This privacy policy explains which personal data we process when you visit this website, what we use it for and which rights you have. It applies to www.saatkorn.com in German and English. The WorkTech directory at worktech.saatkorn.com has its own privacy policy.
1. Controller and contact
The controller for data processing on this website within the meaning of the General Data Protection Regulation (GDPR) is:
Gero Hesse
SAATKORN
Brockweg 104
33332 Gütersloh, Germany
Phone: +49 160 7132570
Email: saatkorn@googlemail.com
We have not appointed a data protection officer. If you have questions about data protection, you can reach us at the contact details above.
2. Overview of data processing
We only process personal data where this is necessary to provide this website, to answer enquiries, to send our newsletter or to keep the website secure, or where you have given your consent. Personal data means any information that can be used to identify you personally, for example your IP address or your email address.
Legal bases
- Consent (Art. 6(1)(a) GDPR). Where we access or store information on your device, Section 25(1) of the German Digital Services Data Protection Act (TDDDG) applies in addition.
- Contract or pre-contractual measures (Art. 6(1)(b) GDPR), for example when handling your enquiry.
- Legal obligation (Art. 6(1)(c) GDPR).
- Legitimate interests (Art. 6(1)(f) GDPR), for example the secure and stable operation of this website.
Recipients and processors
To provide the website and individual features we use service providers who process data on our behalf (processors under Art. 28 GDPR). They may only process the data in accordance with our instructions. We have corresponding agreements with EPUNKS GmbH, Mailjet, Usercentrics and Google (for Google Analytics). For Wordfence (Defiant) and Cloudflare, the data processing terms provided by the respective provider apply, which become part of the contract automatically upon use.
Transfers outside the EU
Some of the providers named below are based in the USA or process data there. Where the provider is certified under the EU-US Data Privacy Framework, the transfer relies on the adequacy decision of the European Commission, otherwise on standard contractual clauses.
3. Hosting, technical operation and server log files
This website runs on servers of IONOS SE in Germany and is maintained by EPUNKS GmbH, Meller Straße 2, 33613 Bielefeld, Germany, as technical service provider. Requests are routed through an upstream reverse proxy (load balancer, nginx), which terminates the encrypted connection and forwards requests to the web server. We have a data processing agreement with EPUNKS GmbH under Art. 28 GDPR.
When you visit the website, the reverse proxy and the web server automatically record information that your browser transmits (server log files): IP address, date and time of access, page or file requested, referrer URL, browser type and version, operating system, status code and amount of data transferred. We use it to deliver the website, to ensure its stability, to analyse errors and to defend against attacks. The data is not merged with other data.
The legal basis is Art. 6(1)(f) GDPR. Storage period: The logs of the reverse proxy are rotated daily and deleted after 14 days. The logs of the web server are rotated by size (currently they go back about one week) and overwritten after 30 days at the latest.
4. Consent management (Usercentrics) and cookies
We use the consent management platform “Usercentrics” of Usercentrics GmbH, Sendlinger Straße 7, 80331 Munich, Germany. It collects, stores and documents your consent to optional services. When you visit the website, a script is loaded from Usercentrics servers for this purpose (app.usercentrics.eu, privacy-proxy.usercentrics.eu, api.usercentrics.eu). The data processed is your decision (consent or refusal for each service), the time, the version of the banner and technical details such as browser, device and a shortened IP address. We store your choice in the local storage of your browser.
The legal basis is Art. 6(1)(c) GDPR in conjunction with Art. 7(1) GDPR, to be able to prove your consent. You can change or withdraw your choice at any time via the privacy settings (link “Cookie Policy (EU)” in the footer of the website).
Our own cookies: This website does not set any cookies of its own for visitors. Cookies or similar technologies may be set when the third-party services described below are loaded, but only with your consent. For logged-in editors WordPress sets technically necessary cookies for the login.
5. Web analytics with Google Analytics (only with consent)
With your consent we use Google Analytics 4 of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (“Google”). It is integrated via the WordPress plugin ExactMetrics. Without your consent Google Analytics is not loaded or executed, and no data is transmitted to Google.
Google Analytics records how the website is used: pages viewed, time spent, clicks, origin of visitors, device, browser, approximate location and pseudonymous identifiers. IP anonymisation is enabled. We use the evaluation to measure reach and to improve our content. Data may be transferred to the USA (see section 2).
