Last updated: July 2026

1. Privacy at a glance

General information

The following notes provide a simple overview of what happens to your personal data when you visit this website. Personal data is any data with which you can be personally identified.

Data collection on this website

Who is responsible? Data processing on this website is carried out by GDDC GmbH (see section 2).

How do we collect your data? Some data is collected when you provide it to us — for example via contact forms, shop orders or job applications. Other data is collected automatically or after your consent when you visit the website (e.g. technical access data, analytics cookies).

What do we use your data for? Some data is collected to ensure error-free operation of the website. Other data may be used to analyse user behaviour or to process enquiries and orders.

Your rights

You have the right at any time to receive free information about the origin, recipient and purpose of your stored personal data. You also have the right to request correction or deletion of this data and restriction of processing. Where processing is based on consent, you may withdraw consent at any time. You also have the right to lodge a complaint with a supervisory authority. Details are set out in section 10.

2. Data controller

GDDC GmbH
Marienthaler Str. 12
24340 Eckernförde
Germany

Managing director: Dr. Gabriele Zell
Phone: +49 (0)4351 7677300
Email: datenschutz@gddc-sh.de (general: info@gddc-sh.de)

The controller is the natural or legal person who alone or jointly with others determines the purposes and means of processing personal data.

3. Hosting

This website is operated on servers in the EU/EEA, primarily in Germany. When you visit the site, technically necessary access data is processed (e.g. IP address, timestamp, browser type, page requested) to provide the website securely and reliably.

Legal basis: Art. 6(1)(f) GDPR (legitimate interest in secure, reliable web operation).

Where individual service providers in third countries are involved, transfers take place only on the basis of appropriate safeguards (e.g. standard contractual clauses) and data processing agreements pursuant to Art. 28 GDPR.

Strictly necessary storage

We use technically required cookies or comparable storage for site operation (e.g. for the shopping cart or your display preferences). These are required for core functionality.

Legal basis: Art. 6(1)(f) GDPR and § 25(2) no. 2 TDDDG (strictly necessary).

We use a first-party consent banner that stores your choice for functional and analytics cookies in your browser. Google Analytics 4 is loaded only after you consent to analytics cookies.

Legal basis for analytics cookies: Art. 6(1)(a) GDPR (consent)
Withdrawal: You can withdraw consent at any time via browser settings (clear site data) or by updating your preferences when prompted.

5. Analytics and reach measurement

Google Analytics 4

Provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (parent: Google LLC, USA)
Purpose: Reach measurement, usage statistics, website optimisation
Data processed: Pseudonymous usage profiles, device and browser information, approximate location (truncated IP)
Integration: only after your consent via the cookie banner
Legal basis: Art. 6(1)(a) GDPR (consent)
Retention: Per Google configuration (default: 14 months)
Opt-out: Withdraw consent in the banner; browser add-on: https://tools.google.com/dlpage/gaoptout
Processing agreement: Google Ads Data Processing Terms

Note: We do not deploy a separate Google Tag Manager container, Microsoft Clarity, Hotjar, or Meta / LinkedIn pixels on gddc-sh.de.

Plausible Analytics (optional, cookieless)

Where configured, Plausible Analytics (Plausible Insights OÜ, Estonia / EU) may be used additionally. It works without cookies and without personal profiles; aggregated page views are recorded.

Legal basis: Art. 6(1)(f) GDPR (legitimate interest in anonymised reach measurement) — no consent banner required when operated cookielessly.

Google Search Console (operator tool)

We use Google Search Console solely as an internal operator tool to analyse indexing and search performance. No tracking scripts for visitors are embedded for this purpose.

Legal basis: Art. 6(1)(f) GDPR (improving findability).

6. Contact forms and email

Contact form

When you send us enquiries via a form, the data you enter (name, email, optional phone, message, optional topic) is stored to handle your request and follow-up questions.

Legal basis: Art. 6(1)(b) GDPR (pre-contractual steps) and (f) GDPR (handling enquiries)
Retention: Until the request is completed, at most per internal retention policy (typically 24 months after closure unless statutory obligations require longer storage)

Email delivery

We use a specialised email service provider to send transactional emails (e.g. acknowledgement of your contact request).

Legal basis: Art. 6(1)(b) and (f) GDPR
Processing agreement: DPA with standard contractual clauses where required

Bot protection (optional)

On forms (contact, applications, Academy enrolment) a service may be used to protect against automated submissions.

Legal basis: Art. 6(1)(f) GDPR (website security)

7. Online shop and payment processing

When you use our online shop at /shop, we process the data required for ordering and delivery (e.g. contact details, order items, billing address).

Legal basis: Art. 6(1)(b) GDPR (contract performance)

Stripe (payment provider)

Provider: Stripe Payments Europe Ltd., Dublin, Ireland
Purpose: Payment processing in the online shop (card and other methods supported by Stripe)
Data processed: Payment data, billing address, transaction ID — card data is sent directly to Stripe, not stored on our servers
Legal basis: Art. 6(1)(b) GDPR
Processing agreement: PCI-DSS compliant payment provider

Additional payment methods may be connected in future; you will be informed separately before completing an order.

8. Embedded content, video and fonts

YouTube (enhanced privacy mode)

Where videos are embedded, we use YouTube's enhanced privacy mode. When you play a video, data may be transmitted to Google.

Operator: Google Ireland Limited
Legal basis: Art. 6(1)(a) GDPR (consent where required before loading) or (f) GDPR for click-to-load implementations

Fonts (local hosting)

We host ABC Schengen and ABC Schengen Mono fonts locally on our servers. Visiting the website does not establish a connection to Google Fonts or other external font CDNs.

9. Applicant data

If you apply via our careers page, we process the data you submit (contact details, CV, cover letter, optional LinkedIn URL) for recruitment purposes.

Legal basis: § 26(1) BDSG, Art. 6(1)(b) GDPR
Retention: Up to 6 months after completion of the recruitment process unless longer statutory retention applies

You have the following rights regarding your personal data:

Access (Art. 15 GDPR)
Rectification (Art. 16 GDPR)
Erasure (Art. 17 GDPR)
Restriction of processing (Art. 18 GDPR)
Data portability (Art. 20 GDPR)
Objection to processing based on Art. 6(1)(f) GDPR (Art. 21 GDPR)
Withdrawal of consent (Art. 7(3) GDPR) with effect for the future

Right to complain: You may lodge a complaint with a data protection supervisory authority, e.g.:

Independent Centre for Privacy Protection Schleswig-Holstein (ULD)
Holstenstraße 98, 24103 Kiel, Germany
https://www.datenschutzzentrum.de

11. Data processors (overview)

Where required for the operation of gddc-sh.de, we use the following categories of processors:

Category	Purpose	Location
Web hosting	Website delivery	EU (Germany)
Data storage	Form and shop data	EU
Email delivery	Transactional email	third country with SCC if needed
Web analytics	Usage statistics (consent only)	EU / USA
Payment processing	Online shop	EU
Bot protection	Form security	third country with SCC if needed

Processing agreements pursuant to Art. 28 GDPR or comparable safeguards (standard contractual clauses) are in place where processing occurs in third countries.

12. Security and retention

We use TLS encryption (HTTPS) for transmission. Personal data is stored only as long as necessary for the respective purposes or as required by statutory retention periods.

Processing takes place primarily in the EU/EEA. Access from third countries occurs only where required for individual service providers and is safeguarded by appropriate guarantees.

13. Audio and video conferencing

Where we use video conferencing tools for consultations (e.g. Microsoft Teams or Zoom), the privacy notices of the respective providers apply. Invitations are sent only at your request or with your agreement.