Soldier. Author. My own perspective.
Freedom remains real only if we are willing to protect it.
Talking about security means
taking responsibility.
I know the
view from above.
And life
afterwards.
I am André Hassan Khan. As a sensor operator on the Heron 1, I carried out missions from a bird’s-eye view.
Today, I write and speak about what stays with us: responsibility, the lasting effects of deployments, and the people behind the technology.
More about meMy perspective.
From experience.
The Heron 1 unmanned ISR system.
ISR stands for Intelligence, Surveillance and Reconnaissance: gathering information, monitoring an area and observing what is happening on the ground.
The console as a human–machine interface.
I have logged 3,000 flight hours as a Heron 1 sensor operator. I am also familiar with the Hermes 450 and the Israeli variant of the Heron TP.
One view. Three perspectives.
Topics & Insights
A perspective shaped by experience.
As a sensor operator, I worked with the Heron 1 unmanned ISR system. ISR stands for Intelligence, Surveillance and Reconnaissance — gathering information, monitoring an area and observing what is happening on the ground. My job meant looking through its sensors at events on the ground.
When I talk about drones and Counter-UAS, my interest goes beyond the technology: What information does it provide? How is it used? And who takes responsibility?
Freedom requires responsibility.
Freedom is a personal value for me. It shapes how I see security and how we take responsibility as a society.
In conversations and in my writing, I draw on my own experience. I want to bring different perspectives together and take a closer look.

André Hassan Khan · with Gideon Böss
Today, everything
feels like war.
A mission ends.
The images remain.
In my book, I write about Afghanistan, my family, and living with PTSD. A personal story about the traces war leaves behind and finding a way back to life. Published in German as Heute fühlt sich alles an wie Krieg.
Book & excerpt at Rowohlt (German)04 / The person behind the perspective
Lived through.
Worked through.
Spoken about.
Born in Neumünster in 1976. Career soldier. In 2010, I was among the first to bring the Heron 1 unmanned ISR system into operational service in Afghanistan. Our task was to close a gap in intelligence, surveillance and reconnaissance for the German Air Force and forces operating in northern Afghanistan. Over my career, I have deployed more than 27 times.
Since my PTSD injury in 2017, I have advocated for a more open conversation about invisible wounds. Because behind every mission are people.
Looking for
more insight?
For readings, conversations,
media enquiries, or a different
perspective on things.
Legal notice
Information pursuant to Section 5 TMG
André Hassan Khan
Koppoldstr. 1
c/o COCENTER
86551 Aichach
Contact email: andre@hassankhan.de
Privacy policy
Introduction and overview
We have written this privacy policy (version 21 October 2023-312656973) to explain, in accordance with the General Data Protection Regulation (EU) 2016/679 and applicable national laws, which personal data (referred to below as data) we as the controller — and processors acting on our behalf, such as providers — process and will process in the future, and which lawful options are available to you. The terms used are gender-neutral.
In brief: We provide comprehensive information about the data we process about you.
Privacy policies usually sound very technical and use specialist legal terms. This policy aims to explain the most important points as simply and transparently as possible. Where it helps transparency, technical terms are explained in accessible language, links to further information are provided, and graphics are used. We explain in clear, simple language that, in the course of our business activities, we only process personal data where an appropriate legal basis exists. This is difficult to achieve with the brief, unclear, legalistic explanations often found online. I hope you find the following explanations interesting and informative, and perhaps learn something new.
If you still have questions, please contact the controller named below or in the legal notice, follow the links provided, and consult third-party websites for further information. Our contact details are also included in the legal notice.
Scope
This privacy policy applies to all personal data processed within our company and to all personal data processed by companies acting on our behalf (processors). By personal data, we mean information within the meaning of Article 4(1) GDPR, such as a person’s name, email address and postal address. Processing personal data enables us to provide and bill for our services and products, online and offline. The scope of this privacy policy includes:
- all online presences (websites and online shops) that we operate
- social media presences and email communication
- mobile apps for smartphones and other devices
In brief: This privacy policy applies wherever personal data is processed in a structured way within the company through the channels listed above. If we enter into legal relationships with you outside these channels, we will inform you separately where necessary.
Legal bases
In this privacy policy, we provide transparent information about the legal principles and provisions — the legal bases under the General Data Protection Regulation — that allow us to process personal data.