The legal basis is your consent (Art. 6(1)(a) GDPR, Section 25(1) TDDDG). You can withdraw it at any time via the privacy settings. Storage period at Google: event data 2 months, user-related data (linked to cookies, user or advertising IDs) 14 months. The 14-month period restarts with new user activity. We have a data processing agreement with Google.
6. Contact and forms
If you contact us by email, phone or through one of our forms, we process the data you give us (for example name, email address and message) and, for forms, the date and time of submission. We use it to handle and answer your enquiry.
The forms run on the WordPress plugin SureForms. Submissions are stored in the database of this website and delivered to us by email. Email delivery is handled by the service Mailjet (see section 9). Our technical service provider EPUNKS has access for maintenance of the website.
The legal basis is Art. 6(1)(b) GDPR if your enquiry relates to a contract, otherwise Art. 6(1)(f) GDPR. We delete your enquiry after twelve months at the latest, unless statutory retention periods prevent this.
7. Spam protection with Cloudflare Turnstile
To protect our forms from automated abuse we use “Turnstile” of Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107, USA. For this purpose a script is loaded from challenges.cloudflare.com on pages with forms. Your IP address as well as browser, device and interaction data may be transmitted to Cloudflare and processed there to determine whether the input comes from a human. According to the provider, Turnstile does not set cookies and does not track visitors across sites.
The legal basis is Art. 6(1)(f) GDPR. Our legitimate interest is the protection of the forms against spam and abuse. The script is loaded without prior prompt. In the consent management Cloudflare is listed as a necessary service because the forms cannot be operated securely without spam protection.
8. Newsletter (Mailjet)
If you subscribe to our newsletter, we collect your email address and first name as well as your consent. We use them to send you content and news about SAATKORN. After signing up you receive a confirmation email (double opt-in). Only when you click the confirmation link in it do we add you to the mailing list.
The sign-up form on this website transmits your details to Mailjet on the server side. Mailjet SAS (Paris, France; part of the Sinch group) sends the newsletter and manages the recipient list as our processor. According to the provider, the data is stored in data centres in Frankfurt am Main and in Saint-Ghislain, Belgium. We have a data processing agreement with Mailjet. In addition, this website stores the form submission in its database and deletes it after twelve months.
Mailjet evaluates whether and when a newsletter was opened and which links were clicked (open and click statistics). A tracking pixel in the email and individual links are used for this; among other things your IP address, device and the time are recorded. We use the statistics to improve our newsletter.
The legal basis is your consent (Art. 6(1)(a) GDPR). We store your data until you unsubscribe. You can unsubscribe at any time using the link in each newsletter or by email to us. You can withdraw your consent at any time with effect for the future.
9. Email delivery of the website
System notifications of this website, for example the receipt of a form enquiry, are sent through the service Mailjet (Mailjet SAS, Paris, France). The sender, recipient, subject and content of the message are processed. The legal basis is Art. 6(1)(f) GDPR (reliable delivery of our messages) or Art. 6(1)(b) GDPR. Mailjet acts as a processor. The system keeps a log of sent messages, including their content, in the database of this website for 30 days (to trace delivery problems) and then deletes them automatically.
10. Search and the WorkTech directory
When you use the search of this website, our server processes your search term. In addition, our server queries the WorkTech directory (worktech.saatkorn.com) for matching products. The directory is also operated by us; the technical implementation is carried out by service providers. Only the search term is transmitted. Your IP address and browser details are not passed on to the directory because the query is made from our server. We cache the results for up to ten minutes to speed up requests. We load product logos through our own server.
If you click a result or “Keep searching in the directory”, you leave this website. The privacy policy of the WorkTech directory (worktech.saatkorn.com/datenschutz) then applies. The legal basis of the search is Art. 6(1)(f) GDPR.
11. Embedded content from third parties
Some posts embed content from other providers, mainly podcast players and videos. When such content is loaded, data is transmitted to the respective provider, mainly your IP address, browser details and the page you visited. The provider may use cookies or similar technologies and analyse your usage behaviour.
The Podigee podcast player is loaded without prior prompt when you open a post with a podcast episode, because the podcast is a core part of our offering. Podigee receives your IP address, browser details and the page you visited. The legal basis is Art. 6(1)(f) GDPR (our interest in providing the podcast). You can object at any time (see section 17).
We load videos and audio players from YouTube, Vimeo and SoundCloud only with your consent. Until then the content is not loaded. The legal basis is Art. 6(1)(a) GDPR and Section 25(1) TDDDG. You can withdraw your consent at any time via the privacy settings. Depending on the post, the following providers are embedded:
- Podigee (podcast hosting and player): Podigee GmbH, Revaler Straße 28, 10245 Berlin, Germany.
