Privacy Policy

We are pleased that you are visiting our website and are interested in our company, Space Plus Store GmbH. The protection of personal data (data privacy) is of great importance to us. We comply with all applicable data protection laws and strive to continuously improve data protection.

1. Who is responsible for data processing on this website?

Space Plus Store GmbH is the responsible entity for processing personal data on this website in accordance with the European General Data Protection Regulation (GDPR) and the German Federal Data Protection Act ("BDSG").

Space Plus Store GmbH (hereinafter referred to as "Space Plus" or "we")
An der Gümpgesbrücke 9
D-41564 Kaarst
Email: privacy@myspaceplus.de

2. How can the data protection officer be contacted?

Either by mail to the address below with the addition "Data Protection Officer Space Plus Store GmbH" or via the provided email address.

Stefan Kleinermann
Kleinermann & Sohn GmbH
Max-Planck-Str. 9 52499 Baesweiler
(HRB 6667 Aachen)
Data Protection Officer Space Plus Store GmbH
Telefon: +49 (0) 2401 6054-0
E-Mail: sk@das-datenschutz-team.de

3. For what purpose do we process data on this website and on what legal basis? Who receives the data?

Space Plus collects and uses personal data to provide the website as well as our content and services in accordance with Article 6(1) a to f of the GDPR, meaning as permitted by the GDPR or another legal provision, or if the user has given consent to the processing.

To fulfill the purposes outlined in this section, personal data may be disclosed to the following recipients:

Subsidiaries or affiliated companies of Space Plus
Authorities, courts, or other public entities in and outside of Germany, where necessary
Other IT service providers and data processors strictly for specific purposes, such as hosting, cloud services, and public relations (e.g., sending newsletters and customer information)

All service providers acting as processors under Article 28 of the EU GDPR have legally regulated data protection contracts with us.

Personal data is only transferred to countries outside the European Economic Area (EEA) under the condition of an adequate level of data protection as per Articles 44 ff. of the GDPR.

For external service providers of Space Plus (including cloud service providers) outside the EU/EEA, the required adequate level of data protection is ensured by complying with Articles 45 ff. of the EU GDPR—typically through EU standard contractual clauses under Article 46(2)(c) of the EU GDPR.

Specifically, Space Plus processes personal data when visiting this website as follows:

A Log files

With every visit to our website, so-called log files are automatically stored based on our legitimate interest pursuant to Article 6(1)(f) of the EU GDPR. These log files contain data about the device accessing our website, such as browser type, operating system, internet service provider, IP address, date, and time of access.

Storing this data is necessary to make our website available for the duration of the session. We also use this data to optimize our website and ensure the security of our IT systems.

Your data in our server log files is typically deleted automatically 30 days after visiting our website.

B Call-back service

You can use our call-back service on our website.

The required fields for using the call-back service are marked in the input form. These fields must be completed, as we otherwise cannot return your call. Any additional information is voluntary and helps us better respond to your request.

If your use of the call-back service is related to concluding a contract, we process your data under Article 6(1)(b) of the GDPR. If your request is of a general nature, we process your data under Article 6(1)(f) of the GDPR based on our legitimate interest in answering inquiries about our company and services individually and in the best possible way.

If you have an existing customer account with us, we store information related to the call-back service in your account for one year. Data concerning all other inquiries is deleted after one month.

C Contacting us

Our website offers various ways to contact us. When using our contact form, mandatory fields are marked as such. These fields must be completed to process your request. Any additional information is voluntary and helps us better respond to your inquiry. You may also contact us by phone, email, mail, or fax. The personal data processed in this context may vary depending on the communication channel but generally includes your first and last name, address, phone number, and email address.

If your inquiry is related to concluding a contract, we process your data under Article 6(1)(b) of the GDPR. If your inquiry is of a general nature, we process your data under Article 6(1)(f) of the GDPR based on our legitimate interest in answering inquiries about our company and services individually and in the best possible way.

If your data is related to a contractual relationship, we may retain it until the expiration of statutory retention periods, which can be up to six years. These periods generally begin at the end of the year in which you contacted us. All other data is deleted once your inquiry has been conclusively resolved and no legal obligation requires its retention.

D Cookies

Space Plus uses so-called cookies for the purposes listed below. A cookie is a text file sent from the web server to the browser that processes information about the website visitor (e.g., IP address), their settings, and the devices used.

The table below lists the different types of cookies we use on our site:

Essential cookies

These cookies are indispensable to ensure that users can navigate and use certain functions of the website. Without them, essential parts of the website cannot be used. Accordingly, these cookies are always enabled. They are only used when you visit our website and are generally deleted after you close your browser. They are also used to retrieve the optimized website display when accessing it from a mobile device to prevent unnecessary data usage. Additionally, these cookies facilitate switching from HTTP to HTTPS to ensure the security of transmitted data.