For EU law, we refer to REGULATION (EU) 2016/679 OF THE EUROPEAN PARLIAMENT AND OF THE COUNCIL of 27 April 2016. You can read this EU General Data Protection Regulation online on EUR-Lex, the gateway to EU law, at https://eur-lex.europa.eu/legal-content/DE/ALL/?uri=celex%3A32016R0679.
We only process your data where at least one of the following conditions applies:
- Consent (Article 6(1)(a) GDPR): You have given us consent to process data for a specific purpose. An example would be storing the data you enter in a contact form.
- Contract (Article 6(1)(b) GDPR): We process your data to fulfil a contract or pre-contractual obligations with you. For example, if we enter into a purchase agreement with you, we need personal information beforehand.
- Legal obligation (Article 6(1)(c) GDPR): We process your data where we are subject to a legal obligation. For example, we are legally required to retain invoices for accounting purposes. These usually contain personal data.
- Legitimate interests (Article 6(1)(f) GDPR): Where legitimate interests do not restrict your fundamental rights, we reserve the right to process personal data. For example, we need to process certain data to operate our website securely and economically. This processing therefore constitutes a legitimate interest.
Other conditions, such as performing tasks in the public interest, exercising official authority or protecting vital interests, generally do not apply to us. If such a legal basis does apply, we will identify it in the relevant section.
National laws apply in addition to the EU regulation:
- In Austria, this is the Federal Act on the Protection of Natural Persons with regard to the Processing of Personal Data (Data Protection Act), abbreviated to DSG.
- In Germany, the Federal Data Protection Act, abbreviated to BDSG, applies.
Where further regional or national laws apply, we inform you about them in the following sections.
Controller’s contact details
If you have questions about data protection or the processing of personal data, the contact details of the responsible person or organisation are provided below:
André Hassan Khan
Koppoldstr. 1, 86551 Aichach, Germany
Email: andre@hassankhan.de
Legal notice: here on this page
Retention period
Our general rule is to store personal data only for as long as strictly necessary to provide our services and products. This means that we delete personal data as soon as the reason for processing it no longer exists. In some cases, we are legally required to retain certain data after the original purpose has ceased, for example for accounting purposes.
If you request the deletion of your data or withdraw your consent to processing, the data will be deleted as quickly as possible, provided no retention obligation applies.
Where further information is available, we explain the specific duration of each processing activity below.
Rights under the General Data Protection Regulation
Under Articles 13 and 14 GDPR, we inform you of the following rights to ensure fair and transparent processing:
- Under Article 15 GDPR, you have the right to know whether we process data about you. If we do, you have the right to receive a copy of the data and the following information:
- the purposes of processing;
- the categories or types of data being processed;
- who receives the data and, if data is transferred to third countries, how its security is guaranteed;
- how long the data is stored;
- the existence of the rights to rectification, erasure, restriction of processing and objection;
- your right to lodge a complaint with a supervisory authority (links are provided below);
- the source of the data, if we did not collect it from you;
- whether profiling takes place, meaning automated evaluation of data to create a personal profile of you.
- Under Article 16 GDPR, you have the right to rectification, meaning that we must correct data if you identify errors.
- Under Article 17 GDPR, you have the right to erasure (the “right to be forgotten”), meaning that you may request the deletion of your data.
- Under Article 18 GDPR, you have the right to restriction of processing, meaning that we may continue to store the data but may no longer use it.
- Under Article 20 GDPR, you have the right to data portability, meaning that we provide your data in a commonly used format on request.
- Under Article 21 GDPR, you have the right to object; a successful objection results in a change to the processing.
- If processing is based on Article 6(1)(e) GDPR (public interest or exercise of official authority) or Article 6(1)(f) GDPR (legitimate interests), you may object. We then examine as quickly as possible whether we can legally comply.
- If data is used for direct marketing, you may object at any time. We may then no longer use your data for direct marketing.
- If data is used for profiling, you may object at any time. We may then no longer use your data for profiling.
- Under Article 22 GDPR, in certain circumstances you have the right not to be subject to a decision based solely on automated processing, such as profiling.
- Under Article 77 GDPR, you have the right to lodge a complaint. You may contact a data protection authority at any time if you believe the processing of personal data infringes the GDPR.
In brief: You have rights — please do not hesitate to contact the controller listed above!
