposes of processing as well as the varying likelihood and severity of the risk to the rights and freedoms of natural persons, we take appropriate technical and organizational measures to ensure a level of protection appropriate to the risk.

The measures include in particular safeguarding the confidentiality, integrity and availability of data by controlling physical and electronic access to the data as well as the access, input, disclosure, safeguarding of availability and separation relating to them. Furthermore, we have established procedures that ensure the exercise of data subjects' rights, the erasure of data and responses to data being put at risk. We also take the protection of personal data into account as early as the development or selection of hardware, software and procedures, in accordance with the principle of data protection by design and by default.

TLS encryption (https): To protect your data transmitted via our online offering, we use TLS encryption. You can recognize such encrypted connections by the prefix https:// in the address bar of your browser.

Provision of the online offering and web hosting

We process users' data in order to be able to provide them with our online services. For this purpose, we process the user's IP address, which is necessary to transmit the content and functions of our online services to the user's browser or device.

  • Types of data processed: usage data (e.g. websites visited, interest in content, access times); meta/communication data (e.g. device information, IP addresses).
  • Data subjects: users (e.g. website visitors, users of online services).
  • Purposes of processing: provision of our online offering and user-friendliness; information technology infrastructure (operation and provision of information systems and technical devices (computers, servers, etc.)); security measures.
  • Legal bases: legitimate interests (Art. 6 (1) sentence 1 (f) GDPR).

Further information on processing operations, procedures and services:

  • Provision of the online offering on rented storage space: To provide our online offering, we use storage space, computing capacity and software that we rent or otherwise obtain from a corresponding server provider (also called a “web host”); legal bases: legitimate interests (Art. 6 (1) sentence 1 (f) GDPR).
  • Collection of access data and log files: Access to our online offering is logged in the form of so-called “server log files”. The server log files may include the address and name of the web pages and files accessed, the date and time of access, the volume of data transferred, notification of successful access, browser type and version, the user's operating system, the referrer URL (the page previously visited) and, as a rule, IP addresses and the requesting provider. The server log files may be used, on the one hand, for security purposes, e.g. to avoid overloading the servers (in particular in the event of abusive attacks, so-called DDoS attacks) and, on the other hand, to ensure the utilization of the servers and their stability; legal bases: legitimate interests (Art. 6 (1) sentence 1 (f) GDPR); erasure of data: log file information is stored only for as long as is necessary for the purposes mentioned and is then deleted or anonymized. Data whose further retention is necessary for evidentiary purposes is excluded from erasure until the respective incident has been finally clarified.
  • Netlify: hosting of the website and delivery of its content via a worldwide server network (content delivery network). When the website is accessed, Netlify processes the IP address and the access data mentioned above (server log files) in order to transmit the content to the user's browser and to ensure secure operation; service provider: Netlify, Inc., 101 2nd Street, San Francisco, CA 94105, USA; legal bases: legitimate interests (Art. 6 (1) sentence 1 (f) GDPR); website: https://www.netlify.com/; privacy policy: https://www.netlify.com/privacy/; data processing agreement: https://www.netlify.com/pdf/netlify-dpa.pdf; basis for third-country transfers: EU-U.S. Data Privacy Framework (DPF), standard contractual clauses.
  • ALL-INKL: services in the field of domain administration, name resolution (DNS) and the provision of email mailboxes as well as the sending of inquiries from our contact form; service provider: ALL-INKL.COM – Neue Medien Münnich, owner: René Münnich, Hauptstraße 68, 02742 Friedersdorf, Germany; legal bases: legitimate interests (Art. 6 (1) sentence 1 (f) GDPR); website: https://all-inkl.com/; privacy policy: https://all-inkl.com/datenschutzinformationen/; data processing agreement: provided by the service provider.

Use of cookies and consent management

This website currently does not use any cookies or any services for statistics or marketing purposes. Fonts and scripts are loaded exclusively from our own online offering.

On your first visit, we use a consent banner to ask whether, in addition to technically necessary storage, you would also like to allow optional services in the categories “Statistics” and “Marketing”. Such services are only loaded after you have given your consent. You can change or withdraw your choice at any time via the “Cookie settings” link in the footer.

To save your choice, we store an entry named “epilepticon-consent” in the local storage of your browser. It contains only your choice per category, the time of the choice and a version number. The entry is not transmitted to us or to third parties and is no longer taken into account after twelve months; after that, we ask for your choice again. You can also delete the entry at any time via your browser settings.

