Preamble
With the following privacy policy, we would like to inform you about which types of your personal data (hereinafter also referred to simply as „data“) we process, for what purposes, and to what extent. This privacy policy applies to all processing of personal data carried out by us, both in the context of providing our services and in particular on our websites, in mobile applications, and within external online presences, such as our social media profiles (hereinafter collectively referred to as the „online offering“).
Effective Date: May 24, 2025
Controller
femzar GmbH
Lorenzengasse 7
22303 Hamburg
Germany
Authorized Representatives: Samira Mousavi Hesari, Mira Schröder
Email: hallo@femzar.com
Overview of Processing Activities
The following overview summarizes the types of data processed, the purposes of processing, and the categories of data subjects.
Relevant Legal Bases
Relevant legal bases under the GDPR: The following provides an overview of the legal bases of the GDPR on which we process personal data. Please note that in addition to the GDPR, national data protection regulations may apply in your or our country of residence. If more specific legal bases apply in individual cases, we will inform you about them in this privacy policy.
• Consent (Art. 6(1)(a) GDPR) – The data subject has given consent to the processing of their personal data for one or more specific purposes.
• Performance of a contract and pre-contractual inquiries (Art. 6(1)(b) GDPR) – Processing is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract.
• Legal obligation (Art. 6(1)(c) GDPR) – Processing is necessary for compliance with a legal obligation to which the controller is subject.
• Legitimate interests (Art. 6(1)(f) GDPR) – Processing is necessary for the purposes of the legitimate interests pursued by the controller or a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject.
National Data Protection Regulations in Germany: In addition to the GDPR, national data protection laws apply in Germany, particularly the Federal Data Protection Act (Bundesdatenschutzgesetz – BDSG). The BDSG includes specific provisions on the right to access, the right to erasure, the right to object, the processing of special categories of personal data, processing for other purposes, as well as transmission and automated decision-making in individual cases including profiling. Furthermore, state data protection laws of the individual federal states may also apply.
Note on the Applicability of the GDPR and Swiss DPA: This privacy notice serves both to fulfill information requirements under the Swiss Data Protection Act (DSG) and the General Data Protection Regulation (GDPR). For reasons of broader territorial scope and clarity, the terminology of the GDPR is used. In particular, instead of the terms used in the Swiss DPA such as „processing“ of „personal data“, „overriding interest“, and „sensitive personal data“, the GDPR terms „processing“ of „personal data“, „legitimate interest“, and „special categories of data“ are used. However, the legal meaning of these terms continues to be interpreted according to the Swiss DPA when applicable.
Security Measures
In accordance with legal requirements, and taking into account the state of the art, implementation costs, the nature, scope, context, and purposes of processing, as well as the varying probabilities and severity of risks to the rights and freedoms of natural persons, we implement appropriate technical and organizational measures to ensure a level of protection appropriate to the risk.
These measures include, in particular, safeguarding the confidentiality, integrity, and availability of data by controlling physical and electronic access to the data, as well as access, input, transmission, availability, and separation of the data itself. Furthermore, we have established procedures that ensure the exercise of data subject rights, data deletion, and responses to data breaches. We also take data protection into account in the development or selection of hardware, software, and procedures in accordance with the principle of data protection by design and by default.
Securing Online Connections Using TLS/SSL Encryption (HTTPS):
To protect user data transmitted through our online services from unauthorized access, we use TLS/SSL encryption technology. Secure Sockets Layer (SSL) and Transport Layer Security (TLS) are the cornerstones of secure data transmission on the Internet. These technologies encrypt the information exchanged between the website or app and the user’s browser (or between two servers), protecting the data from unauthorized access. TLS, as the advanced and more secure version of SSL, ensures that all data transfers comply with the highest security standards. When a website is secured with an SSL/TLS certificate, this is indicated by the display of HTTPS in the URL. This serves as an indicator to users that their data is being securely and encryptedly transmitted.
Transfer of Personal Data
As part of our processing of personal data, data may be transmitted to or disclosed to other entities, companies, legally independent organizational units, or individuals. Recipients of this data may include, for example, IT service providers or providers of services and content integrated into a website. In such cases, we comply with the legal requirements and, in particular, conclude appropriate contracts or agreements that serve to protect your data with the recipients.
