Privacy Policy

1. Data controller

The data controller within the meaning of the General Data Protection Regulation (GDPR) is:

Phone

Email

2. General information on data processing

We generally process the personal data of our users only to the extent necessary to provide a functioning website and our content and services (digital waiting-room management). Processing regularly takes place only with the consent of the data subject (Art. 6(1)(a) GDPR), for the performance of a contract or pre-contractual measures (Art. 6(1)(b) GDPR), to comply with legal obligations (Art. 6(1)(c) GDPR), or on the basis of legitimate interests (Art. 6(1)(f) GDPR).

3. Provision of the website (server log files)

We operate our website on a virtual server (VPS) provided by 1&1 IONOS SE, Elgendorfer Straße 57, 56410 Montabaur, Germany. When you access our website, our hosting provider automatically collects data and information in so-called server log files (including IP address, date and time of the request, page accessed, browser type, operating system used, referrer URL). The legal basis is Art. 6(1)(f) GDPR (legitimate interest in the technical provision and security of the website). We have entered into a data processing agreement with IONOS in accordance with Art. 28 GDPR. When you submit a form, we also process your IP address to protect against misuse: we count forms per connection and store only a check value derived with a secret key, not the address itself. We delete the counters after 24 hours at the latest. The legal basis is Art. 6(1)(f) GDPR.

4. Registration, account and bookings

The creation of a user account is required to use certain functions (e.g. managing waiting rooms, bookings, staff and role management). In doing so, we process the data you provide (including name, email address, password as a hash, and, if applicable, address and contact details of the waiting room) to establish, design and modify the user relationship (Art. 6(1)(b) GDPR). When participating in a waiting room as a guest, we process the information necessary to organise the queue (e.g. name, phone number, chosen position).

5. Resetting your password

If you reset your password, we send a time-limited, signed link (valid for several hours) to the email address on file, which can be used to set a new password. The legal basis is Art. 6(1)(b) GDPR (performance of the user agreement) and/or Art. 6(1)(f) GDPR (protecting the account from unauthorised access).

6. Contact form and email contact

If you send us enquiries via the contact form or by email, your details (name, email address, message text) will be stored by us in order to process the enquiry and in case of follow-up questions. The legal basis is Art. 6(1)(b) GDPR and/or Art. 6(1)(f) GDPR (legitimate interest in responding to enquiries). System and transactional emails (e.g. registration confirmation, password reset, reminders) are also sent via 1&1 IONOS SE (see section 3 regarding the data processing agreement in place there).

7. Payment processing via PayPal

When paying for chargeable services, we offer payment via the provider PayPal (PayPal (Europe) S.à.r.l. et Cie, S.C.A., 22-24 Boulevard Royal, L-2449 Luxembourg). As part of payment processing, we transmit the data required for this purpose (e.g. name, billing address, payment amount) to PayPal. Processing takes place for the performance of the contract (Art. 6(1)(b) GDPR). Data may be transferred to third countries (including the USA); PayPal has put in place suitable safeguards for this (e.g. EU standard contractual clauses). Further information can be found in PayPal's privacy policy: https://www.paypal.com/de/webapps/mpp/ua/privacy-full

8. Invoicing

We create and store invoices in our own system. In doing so we process the data required for invoicing (e.g. name, address, service billed, amount) and keep the invoice as a PDF. The legal basis is Art. 6(1)(c) GDPR (compliance with retention obligations under commercial and tax law) in conjunction with Art. 6(1)(b) GDPR. No transfer to an external accounting service currently takes place; should that change, we will name the service here.

9. WhatsApp integration (Meta Cloud API)

If a provider activates the optional WhatsApp integration, guests can communicate with the respective waiting room via WhatsApp or join the queue. In doing so, phone number and message text are processed via the Meta Cloud API (Meta Platforms Ireland Limited, 4 Grand Canal Square, Dublin 2, Ireland). Data may be transferred to third countries (including the USA). The legal basis is Art. 6(1)(b) GDPR (performance of the user agreement between guest and provider) and/or Art. 6(1)(f) GDPR. Further information: https://www.whatsapp.com/legal/privacy-policy

10. Cookies and session management

We use technically necessary cookies only. A session cookie is created as soon as you log in or use a form on this website; the session is stored in our database and ends after eight hours of inactivity at the latest. If you join a queue as a guest, a further cookie holding a random token is added, which lets you find your own waiting status again. Both are strictly necessary for operation; consent is not required for this under Section 25(2) TTDSG. The legal basis is Art. 6(1)(f) GDPR (legitimate interest in providing a secure and functioning website).

11. Web analysis and consent banner

This website sets no analytics or marketing cookies, embeds no fonts and no videos from third-party servers, and measures no reach. That is also why you will not find a consent banner here: there would be nothing to consent to. Earlier versions of this website embedded a web analytics tool; it was removed when the site was moved in September 2026.

12. Storage period

We store personal data only for as long as is necessary for the respective processing purposes, or as long as required by statutory retention periods (e.g. requirements under commercial and tax law, generally 6–10 years for invoicing and booking documents). The data is then deleted or anonymised, provided there are no legitimate reasons for further storage.

13. Your rights as a data subject

Subject to the statutory requirements, you have the following rights:

• Right of access (Art. 15 GDPR)
• Right to rectification (Art. 16 GDPR)
• Right to erasure (Art. 17 GDPR)
• Right to restriction of processing (Art. 18 GDPR)
• Right to data portability (Art. 20 GDPR)
• Right to object to processing (Art. 21 GDPR)
• Right to withdraw consent given, with effect for the future (Art. 7(3) GDPR)
• Right to lodge a complaint with a supervisory authority (Art. 77 GDPR)

To exercise your rights, please contact us using the contact details given in the "Data controller" section. You also have the right to lodge a complaint with the supervisory authority responsible for us:

Independent Centre for Privacy Protection Schleswig-Holstein (ULD)

14. Data security

We use the widely used TLS/SSL encryption method during your visit to the website. In addition, we employ suitable technical and organisational security measures to protect your data against accidental or intentional manipulation, partial or complete loss, destruction, or unauthorised access by third parties.

15. Currency and amendment of this privacy policy

This privacy policy is currently valid. As we further develop our website and services, or due to changes in legal or regulatory requirements, it may become necessary to amend this privacy policy.

Last updated: {0}.