- YouTube (videos): Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Privacy: policies.google.com/privacy.
- Vimeo (videos): Vimeo.com, Inc., 330 West 34th Street, 5th Floor, New York, NY 10001, USA.
- SoundCloud (audio): SoundCloud Global Limited & Co. KG, Rheinsberger Str. 76/77, 10115 Berlin, Germany.
- Others (in several older posts, about 30): the former sign-up form of Mailjet (Mailjet SAS, Paris, France). It is loaded only with your consent (service “Mailjet”).
12. Social networks and external links
On this website we link to our profiles (for example on LinkedIn) and to external sites. Merely visiting our pages does not transmit any data to these providers. Only when you click a link do you leave our website, and the privacy policy of the respective provider applies.
13. Website security
To protect against attacks we use the security plugin “Wordfence” (Defiant, Inc., 800 5th Ave Ste 4100, Seattle, WA 98104, USA). It checks access to the website and the login page, blocks suspicious access and in doing so records, among other things, IP address, time, the address requested and browser details. We take part in the real-time network of Wordfence: information about attacks (for example IP addresses of suspicious access) may be transmitted to the provider’s servers. Defiant relies on standard contractual clauses for transfers to the USA.
In addition, the website logs requests for pages that were not found (404 errors) in order to fix faulty links. The plugin “Redirection” used for this also stores IP addresses and deletes these entries after 30 days. Editors log in to the back end with two-factor authentication.
The legal basis is Art. 6(1)(f) GDPR (protection of the website and its data). Storage period: 404 log 30 days; Wordfence security logs (with IP address): log of suspicious requests at most 30 days, login log the most recent 2,000 entries (currently a few days). Temporary blocks are removed automatically after they expire; blocks that we have entered individually as permanent remain until lifted.
14. User accounts and comments (existing data)
Registration on this website and new comments are switched off. Existing user accounts and earlier comments are still stored. For comments this includes name or pseudonym, email address, IP address, time and comment text. Only approved comments with name and text are publicly visible.
You can request information about, correction of or deletion of your comment or your account at any time (contact see section 1). The legal basis is Art. 6(1)(f) GDPR or your earlier consent. We delete accounts and comments on request.
15. Fonts and images
We load the fonts of this website from our own server. No data is transmitted to Google or other font providers for this. We also deliver images and graphics from our own server.
Your device displays emoji with its own font; no images are loaded from third parties for this. For country flags we additionally use the font “Twemoji Country Flags”, also from our own server, because some systems (e.g. Windows) otherwise show flags only as a pair of letters. The flag graphics come from the Twemoji project (Copyright Twitter, Inc. and other contributors) and are licensed under CC BY 4.0.
16. Storage period
We store personal data only as long as it is necessary for the respective purpose or statutory retention periods require. Data that we process on the basis of your consent is stored until you withdraw it. We name specific periods for the individual processing activities above.
17. Your rights
Under the GDPR you have the following rights against us as controller:
- access to your stored personal data (Art. 15 GDPR),
- correction of inaccurate data (Art. 16 GDPR),
- erasure of your data (Art. 17 GDPR),
- restriction of processing (Art. 18 GDPR),
- data portability (Art. 20 GDPR),
- withdrawal of consent given, with effect for the future (Art. 7(3) GDPR),
- lodging a complaint with a supervisory authority (Art. 77 GDPR).
Right to object: Where we process data on the basis of legitimate interests (Art. 6(1)(f) GDPR), you may object to this processing at any time on grounds relating to your particular situation. We will then stop processing the data unless we can demonstrate compelling legitimate grounds.
To exercise your rights an informal message to the contact details in section 1 is sufficient. The supervisory authority responsible for us is the State Commissioner for Data Protection and Freedom of Information of North Rhine-Westphalia (Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen), Kavalleriestraße 2–4, 40213 Düsseldorf, Germany.
18. No automated decision-making
There is no automated decision-making, including profiling, within the meaning of Art. 22 GDPR.
19. Encryption
For security reasons this website uses SSL/TLS encryption (HTTPS). You can recognise an encrypted connection by “https://” in the address bar of your browser.
20. Currentness and changes
This privacy policy was last updated on: 21 October 2026. We adapt it when our website, our services or the legal requirements change. You will always find the current version on this page.