If you believe that processing your data infringes data protection law or otherwise violates your data protection rights, you may complain to a supervisory authority. In Austria, this is the data protection authority at https://www.dsb.gv.at/. In Germany, each federal state has a data protection commissioner. For further information, you can contact the Federal Commissioner for Data Protection and Freedom of Information (BfDI). The following local data protection authority is responsible for our company:
Schleswig-Holstein data protection authority
State Data Protection Commissioner: Marit Hansen
Address: Holstenstraße 98, 24103 Kiel
Telephone: 04 31/988-12 00
Email: mail@datenschutzzentrum.de
Website: https://www.datenschutzzentrum.de/
Communication
| Communication summary 👥 Data subjects: Everyone who communicates with us by telephone, email or online form 📓 Data processed: For example, telephone number, name, email address and submitted form data. Further details are provided for each contact method. 🤝 Purpose: Handling communication with customers, business partners and others 📅 Retention period: Duration of the business matter and statutory requirements ⚖️ Legal bases: Article 6(1)(a) GDPR (consent), Article 6(1)(b) GDPR (contract), Article 6(1)(f) GDPR (legitimate interests) |
If you contact us by telephone, email or online form, personal data may be processed.
The data is processed to handle your enquiry and the related business transaction. It is stored for that duration or for as long as required by law.
Data subjects
These activities affect everyone who contacts us through the communication channels we provide.
Telephone
If you call us, call data is stored in pseudonymised form on the relevant device and by the telecommunications provider. Data such as your name and telephone number may also be sent by email afterwards and stored to answer your enquiry. The data is deleted once the business matter is concluded and legal requirements permit deletion.
If you communicate with us by email, data may be stored on the relevant device (computer, laptop, smartphone, etc.) and on the email server. The data is deleted once the business matter is concluded and legal requirements permit deletion.
Online forms
If you communicate with us using an online form, data is stored on our web server and may be forwarded to one of our email addresses. The data is deleted once the business matter is concluded and legal requirements permit deletion.
Legal bases
Processing is based on the following legal bases:
- Article 6(1)(a) GDPR (consent): You consent to us storing your data and using it for purposes relating to the business matter;
- Article 6(1)(b) GDPR (contract): Processing is necessary to fulfil a contract with you or with a processor such as a telephone provider, or for pre-contractual activities such as preparing an offer;
- Article 6(1)(f) GDPR (legitimate interests): We want to handle customer enquiries and business communication professionally. Certain technical facilities, such as email programs, Exchange servers and mobile network operators, are needed for efficient communication.
Cookies
| Cookies summary 👥 Data subjects: Website visitors 🤝 Purpose: Depends on the individual cookie. Further details are provided below or by the software manufacturer that sets the cookie. 📓 Data processed: Depends on the cookie used. Further details are provided below or by the software manufacturer that sets the cookie. 📅 Retention period: Depends on the individual cookie and can range from hours to years ⚖️ Legal bases: Article 6(1)(a) GDPR (consent), Article 6(1)(f) GDPR (legitimate interests) |
What are cookies?
Our website uses HTTP cookies to store user-specific data.
Below, we explain what cookies are and why they are used, to help you understand the rest of this privacy policy.
Whenever you browse the internet, you use a browser. Well-known browsers include Chrome, Safari, Firefox, Internet Explorer and Microsoft Edge. Most websites store small text files in your browser. These files are called cookies.
Cookies are useful little helpers. Almost all websites use them. More precisely, these are HTTP cookies, as other kinds of cookies exist for other applications. HTTP cookies are small files that our website stores on your computer. They are automatically placed in the cookie folder — effectively your browser’s “memory”. A cookie consists of a name and a value. When defining a cookie, one or more additional attributes must also be specified.
Cookies store certain user data, such as your language or personal page settings. When you return to our website, your browser sends this user-related information back. Cookies help our website recognise you and provide your familiar settings. In some browsers, each cookie has its own file; in others, such as Firefox, all cookies are stored in a single file.
The following graphic shows a possible interaction between a browser such as Chrome and the web server. The browser requests a website and receives a cookie from the server, which it uses again when another page is requested.
There are both first-party and third-party cookies. First-party cookies are created directly by our website; third-party cookies are created by partner websites, such as Google Analytics. Each cookie must be assessed individually because each stores different data. Their lifetimes also vary, from a few minutes to several years. Cookies are not software programs and contain no viruses, Trojans or other malware. They cannot access information on your PC.
