Privacy policy

1. Controller

[FULL NAME]
[STREET AND NUMBER]
[TOWN] [POSTCODE]
Malta
Email: [EMAIL ADDRESS]

We have not appointed a data protection officer because we are not required to.

2. Visiting the website

When you open servusmuc.de, our hosting provider [HOSTING PROVIDER, LOCATION] processes technically necessary data: IP address, date and time, the page requested, referrer, browser and operating system. Without this data the website can't be delivered or protected against attacks.

The legal basis is our legitimate interest in a secure, working service (Art. 6(1)(f) GDPR). Server logs are deleted after [NUMBER] days. We have a data processing agreement with the hosting provider.

The fonts are served from our own server; loading the page makes no connection to Google or other font providers.

3. Cookies and analytics

This website sets no cookies and uses no analytics or tracking tools.

4. Newsletter

When you subscribe, we process your email address, the edition you chose (English, German or both), the time and IP address of your signup and confirmation, and, where applicable, which referral link or social media post brought you to us.

Signup uses double opt-in: you receive an email with a confirmation link, and we only send the newsletter after you confirm. This makes sure nobody can sign up someone else's address.

The legal basis is your consent (Art. 6(1)(a) GDPR). You can withdraw it at any time, through the unsubscribe link in every issue or by emailing us. When you unsubscribe, we remove your address from the list. We keep proof of consent (time and IP address of signup and confirmation) for up to three years so we can show that the signup was valid (Art. 6(1)(f) GDPR).

Statistics: we measure whether an issue is opened and which links in it are clicked. Each email contains a small tracking pixel, and links pass through a redirect at our email provider. We use these figures to improve the newsletter and only ever share aggregate figures with sponsors (for example the average open rate), never data about individual readers. This is part of the consent you give when subscribing, and it ends when you unsubscribe.

• Subscriber storage: Neon (Neon, LLC, part of the Databricks group, USA), on servers in the EU ([NEON REGION]).
• Sending and statistics: Resend (Plus Five Five, Inc., USA).

The provider is based in the USA. We base the transfer on the EU-US Data Privacy Framework (Art. 45 GDPR) where the provider is certified under it, and otherwise on the European Commission's standard contractual clauses (Art. 46(2)(c) GDPR). We have a data processing agreement with the provider (Art. 28 GDPR).

You must be at least 16 to subscribe.

5. Referrals

Every subscriber gets a personal referral link. If someone subscribes through it, we store whose link was used and count the referrals. The person who signs up learns nothing about the referrer beyond what the referrer chooses to share. The legal basis is our legitimate interest in keeping track of referrals (Art. 6(1)(f) GDPR).

6. Contact and sponsorship enquiries

If you email us, as a reader or a potential sponsor, we process your details to answer (Art. 6(1)(b) GDPR for enquiries about a booking, otherwise Art. 6(1)(f) GDPR). We delete the correspondence once it's dealt with, unless we're legally required to keep it.

7. Our social media profiles

Servus MUC is on Instagram and Threads (Meta Platforms Ireland Limited, Dublin), TikTok (TikTok Technology Limited, Dublin) and LinkedIn (LinkedIn Ireland Unlimited Company, Dublin). When you visit or interact with these profiles, the platforms process your data under their own privacy policies, which we have no influence over.

Where the platforms give us statistics about how our profiles are used (for example Instagram Insights), we are joint controllers with the platform (Art. 26 GDPR). For Meta, the Page Controller Addendum applies: facebook.com/legal/terms/page_controller_addendum. We only receive aggregate figures, not data about individuals.

We read and answer comments and direct messages to communicate with you (Art. 6(1)(f) GDPR). To publish our posts we use the scheduling software Postiz, which we run ourselves on a server of netcup GmbH (Karlsruhe, Germany) in Nuremberg. We have a data processing agreement with netcup.

Your rights against the platforms are best exercised with them directly, but we're happy to pass on requests sent to us.

8. Your rights

You have the right to access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20), and to withdraw consent with effect for the future (Art. 7(3)). An email to [EMAIL ADDRESS] is enough.

Right to object: where we process data on the basis of our legitimate interest (Art. 6(1)(f) GDPR), you can object at any time on grounds relating to your particular situation (Art. 21 GDPR).

You can also complain to a data protection authority. The one responsible for us is:

Information and Data Protection Commissioner (IDPC)
Floor 2, Airways House, Triq Il-Kbira, Tas-Sliema SLM 1549, Malta
idpc.org.mt

You can equally complain to the authority in the EU country where you live or work, for example the Bayerisches Landesamt für Datenschutzaufsicht (BayLDA) if you live in Bavaria.

9. Changes

We update this policy when our service or the law changes. The version published here applies.