Privacy Policy

1. Controller

The controller within the meaning of the General Data Protection Regulation (GDPR) is:

Phone: 01792006822
Email: Info@lauras-tortenmanufaktur.de

No data protection officer has been appointed, as there is no obligation to do so under Art. 37 GDPR.

2. General information on data processing

2.1 Scope of processing

I generally process users' personal data only to the extent necessary to provide a functioning website as well as my content and services. Processing regularly takes place only with the user's consent, except in cases where obtaining prior consent is not possible for factual reasons and processing is permitted by law.

2.2 Legal bases

Where I obtain consent for processing operations, Art. 6(1)(a) GDPR serves as the legal basis. Where processing is necessary for the performance of a contract, Art. 6(1)(b) GDPR applies. Where processing is necessary to safeguard a legitimate interest, Art. 6(1)(f) GDPR applies.

2.3 Erasure and storage period

Personal data of the data subject will be erased or blocked as soon as the purpose of storage no longer applies. Storage beyond that may occur where provided for by European or national legislation (e.g. commercial and tax retention periods).

3. Website provision and server log files (hosting)

This website is provided via the Lovable platform (Lovable Labs Inc.). When the website is accessed, the hosting provider automatically collects information in so-called server log files transmitted by your browser. These are:

• browser type and version
• operating system used
• referrer URL
• host name of the accessing device
• time of the server request
• IP address

This data is not merged with other data sources. The legal basis is Art. 6(1)(f) GDPR, as there is a legitimate interest in the technically error-free presentation and optimisation of my website.

Note on third-country transfers: The hosting provider may use servers outside the EU/EEA (in particular in the USA). Where this is the case, the transfer is based on EU standard contractual clauses or an adequacy decision of the EU Commission.

No database or other backend system is currently used for this website; no user accounts or user profiles are stored.

4. Enquiry and contact form

The enquiry form on this website currently processes your entries exclusively locally in your browser. No data is transmitted to or stored on a server of this website.

If you contact me by email or phone, your details including your contact data will be stored for the purpose of processing the enquiry and in case of follow-up questions. Processing is based on Art. 6(1)(b) GDPR where your request relates to the performance of a contract or pre-contractual measures. In all other cases, processing is based on my legitimate interest in effectively handling enquiries (Art. 6(1)(f) GDPR) or on your consent (Art. 6(1)(a) GDPR).

The data remains with me until you ask me to delete it, revoke your consent to storage, or the purpose for storage ceases to apply. Statutory retention periods remain unaffected.

5. Map display (OpenStreetMap)

On the contact page I embed a map view from OpenStreetMap, provided by the OpenStreetMap Foundation, St John's Innovation Centre, Cowley Road, Cambridge, CB4 0WS, United Kingdom. Google Maps is not used on this website.

When the map loads, a connection to OpenStreetMap servers is established, which may transmit your IP address and further technical data of your device. The legal basis is my legitimate interest in providing easy-to-find directions, Art. 6(1)(f) GDPR.

Further information is available in the OpenStreetMap privacy policy: osmfoundation.org/wiki/Privacy_Policy

6. Google Fonts

For a consistent display of typefaces I use fonts from Google Fonts, provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. When a page is loaded, your browser downloads the required fonts from Google servers, which transmits your IP address to Google and may transfer it to the USA.

The legal basis is my legitimate interest in a consistent and appealing presentation of my online offering, Art. 6(1)(f) GDPR. Further information: policies.google.com/privacy

7. Social media

This website contains a link to my Instagram profile (operator: Meta Platforms Ireland Limited, 4 Grand Canal Square, Dublin 2, Ireland). This is a plain text/icon link without an active plugin. No data is transmitted to Meta when my website is loaded.

Only when you click the link and open the platform do the privacy terms of the respective provider apply. No other social media services (e.g. LinkedIn) are embedded on this website.

8. Cookies and consent (Sec. 25 TDDDG)

This website does not use tracking or marketing cookies and does not embed analytics or advertising services. Technically necessary storage operations that are strictly required for the operation of the website are carried out on the basis of Sec. 25(2) no. 2 TDDDG without separate consent.

Should processing that is not technically necessary be added in future, I will obtain active consent before loading it in accordance with Sec. 25(1) TDDDG in conjunction with Art. 6(1)(a) GDPR. Consent given can be withdrawn at any time with effect for the future.

9. SSL/TLS encryption

For security reasons this website uses SSL/TLS encryption. You can recognise an encrypted connection by the browser address bar changing from “http://” to “https://”.

10. Your rights as a data subject

Within the framework of the applicable statutory provisions, you have the right at any time to:

• access (Art. 15 GDPR) the personal data stored about you
• rectification (Art. 16 GDPR) of inaccurate data or completion of your data
• erasure (Art. 17 GDPR) of your stored data
• restriction of processing (Art. 18 GDPR)
• data portability (Art. 20 GDPR)
• object (Art. 21 GDPR) to processing
• withdraw consent given (Art. 7(3) GDPR) with effect for the future

11. Right to lodge a complaint with a supervisory authority

Without prejudice to any other administrative or judicial remedy, you have the right to lodge a complaint with a data protection supervisory authority, in particular in the Member State of your residence, place of work or the place of the alleged infringement, if you consider that the processing of personal data relating to you infringes the GDPR.

Competent supervisory authority for Saxony-Anhalt:

12. Validity and changes to this privacy policy

This privacy policy is currently valid and dated 14 August 2026. Due to the further development of my website and offerings or changed legal or regulatory requirements, it may become necessary to amend this privacy policy. The current version can always be found on this page.