Cookie data may look like this:
Name: _ga
Value: GA1.2.1326744211.152312656973-9
Purpose: Distinguishing website visitors
Expiry: After 2 years
A browser should support at least:
- 4096 bytes per cookie
- 50 cookies per domain
- 3000 cookies in total
What types of cookies are there?
The specific cookies we use depend on the services used and are explained in the following sections. Here, we briefly describe the different types of HTTP cookies.
Four types of cookies can be distinguished:
Essential cookies
These cookies are necessary for basic website functions. For example, they are needed when a user puts a product in a shopping basket, browses other pages, and checks out later. They ensure the basket is not deleted, even if the user closes the browser window.
Functional cookies
These cookies collect information about user behaviour and any error messages received. They also measure loading times and website behaviour in different browsers.
Preference cookies
These improve usability. For example, they store entered locations, font sizes or form data.
Advertising cookies
Also known as targeting cookies, these deliver individually tailored advertising. This can be convenient, but also annoying.
On your first visit to a website, you are usually asked which types of cookies you wish to allow. This decision is, of course, also stored in a cookie.
To learn more about cookies, if you are comfortable with technical documentation, we recommend https://datatracker.ietf.org/doc/html/rfc6265, the Internet Engineering Task Force (IETF) Request for Comments entitled “HTTP State Management Mechanism”.
Purpose of processing through cookies
The purpose ultimately depends on the individual cookie. Further details are provided below or by the manufacturer of the software that sets it.
What data is processed?
Cookies help with many different tasks. It is not possible to generalise about the data stored in them, but the following privacy policy explains which data is processed or stored.
Cookie retention periods
The retention period depends on the cookie and is specified further below. Some cookies are deleted after less than an hour; others can remain on a computer for several years.
You can also influence the retention period yourself. You can manually delete all cookies through your browser at any time (see “Right to object” below). Cookies based on consent are deleted no later than when you withdraw consent; this does not affect the lawfulness of storage before withdrawal.
Right to object — how can I delete cookies?
You decide whether and how to use cookies. Regardless of which service or website they come from, you can always delete, disable or partially allow cookies. For example, you can block third-party cookies while allowing all others.
To see which cookies are stored in your browser, or to change or delete cookie settings, consult your browser settings:
Chrome: Delete, enable and manage cookies in Chrome
Safari: Manage cookies and website data in Safari
Firefox: Clear cookies to remove information websites have stored on your computer
Internet Explorer: Delete and manage cookies
Microsoft Edge: Delete and manage cookies
If you do not want cookies at all, you can configure your browser to notify you whenever one is about to be set. You can then decide for each cookie whether to allow it. The procedure varies by browser. For Chrome, for example, search Google for “delete cookies Chrome” or “disable cookies Chrome”.
Legal basis
So-called “cookie directives” have existed since 2009. They state that storing cookies requires your consent (Article 6(1)(a) GDPR). EU countries have responded to these directives in very different ways. In Austria, the directive was implemented in Section 96(3) of the Telecommunications Act (TKG). In Germany, the cookie directives were not transposed as national law. Instead, implementation largely took place through Section 15(3) of the Telemedia Act (TMG).
For strictly necessary cookies, legitimate interests (Article 6(1)(f) GDPR) exist even without consent; these are usually economic in nature. We want to offer website visitors a pleasant experience, for which certain cookies are often essential.
Non-essential cookies are only used with your consent. The legal basis is Article 6(1)(a) GDPR.
The following sections provide more detailed information about cookies where the software used sets them.
Introduction to web hosting
| Web hosting summary 👥 Data subjects: Website visitors 🤝 Purpose: Professional website hosting and secure operation 📓 Data processed: IP address, time of website visit, browser used and other data. Further details are provided below or by the hosting provider concerned. 📅 Retention period: Depends on the provider, but usually 2 weeks ⚖️ Legal basis: Article 6(1)(f) GDPR (legitimate interests) |
What is web hosting?
When you visit websites today, certain information, including personal data, is automatically generated and stored. This also happens on this website. Such data should be processed sparingly and only with justification. By “website”, we mean all web pages on a domain, from the homepage to the final subpage, such as this one. A domain might be example.de or example.com.
To view a website on a computer, tablet or smartphone, you use a program called a web browser. You probably know names such as Google Chrome, Microsoft Edge, Mozilla Firefox and Apple Safari. We call these browsers or web browsers.