Functional cookies

Functional cookies allow the website to store user-entered information, such as username or language selection, and provide improved and personalized functions based on that data. The collected information is only evaluated in aggregated form.

Since we aim to offer a website optimized for user-friendliness, we recommend enabling these cookies. Functional cookies are also used to activate requested features, such as video playback.

Performance cookies

These cookies collect data about user behavior. Based on this data, the website's content and functionality are adjusted to align with general usage patterns. The collected information is generally processed in aggregated form unless a user has explicitly consented to a personalized analysis. Performance cookies are used exclusively to improve the website’s performance and tailor the online experience to user needs.

Marketing cookies

Marketing cookies are used to deliver content that is more relevant to the user and tailored to their interests. They are also used to measure and manage campaign effectiveness. These cookies track whether a user has visited a website and which content was accessed. Based on this information, an interest profile is created so that only relevant content is displayed.

Revoking consent for marketing cookies does not mean you will see fewer ads; rather, the ads you see will not be personalized to your interests.

Social media cookies

Social media cookies are used to provide users with content that aligns with their interests. They also help measure and manage campaign effectiveness. These cookies track whether a user has visited a website and which content was accessed. Using this data, an interest profile is created so that only relevant content is displayed.

Revoking consent for social media cookies does not mean you will receive fewer ads, but rather that they will not be personalized to you. Space Plus may use this data to display targeted ads outside its website without identifying you as a website visitor.

The legal basis for data processing through cookies can either be a legitimate interest of Space Plus or user consent.

A legitimate interest for Space Plus to use cookies under Art. 6(1)(f) GDPR & § 25(2) TDDDG exists particularly for essential cookies (see above). No consent is required for these.

For all other types of cookies (e.g., marketing and social media cookies), consent is required (Art. 6(1)(a) GDPR in conjunction with § 25(1) TDDDG), which can be provided via the cookie banner displayed on our websites.

Note: If you consent, cookies are activated immediately or when the webpage is reloaded. If you withdraw your consent, previously set cookies will remain active until they expire. To ensure these cookies are blocked immediately, you must manually delete them in your browser settings.

a) Tracking and analytics tools

Space Plus uses third-party tracking and analytics tools on these websites. These tools use so-called performance cookies, which can be adjusted via the settings explained below for each provider or in the Space Plus cookie settings. The settings can be customized on each page based on the domain.

We use the following tracking and analytics tools on the basis of your consent pursuant to Art. 6(1)(a) GDPR in conjunction with § 25(1) TDDDG. You can withdraw your consent at any time with effect for the future.

(1) Google Analytics

Space Plus uses Google Analytics on its websites, a web analytics service provided by Google Ireland Limited, Gordon House, 4 Barrow St, Dublin, D04 E5W5, Ireland (“Google Ireland”).

Google Analytics uses so-called “cookies,” text files stored in the browser that enable an analysis of how the website is used. The information generated by the cookie about the use of this website is usually transmitted to a Google server in the USA and stored there. If IP anonymization is activated on this website, the user's IP address will be shortened by Google within member states of the European Union or other contracting states of the Agreement on the European Economic Area before transmission. Only in exceptional cases will the full IP address be transmitted to a Google server in the USA and shortened there. On behalf of the operator of this website, Google will use this information to evaluate the use of these websites, compile reports on website activity, and provide other services related to website and internet usage to the website operator.

The IP address transmitted by the browser as part of Google Analytics will not be merged with other Google data.

We also point out that Google Analytics has been extended with the code “anonymizeIp” on this website to ensure an anonymized collection of IP addresses (so-called IP masking).

As part of Google Analytics, we also use the Google Signals extension, which enables cross-device tracking. Google uses data from users who are simultaneously logged into a Google service when visiting websites and have activated the "personalized advertising" option in their Google account settings (https://adssettings.google.com/authenticated). Google Signals is only used with activated IP anonymization.

More information about Google's terms of use and privacy policies can be found at http://www.google.com/analytics/terms/de.html and https://www.google.de/intl/de/policies/.

The use of Google Analytics is based on your consent pursuant to Art. 6(1)(a) GDPR in conjunction with § 25(1) TDDDG.

(2) Google Ads Conversion

We use Google Ads Conversion Tracking on our website, a service provided by Google Ireland Limited, Gordon House, 4 Barrow St, Dublin, D04 E5W5, Ireland (“Google Ireland”).