  • Types of data processed: consent status (choice per category, time).
  • Data subjects: users (e.g. website visitors, users of online services).
  • Purposes of processing: management and documentation of consent.
  • Legal bases: storing the choice is technically necessary (Section 25 (2) no. 2 of the German Telecommunications Digital Services Data Protection Act, TDDDG); legal obligation (Art. 6 (1) sentence 1 (c) GDPR) and legitimate interests (Art. 6 (1) sentence 1 (f) GDPR). Where optional services are used: consent (Section 25 (1) TDDDG, Art. 6 (1) sentence 1 (a) GDPR).

Contact and inquiry management

When you contact us (e.g. via contact form, email, telephone or social media) and in the context of existing user and business relationships, the information provided by the inquiring persons is processed to the extent necessary to respond to the contact inquiries and any requested measures.

  • Types of data processed: contact data (e.g. email, telephone numbers); content data (e.g. entries in online forms); usage data (e.g. websites visited, interest in content, access times); meta/communication data (e.g. device information, IP addresses).
  • Data subjects: communication partners.
  • Purposes of processing: contact requests and communication; managing and responding to inquiries; feedback (e.g. collecting feedback via online form); provision of our online offering and user-friendliness.
  • Legal bases: legitimate interests (Art. 6 (1) sentence 1 (f) GDPR); performance of a contract and pre-contractual inquiries (Art. 6 (1) sentence 1 (b) GDPR).

Further information on processing operations, procedures and services:

  • Contact form: When users contact us via our contact form, email or other communication channels, we process the data communicated to us in this context in order to handle the matter communicated. The data entered in the contact form (first name, last name, email address, optionally phone number and message) is transmitted in encrypted form to a server of our service provider ALL-INKL in Germany and forwarded from there by email to our mailbox; it is not stored on that server. To protect against automated spam submissions, the form contains a check field that is not visible to humans; no third-party service such as reCAPTCHA is used; legal bases: performance of a contract and pre-contractual inquiries (Art. 6 (1) sentence 1 (b) GDPR), legitimate interests (Art. 6 (1) sentence 1 (f) GDPR); erasure of data: we delete inquiries as soon as they are no longer required to handle the matter and no statutory retention obligations prevent this.

Changes and updates to the privacy policy

We ask you to inform yourself regularly about the content of our privacy policy. We adapt the privacy policy as soon as changes to the data processing we carry out make this necessary. We will inform you as soon as the changes require an act of cooperation on your part (e.g. consent) or other individual notification.

Where we provide addresses and contact information of companies and organizations in this privacy policy, please note that the addresses may change over time and please check the information before contacting them.

Rights of data subjects

As a data subject, you have various rights under the GDPR, which arise in particular from Art. 15 to 21 GDPR:

  • Right to object: You have the right to object at any time, on grounds relating to your particular situation, to the processing of personal data concerning you which is based on Art. 6 (1) (e) or (f) GDPR; this also applies to profiling based on these provisions. If the personal data concerning you is processed for direct marketing purposes, you have the right to object at any time to the processing of personal data concerning you for such marketing; this also applies to profiling to the extent that it is related to such direct marketing.
  • Right to withdraw consent: You have the right to withdraw any consent you have given at any time.
  • Right of access: You have the right to request confirmation as to whether data concerning you is being processed and to obtain information about this data as well as further information and a copy of the data in accordance with the legal requirements.
  • Right to rectification: In accordance with the legal requirements, you have the right to request the completion of the data concerning you or the rectification of inaccurate data concerning you.
  • Right to erasure and restriction of processing: In accordance with the legal requirements, you have the right to demand that data concerning you be erased without undue delay or, alternatively, to demand restriction of the processing of the data in accordance with the legal requirements.
  • Right to data portability: You have the right to receive data concerning you which you have provided to us in a structured, commonly used and machine-readable format in accordance with the legal requirements, or to request its transmission to another controller.
  • Complaint to a supervisory authority: Without prejudice to any other administrative or judicial remedy, you have the right to lodge a complaint with a supervisory authority, in particular in the Member State of your habitual residence, place of work or place of the alleged infringement, if you consider that the processing of personal data concerning you infringes the GDPR.

Definitions of terms

This section provides an overview of the terms used in this privacy policy. Many of the terms are taken from the law and are defined above all in Art. 4 GDPR. The legal definitions are binding. The following explanations, on the other hand, are primarily intended to aid understanding. The terms are sorted alphabetically (in the German original).

  • Personal data: “Personal data” means any information relating to an identified or identifiable natural person (hereinafter “data subject”); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier (e.g. cookie) or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person.
  • Controller: The “controller” is the natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of the processing of personal data.
  • Processing: “Processing” means any operation or set of operations which is performed on personal data, whether or not by automated means. The term is broad and covers practically every handling of data, be it collection, evaluation, storage, transmission or erasure.

Created with the free Datenschutz-Generator.de by Dr. Thomas Schwenke