To display a website, the browser must connect to another computer where the website’s code is stored: the web server. Operating a web server is complex and demanding, so it is usually handled by professional providers. They offer web hosting and ensure reliable, error-free storage of website data. That is a lot of technical terminology, but please bear with us!
Personal data may be processed when the browser on your computer (desktop, laptop, tablet or smartphone) connects to the web server and during transfers to and from it. Your computer stores data, and the web server also needs to store data for a time to ensure proper operation.
A picture says more than a thousand words, so the following graphic illustrates the interaction between the browser, the internet and the hosting provider.
Why do we process personal data?
The purposes of processing are:
- Professional website hosting and secure operation
- Maintaining operational and IT security
- Anonymous evaluation of access behaviour to improve our offering and, where necessary, for law enforcement or pursuing claims
What data is processed?
Even while you are visiting our website now, our web server — the computer where this page is stored — generally records data automatically, such as:
- the full internet address (URL) of the page visited
- the browser and browser version (e.g. Chrome 87)
- the operating system (e.g. Windows 10)
- the address (URL) of the previously visited page (referrer URL), e.g. https://www.beispielquellsite.de/vondabinichgekommen/
- the hostname and IP address of the accessing device (e.g. COMPUTERNAME and 194.23.43.121)
- the date and time
- in files known as web server log files
How long is data stored?
The data listed above is generally stored for two weeks and then deleted automatically. We do not share this data, but cannot rule out access by authorities if unlawful conduct occurs.
In brief: Your visit is logged by our provider (the company running our website on specialised computers called servers), but we do not share your data without consent!
Legal basis
The legal basis for processing personal data in web hosting is Article 6(1)(f) GDPR (safeguarding legitimate interests). Professional hosting is necessary to present the company online securely and accessibly and, where necessary, to investigate attacks and pursue related claims.
We generally have a data processing agreement with the hosting provider under Article 28 et seq. GDPR, ensuring compliance with data protection requirements and data security.
1&1 IONOS web hosting privacy policy
We use the web hosting services of IONOS by 1&1 to host our website. In Germany, 1&1 IONOS SE is based at Elgendorfer Str. 57, 56410 Montabaur. In Austria, its address is Gumpendorfer Straße 142/PF 266, 1060 Vienna.
What is 1&1 IONOS web hosting?
IONOS offers services covering domains, websites and shops, hosting and WordPress, marketing, email and office, IONOS Cloud, and servers. With over 22 million domains, almost 9 million customer contracts and 100,000 servers, IONOS is one of Germany’s largest web hosting providers.
As mentioned in our introduction to web hosting, hosting also stores data about you or your device on IONOS servers. Above all, this includes your IP address, which is personal data. Technical data is also stored, such as our page URL, your browser’s name and your operating system.
Why do we use 1&1 IONOS web hosting?
IONOS was founded in Germany in 1988 and has over 30 years of experience. This does not mean it has stopped developing technologically. We see this combination of experience and innovation as a good basis for our website. We want our website to run smoothly around the clock while providing a high level of security. Since IONOS does not limit monthly traffic and provides ample storage, our website remains efficient even with many visitors. We are very satisfied with its speed, and the value for money currently meets our requirements.
Further information about data protection at IONOS is available in its privacy policy at https://www.ionos.de/terms-gtc/datenschutzerklaerung/. If you have further questions, you can also contact the IONOS data protection team at datenschutz@ionos.de.
IONOS data processing agreement (DPA)
We have concluded a data processing agreement (DPA) with IONOS under Article 28 GDPR. Our general section “Data processing agreement (DPA)” explains what a DPA is and what it must contain.
This agreement is legally required because IONOS processes personal data on our behalf. It specifies that IONOS may only process data received from us according to our instructions and must comply with the GDPR. The data processing agreement is available at https://www.ionos.de/hilfe/datenschutz/allgemeine-informationen-zur-datenschutz-grundverordnung-dsgvo/auftragsverarbeitung/.
Introduction to website builders
| Website builder privacy summary 👥 Data subjects: Website visitors 🤝 Purpose: Optimising our service 📓 Data processed: Technical usage information such as browser activity, clickstream activity, session heatmaps, and contact details, IP address or geographic location. Further details are provided below and in the providers’ privacy policies. 📅 Retention period: Depends on the provider ⚖️ Legal bases: Article 6(1)(f) GDPR (legitimate interests), Article 6(1)(a) GDPR (consent) |
What are website builders?