With Google Ads Conversion, Google Ireland and we can determine whether specific actions have been performed. For example, we can analyze which fields on our website were clicked on most frequently and which products were viewed or purchased most often. This information is used to create conversion statistics. This allows us to determine the total number of users who clicked on our ads and what actions they took. If you are registered with a Google Ireland service, Google Ireland may associate your visit with your account. Even if you are not registered with Google Ireland or logged in, Google Ireland may collect and store your IP address.

The use of Google Ads Conversion is based on your consent provided to us in accordance with Art. 6(1)(a) GDPR.

Google Ireland receives the data as an independent data controller, not as a service provider.

The information collected through Google Ads Conversion is deleted after 9 or 18 months (https://policies.google.com/technologies/ads).

The use of Google Ads Conversion results in the transfer of your data to the USA. The European Commission has issued an adequacy decision for data transfers to the USA. The data transfer is based, among other things, on standard contractual clauses as suitable safeguards for the protection of personal data, which we have agreed upon with Google Ireland in a data processing contract, available at: https://privacy.google.com/businesses/controllerterms/.

You can prevent the transmission of data to Google Ireland by downloading and installing the browser plugin available at the following link: https://support.google.com/ads/answer/7395996.

(3) Use of HubSpot

Space Plus uses HubSpot, a service provided by HubSpot Inc., for analysis purposes on its websites.

This involves the use of so-called "web beacons" and "cookies," which are stored on your computer and enable us to analyze your use of the website. The information collected (e.g., IP address, geographic location, browser type, duration of visit, and visited pages) is analyzed by HubSpot on behalf of Space Plus to generate reports about visits and visited pages on Space Plus's website.

If you do not wish to be tracked by HubSpot, you can prevent cookies from being stored at any time by adjusting your browser settings accordingly (see above under section 3 D). More information about HubSpot’s functionality can be found in HubSpot Inc.'s privacy policy at: http://legal.hubspot.com/de/privacy-policy.

(4) Use of MS Clarity

We use the MS Clarity tool for analysis purposes on our website. The service provider for Microsoft Clarity is Microsoft Ireland Operations Limited.

We process data to generate usage statistics. The purpose of processing is to anonymize data, create statistics, and analyze user behavior. The legal basis for processing is your consent in accordance with Art. 6(1)(a) GDPR.

The data is transmitted to Microsoft Ireland Operations Ltd., One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, Ireland, as the independent data controller.

This may also involve the transfer of personal data to a country outside the European Union. The transfer of data to the USA is based on Art. 45 GDPR in conjunction with the adequacy decision C(2023) 4745 of the European Commission, as the data recipient has committed to complying with the data processing principles of the Data Privacy Framework (DPF).

For contact with the data protection officer of Microsoft Ireland Operations Ltd., visit: https://www.microsoft.com/de-at/concern/privacy.

The privacy policy of Microsoft Ireland Operations Ltd. can be found at: https://privacy.microsoft.com/de-de/privacystatement.

b) Marketing Tools

(1) Google Ads

We use Google Ads from Google Ireland Limited, Gordon House, 4 Barrow St, Dublin, D04 E5W5, Ireland ("Google Ireland") on our website.

Google Ads allows us to display advertisements in the Google search engine or on third-party websites when a user enters certain search terms in Google (Keyword Targeting). Additionally, targeted advertisements can be displayed based on user data available at Google Ireland (e.g., interests) (Audience Targeting). We can quantitatively analyze this data, for example, by examining how many ads led to clicks and which search terms triggered our ads.

The use of Google Ads is based on your consent given to us under Article 6(1)(a) GDPR.

Google Ireland receives the data as a separate controller and not as a processor. The information collected through Google Ads is deleted after 9 or 18 months (https://policies.google.com/technologies/ads).

Using Google Ads results in data transfer to the USA. An adequacy decision by the European Commission is in place for data transfers to the USA. The data transfer is based, among other things, on standard contractual clauses as appropriate safeguards for the protection of personal data, which we have agreed upon with Google Ireland in a data processing agreement available at: https://privacy.google.com/businesses/controllerterms/.

Further information and privacy policies can be found in Google Ireland's privacy policy at: https://policies.google.com/technologies/ads.

You can prevent data transmission to Google Ireland by downloading and installing the browser plugin available at the following link: https://support.google.com/ads/answer/7395996

(2) Google Ads Remarketing

We use Google Ads Remarketing from Google Ireland Limited, Gordon House, 4 Barrow St, Dublin, D04 E5W5, Ireland ("Google Ireland") on our website.

Google Ads Remarketing analyzes your user behavior on our website (e.g., clicking on specific products/ads) to assign you to specific advertising audiences. With the remarketing feature, we can present advertisements based on your interests to users of our website on other websites within the Google network.