Internal Data Transfers Within Our Organization:
We may transfer personal data to other departments or units within our organization or grant them access to the data. If data is shared for administrative purposes, this is based on our legitimate business and economic interests, or it occurs if it is necessary to fulfill our contractual obligations or based on the data subject’s consent or legal permission.
General Information on Data Storage and Deletion
We delete personal data that we process in accordance with legal requirements as soon as the consent on which processing is based is withdrawn, or if there are no other legal grounds for processing. This applies when the original purpose of processing no longer exists or the data is no longer needed. Exceptions apply where statutory obligations or legitimate interests require longer retention or archiving.
In particular, data that must be retained for commercial or tax law reasons or is necessary for legal prosecution or for protecting the rights of other natural or legal persons must be archived accordingly.
Our privacy notices contain additional information on retention and deletion of data that apply to specific processing operations.
Where multiple retention or deletion periods are specified for a particular piece of data, the longest period shall always prevail.
If a retention period does not explicitly begin on a specific date and is at least one year, it will automatically begin at the end of the calendar year in which the event triggering the period occurred. In the case of ongoing contractual relationships under which data is stored, the triggering event is the termination or other conclusion of the legal relationship.
Data that is no longer needed for the original intended purpose but is retained due to legal requirements or other reasons will be processed solely for the reasons justifying its retention.
Additional Information on Processing Activities, Procedures, and Services:
Data Retention and Deletion – General Periods Under German Law:
• 10 years – Retention period for books and records, annual financial statements, inventories, management reports, opening balances, and the work instructions and other organizational documents required to understand them
(§ 147(1) no. 1 in conjunction with § 147(3) AO, § 14b(1) UStG, § 257(1) no. 1 in conjunction with § 257(4) HGB).
•8 years – Accounting vouchers such as invoices and cost records
(§ 147(1) nos. 4 and 4a in conjunction with § 147(3) sentence 1 AO, and § 257(1) no. 4 in conjunction with § 257(4) HGB).
• 6 years – Other business documents, including received or sent commercial correspondence and other documents relevant for taxation, such as hourly wage records, cost sheets, calculation documents, price labels, and payroll records (if not classified as accounting vouchers), as well as cash register receipts
(§ 147(1) nos. 2, 3, 5 in conjunction with § 147(3) AO, § 257(1) nos. 2 and 3 in conjunction with § 257(4) HGB).
• 3 years – Data necessary to consider potential warranty and damage claims or similar contractual claims and rights, as well as to process related inquiries, will be retained for the duration of the standard statutory limitation period of three years
(§§ 195, 199 BGB).
Rights of Data Subjects
Rights under the GDPR:
As a data subject under the General Data Protection Regulation (GDPR), you are entitled to a number of rights, particularly those outlined in Articles 15 to 21 GDPR:
Business Services
We process the data of our contractual and business partners—such as customers and prospects (hereinafter collectively referred to as „contractual partners“)—within the scope of contractual or similar legal relationships, including associated measures and communication (including pre-contractual communication such as responding to inquiries).
This data is used to fulfill our contractual obligations, such as providing the agreed services, addressing warranty issues, and handling service disruptions. It is also used for administrative tasks and business organization, as well as for enforcing our legal rights. Furthermore, we rely on our legitimate interests to ensure secure and efficient business operations, protect against misuse, and safeguard our contractual partners’ and business interests. This may involve sharing data with third parties such as telecommunication or logistics providers, subcontractors, banks, tax or legal advisors, payment service providers, and financial authorities.
We only share data with third parties to the extent necessary for these purposes or to comply with legal obligations. Any additional processing (e.g., for marketing) is described separately in this privacy policy.
The necessary data is disclosed to contractual partners before or during data collection—e.g., through online forms, highlighted markers (such as color or symbols like asterisks), or in-person explanations.
We delete personal data after expiration of statutory warranty and similar obligations, generally after four years, unless the data is stored in a customer account or must be retained for legal reasons (e.g., 10 years for tax purposes). Data disclosed to us under a contract will be deleted in accordance with the contract and legal requirements.
Types of data processed:
Categories of data subjects:
Purposes of processing:
Data retention and deletion:
Legal bases:
Business Processes and Procedures
We process personal data from service recipients and clients—including customers, patients, clients, partners, and, in some cases, other third parties—within the context of contractual and pre-contractual relationships. This data processing supports and facilitates business operations such as customer management, sales, payment processing, accounting, and project management.