We use a website builder for our website. Website builders are special forms of content management systems (CMS). They enable website operators to create websites easily without programming knowledge. Web hosts often provide them too. Using a website builder may result in your personal data being collected, stored and processed. This section provides general information about processing through website builders. More detailed information is available in the provider’s privacy policy.
Why do we use a website builder?
The greatest advantage of a website builder is ease of use. We want to offer a clear, simple and well-organised website that we can operate and maintain ourselves without external support. Website builders now offer many helpful functions that we can use without programming knowledge. This allows us to design our online presence as we wish and offer you an informative, pleasant visit.
What data does a website builder store?
The exact data stored depends on the website builder. Each provider collects and processes different visitor data. Technical usage information is generally collected, such as operating system, browser, screen resolution, language and keyboard settings, hosting provider and visit date. Tracking data, such as browser activity, clickstreams and session heatmaps, may also be processed. Personal data may also be recorded and stored, usually contact details such as email address and telephone number (if provided), IP address and geographic location. The provider’s privacy policy specifies the exact data stored.
How long and where is data stored?
Where further information is available, we explain the duration of processing below in relation to the website builder used. Detailed information is available in the provider’s privacy policy. In general, we only process personal data for as long as strictly necessary to provide our services and products. The provider may store data according to its own rules, over which we have no control.
Right to object
You always have the right to access, rectify and erase your personal data. You can also contact the controller responsible for the website builder at any time with questions. Contact details are in our privacy policy or on the provider’s website.
You can delete, disable or manage cookies used by providers in your browser. The procedure differs by browser. Please note that some functions may then no longer work as usual.
Legal basis
We have a legitimate interest in using a website builder to optimise our online service and present it efficiently and attractively. The corresponding legal basis is Article 6(1)(f) GDPR (legitimate interests). Nevertheless, we only use the builder insofar as you have given consent.
Where processing is not strictly necessary to operate the website, data is processed only with your consent. This applies particularly to tracking. The legal basis is Article 6(1)(a) GDPR.
This privacy policy has provided the most important general information about processing. Further details, where available, are in the following section or in the provider’s privacy policy.
WordPress.com privacy policy
We use the well-known content management system WordPress.com for our website. The service provider is the US company Automattic Inc., 60 29th Street #343, San Francisco, CA 94110, USA.
What is WordPress?
The company began in 2003 and quickly became one of the world’s best-known content management systems (CMS). A CMS is software that helps us design our website and present content attractively and clearly. Content may include text, audio and video.
Using WordPress may result in your personal data being collected, stored and processed. Usually, technical data such as operating system, browser, screen resolution and hosting provider is stored. Personal data such as IP address, geographic data and contact details may also be processed.
Why do we use WordPress?
Programming is not one of our core skills. Nevertheless, we want a capable and attractive website that we can manage and maintain ourselves. A website builder or content management system such as WordPress makes this possible. We do not have to be expert programmers to offer you a good-looking website. WordPress allows us to operate our website quickly and easily without technical knowledge. If technical problems arise or we have special requirements, we can still rely on specialists familiar with HTML, PHP, CSS and similar technologies.
How secure is data transfer with WordPress?
WordPress processes your data in the USA, among other places. WordPress is an active participant in the EU–US Data Privacy Framework, which regulates proper and secure transfers of EU citizens’ personal data to the USA. Further information is available at https://commission.europa.eu/document/fa09cbad-dd7d-4684-ae60-be03fcb0fddf_en.
WordPress also uses standard contractual clauses (Article 46(2) and (3) GDPR). Standard Contractual Clauses (SCCs) are templates provided by the European Commission, intended to ensure your data continues to meet European data protection standards when transferred to and stored in third countries, such as the USA. Through the EU–US Data Privacy Framework and SCCs, WordPress undertakes to maintain European levels of protection when processing relevant data, even where the data is stored, processed and managed in the USA. These clauses are based on a European Commission implementing decision. The decision and clauses are available, among other places, at https://eur-lex.europa.eu/eli/dec_impl/2021/914/oj?locale=de.
The Data Processing Agreements corresponding to the standard contractual clauses are available at https://wordpress.com/support/data-processing-agreements/.
More information about data processed through WordPress.com is available in the privacy policy at https://automattic.com/de/privacy/.