Moreover, Google Ads Remarketing allows linking created advertising audiences with Google's cross-device functions. This means that interest-based and personalized ads, tailored to your previous usage and browsing behavior on one of your devices, can also be displayed on another device.

The use of Google Ads Remarketing is based on your consent given to us under Article 6(1)(a) GDPR.

Google Ireland receives the data as a separate controller and not as a processor.

The information collected through Google Ads is deleted after 9 or 18 months (https://policies.google.com/technologies/ads).

Using Google Ads Remarketing results in data transfer to the USA. An adequacy decision by the European Commission is in place for data transfers to the USA. The data transfer is based, among other things, on standard contractual clauses as appropriate safeguards for the protection of personal data, which we have agreed upon with Google Ireland in a data processing agreement available at: https://privacy.google.com/businesses/controllerterms/.

You can prevent data transmission to Google Ireland by downloading and installing the browser plugin available at the following link: https://support.google.com/ads/answer/7395996. If you have a Google account, you can object to personalized ads via the following link: https://www.google.com/settings/ads/onweb/.

c) Social Media

(1) Facebook Pixel

We use the "Facebook Pixel" from the social network Facebook, Meta Platforms Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland ("Meta") on our website.

With the Facebook Pixel, we can categorize visitors to our website into specific target groups to show relevant ads ("Ads") on Facebook. These pixels capture information about your browsing session, particularly the clicked banners and links, a hashed version of the Facebook ID, and the URL being viewed. If you have a Facebook account and are logged in, the visit to this website will be associated with your Facebook user account. More information on Facebook Pixel and its functionality can be found in Facebook's help section: https://www.facebook.com/business/help/651294705016616.

The use of Facebook Pixel is based on your consent given to us under Article 6(1)(a) GDPR.

We are jointly responsible with Meta for the use of Facebook Pixel. You can view the joint responsibility agreement under Article 26 GDPR at the following link: https://de-de.facebook.com/legal/terms/page_controller_addendum.

Using Facebook Pixel results in data transfer to the USA. An adequacy decision by the European Commission is in place for data transfers to the USA. The data transfer is based, among other things, on standard contractual clauses as appropriate safeguards for the protection of personal data, viewable at: https://www.facebook.com/legal/eu_data_transfer_addendum. In addition to the standard contractual clauses, Facebook has implemented the following technical and organizational measures to protect your data: https://www.facebook.com/legal/terms/data_security_terms.

For any further unilateral processing of your data by Meta, particularly regarding the potential transfer of your data to the USA, Meta is solely responsible. Meta uses cookies and other technologies to collect data from you. You can find out for what purposes and on what legal basis these processes take place in the Facebook Data Policy (https://www.facebook.com/policy.php). Please note that Meta may collect and process data about you when visiting the website www.facebook.com/ even if you do not have a Facebook account or are not logged in. We do not know what data Meta collects from you or for what purposes it is processed.

(2) Facebook Custom Audience (Remarketing)

We use the remarketing feature "Custom Audience" from Meta Platforms Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland ("Meta").

With the help of Facebook Pixel, Facebook can determine the users of a website as the target audience for displaying ads for that website on Facebook (Custom Audience).

With Custom Audience, we ensure that only customers who have visited our website or shown interest in our products will see advertisements on Facebook. The data we use for Custom Audience comes from the Facebook Pixel we set up, as described above. The data we use for Custom Audience has been collected directly from you and provided to Facebook for your targeted advertising. Even if you are not registered with Facebook or logged in, it is possible for the provider to obtain and store your IP address and other identifiers.

The use of Custom Audience is based on your consent given to us under Article 6(1)(a) GDPR.

Individuals remain in a Custom Audience for a maximum of 180 days after the last interaction https://de-de.facebook.com/business/help/419552341510847. We are jointly responsible with Meta for the Facebook "Custom Audience" feature. The joint responsibility agreement under Article 26 GDPR can be viewed at the following link: https://de-de.facebook.com/legal/terms/page_controller_addendum.

Using Facebook Custom Audience results in data transfer to the USA. An adequacy decision by the European Commission is in place for data transfers to the USA. The data transfer is based, among other things, on standard contractual clauses as appropriate safeguards for the protection of personal data, viewable at: https://www.facebook.com/legal/eu_data_transfer_addendum. In addition to the standard contractual clauses, Facebook has implemented the following technical and organizational measures to protect your data: https://www.facebook.com/legal/terms/data_security_terms.

You can deactivate the "Facebook Custom Audience" feature for logged-in users at https://www.facebook.com/settings/?tab=ads#.