The data helps us fulfill contractual obligations and optimize business workflows, including managing transactions, improving sales strategies, ensuring internal accounting and finance processes, safeguarding legal claims, and supporting company administration.
Data may be shared with third parties as needed to fulfill these purposes or comply with legal obligations.
Types of data processed:
Data subjects:
Purposes of processing:
Data retention and deletion:
Legal bases:
Additional Processing: Economic Analyses and Market Research
For business analysis and to recognize market trends and customer preferences, we evaluate data related to business activities, contracts, and inquiries. Affected groups may include contractual partners, prospects, customers, and users of our online services. These analyses support marketing, business development, and market research—such as identifying customer groups with varying characteristics.
If available, we may use user profiles (e.g., service usage data) in our analysis. All analysis is internal and not disclosed externally—unless it is aggregated and anonymized.
We respect users’ privacy by processing the data pseudonymously or anonymously where possible.
Legal basis:
Gerne! Hier ist die englische Übersetzung des gesamten Abschnitts zur Bereitstellung des Onlineangebots, Webhosting, Einsatz von Cookies und Kontaktanfragen:
We process user data in order to provide our online services. For this purpose, we process users’ IP addresses, which are necessary to transmit content and functionalities of our online services to the user’s browser or device.
Additional processing and services:
“Cookies” refer to technologies used to store and retrieve information on users’ devices. They serve various purposes, including functionality, security, user convenience, and analytics. We use cookies in accordance with legal requirements. Where required, we obtain users’ consent beforehand. If consent is not necessary, processing is based on our legitimate interests—such as ensuring the functionality and security of our online services.
Users may revoke their consent at any time. We clearly inform users of the scope and purpose of the cookies used.
Legal bases:
Storage duration of cookies:
Withdrawal and opt-out:
Users can revoke consent or object to processing via browser privacy settings.
Consent management solution:
We use a consent management tool to obtain, document, manage, and revoke users’ cookie consents. This includes assigning a pseudonymous user ID, storing the time and scope of consent, browser/system/device info. Unless otherwise stated, consent is stored for up to two years;
Legal basis: Consent (Art. 6(1)(a) GDPR)
When you contact us (e.g., via post, contact form, email, phone, or social media) or in the context of business/user relationships, we process the data provided by the inquirer as necessary to respond and fulfill the request.
Additional information:
Gerne! Hier ist die englische Übersetzung des Abschnitts über Plug-ins and Embedded Functions and Content sowie den Hinweis zu Changes and Updates:
We integrate function and content elements into our online services that are obtained from the servers of their respective providers (referred to as “third-party providers”). These may include, for example, graphics, videos, or maps (collectively referred to as “content”).
Embedding such content always requires that the third-party providers process users’ IP addresses, as they would otherwise not be able to send the content to users‘ browsers. The IP address is therefore necessary for displaying this content or functionality. We strive to use only content where the providers use the IP address solely to deliver the content.
Third-party providers may also use so-called pixel tags (invisible graphics, also known as „web beacons“) for statistical or marketing purposes. These pixel tags can be used to evaluate visitor traffic on our website. The pseudonymized information may also be stored in cookies on users’ devices and may include technical information such as browser and operating system data, referring websites, visit time, and other data on the use of our online services, and may be linked to such information from other sources.
Legal basis notice: If we request users‘ consent to use third-party providers, the legal basis for the processing of data is that consent. Otherwise, users’ data is processed based on our legitimate interests (i.e., interest in efficient, economical, and user-friendly services). Please also see our information on the use of cookies in this privacy policy.
Further information on processing, procedures, and services:
When visiting our website, users‘ browsers send HTTP requests to the Google Fonts Web API to fetch fonts. These requests include:
Google states:
Provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland
Legal basis: Legitimate interests (Art. 6(1)(f) GDPR)
Website: https://fonts.google.com/
Privacy Policy: https://policies.google.com/privacy
International transfers: Data Privacy Framework (DPF)
Further info: Google Fonts Privacy FAQ
We kindly ask users to regularly review the contents of our privacy policy. We will amend the privacy policy as soon as changes in our data processing practices make it necessary. We will inform you if these changes require your cooperation (e.g., renewed consent) or any other form of individual notification.
Where we provide addresses and contact information of companies and organizations in this privacy policy, please note that such information may change over time. Therefore, we ask you to verify these details before contacting them.