WordPress.com data processing agreement (DPA)
We have concluded a data processing agreement (DPA) with WordPress.com under Article 28 GDPR. Our general section “Data processing agreement (DPA)” explains what a DPA is and what it must contain.
This agreement is legally required because WordPress.com processes personal data on our behalf. It specifies that WordPress.com may only process data received from us according to our instructions and must comply with the GDPR. The data processing agreement is available at https://wordpress.com/support/data-processing-agreements/.
Introduction to web analytics
| Web analytics privacy summary 👥 Data subjects: Website visitors 🤝 Purpose: Analysing visitor information to optimise the website 📓 Data processed: Access statistics containing data such as access locations, device data, visit duration and time, navigation behaviour, click behaviour and IP addresses. Further details are available from the web analytics tool concerned. 📅 Retention period: Depends on the web analytics tool ⚖️ Legal bases: Article 6(1)(a) GDPR (consent), Article 6(1)(f) GDPR (legitimate interests) |
What is web analytics?
We use software to analyse website visitor behaviour, known as web analytics. Data is collected, stored, managed and processed by the analytics provider (also called a tracking tool). It is used to analyse behaviour on our website and the results are made available to us as operators. Most tools also offer testing options. For example, we can test which offers or content visitors prefer by showing two different offers for a limited period. After this A/B test, we know which product or content visitors find more interesting. User profiles may be created and data stored in cookies for these tests and other analytics processes.
Why do we use web analytics?
Our website has a clear goal: to provide the best online offering in our sector. To achieve this, we want to offer interesting content and ensure you feel comfortable on our website. Analytics tools help us examine visitor behaviour and improve our online offering for you and us. For example, we can see visitors’ average age, where they come from, when our website is visited most, and which content or products are especially popular. This information helps optimise the website and adapt it to your needs, interests and preferences.
What data is processed?
The exact data stored depends on the analytics tools used. Usually, it includes which content you view, which buttons or links you click, when you visit a page, your browser, the device used (PC, tablet, smartphone, etc.) and your operating system. If you have agreed to location data being collected, the analytics provider may process that too.
Your IP address is also stored. IP addresses are personal data under the GDPR. However, your IP address is generally stored in pseudonymised form, meaning it is obscured and shortened. Direct data such as your name, age, address or email address is generally not stored for testing, analytics or optimisation. If such data is collected, it is stored in pseudonymised form so you cannot be identified as a person.
The following example illustrates how Google Analytics works as an example of client-side web tracking using JavaScript code.
How long each type of data is stored always depends on the provider. Some cookies store data for only a few minutes or until you leave the website; others may store it for several years.
Duration of processing
Where further information is available, we explain the duration of processing below. In general, we only process personal data for as long as strictly necessary to provide our services and products. A longer retention period may apply where legally required, for example for accounting.
Right to object
You may withdraw your consent to cookies or third-party providers at any time, through our cookie management tool or other opt-out functions. You can also prevent cookie-based collection by managing, disabling or deleting cookies in your browser.
Legal basis
Web analytics requires your consent, obtained through our cookie pop-up. Under Article 6(1)(a) GDPR (consent), this is the legal basis for processing personal data collected through analytics tools.
In addition to consent, we have a legitimate interest in analysing visitor behaviour to improve our offering technically and economically. Analytics helps identify website errors, detect attacks and improve economic efficiency. The legal basis is Article 6(1)(f) GDPR (legitimate interests). Nevertheless, we only use these tools insofar as you have given consent.
Because analytics tools use cookies, we recommend reading our general cookie privacy section. To learn exactly which data about you is stored and processed, read the privacy policies of the relevant tools.
Information on specific web analytics tools, where available, is provided in the following sections.
Closing remarks
Congratulations! If you are reading this, you have made your way through our entire privacy policy, or at least scrolled this far. As its length shows, we do not take the protection of your personal data lightly.
We want to inform you about processing to the best of our knowledge and belief. We also want to explain the reasons for using various software programs. Privacy policies are usually very technical and legalistic. As most of you are not web developers or lawyers, we wanted to explain things in simple, clear language. The subject does not always make that possible, so the most important terms are explained in more detail at the end of this policy.
If you have questions about privacy on our website, please contact us or the controller. We hope you enjoy your visit and look forward to welcoming you back.
All texts are protected by copyright.
Source: Created using the Privacy Policy Generator by AdSimple