(3) YouTube Embedding

We use an iframe from YouTube, LLC, 901 Cherry Ave., San Bruno, CA 94066, USA. YouTube, LLC is a subsidiary of Google Inc., 1600 Amphitheatre Pkwy, Mountain View, CA 94043-1351, USA ("Google").

We have embedded the YouTube iframe on our website to allow you to play selected videos hosted on YouTube. Your IP address is also transferred to YouTube. Each time a subpage of our website containing a YouTube iframe is accessed, YouTube can track that you visited that page. If you are logged into YouTube at the same time, the collected information will be associated with your Google account. You can prevent this only by logging out of YouTube.

The use of YouTube is based on your consent given to us under Article 6(1)(a) GDPR.

Using the YouTube iframe results in data transfer to the USA. An adequacy decision by the European Commission is in place for data transfers to the USA. The data transfer is therefore based on your consent given under Article 49(1)(a) GDPR.

We use the "Enable Enhanced Privacy Mode" setting so that no cookies are set by Google for analyzing user behavior when embedding videos.

E Social Media Profiles

(1) Facebook

We maintain a so-called fan page at www.facebook.com.

When visiting our fan page, various data is collected and processed. For some of the data processing activities occurring on www.facebook.com, we share joint responsibility with Meta Platforms Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland ("Meta") under data protection laws, while we or Meta are solely responsible for other data processing activities.

If you contact us on Facebook, we process your name and any other information you provide directly or through the comment function. We are solely responsible for the processing of this data. The processing of this data is based on Art. 6(1)(f) GDPR and serves our legitimate interests in a reasonable and interactive company presentation.

We are jointly responsible with Meta for the "Page Insights" feature on Facebook, which provides us with aggregated and anonymized statistical evaluations of your usage and interaction with our fan page. You can view the agreement on joint responsibility under Art. 26 GDPR here: https://de-de.facebook.com/legal/terms/page_controller_addendum

For any further unilateral processing of your data by Meta, especially regarding the potential transfer of your data to the USA, Meta is solely responsible. Meta uses cookies and other technologies to collect data from you. You can find out the purposes and legal basis for this processing in Facebook's data policy (https://www.facebook.com/policy.php). Please note that Meta can also collect and process data about you when you visit www.facebook.com, even if you do not have a Facebook account or are not logged in. We do not know what data Meta collects from you or for what purposes it processes it.

(2) Instagram

We maintain an Instagram account at www.instagram.com.

In general, the processing of your data when visiting www.instagram.com is the responsibility of Meta Platforms Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland ("Meta"). Meta uses cookies and other technologies to collect data from you. You can learn more about the purposes and legal basis for this processing in Instagram's privacy policy (https://help.instagram.com/519522125107875) and Instagram's cookie usage information. Please note that Meta can also collect and process data about you when you visit www.instagram.com, even if you do not have an Instagram account or are not logged in. We do not know what data Meta collects from you or for what purposes it processes it.

However, we process data you provide to us via Instagram that is publicly available. The processing of this data is based on Art. 6(1)(f) GDPR and serves our legitimate interests in a reasonable and interactive company presentation.

Meta provides us with the "Instagram Insights" feature, allowing us to measure and analyze the interactions of visitors to our Instagram channel. We only have access to aggregated and anonymized data that does not allow any conclusions about individual users.

(3) LinkedIn

We maintain a profile at www.linkedin.com.

When visiting our profile, various data is collected and processed. For some of the data processing activities occurring on www.linkedin.com, we share joint responsibility with LinkedIn Ireland Unlimited Company, Wilton Place, Dublin 2, Ireland ("LinkedIn Ireland") under data protection laws, while we or LinkedIn Ireland are solely responsible for other data processing activities.

If you contact us on LinkedIn, we process your name and any other information you provide. We are solely responsible for processing this data. The processing of this data is based on Art. 6(1)(f) GDPR and serves our legitimate interests in a reasonable and interactive company presentation.

We are jointly responsible with LinkedIn Ireland for the "Page Insights" feature, which provides us with aggregated and anonymized statistical evaluations of your usage and interaction with our profile. You can view the agreement on joint responsibility under Art. 26 GDPR here: https://legal.linkedin.com/pages-joint-controller-addendum

For any further unilateral processing of your data by LinkedIn Ireland, especially regarding the potential transfer of your data to the USA, LinkedIn Ireland is solely responsible. LinkedIn Ireland uses cookies and other technologies to collect data from you. You can learn more about the purposes and legal basis for this processing in LinkedIn's cookie policy (https://de.linkedin.com/legal/cookie-policy?trk=homepage-basic_footer-cookie-policy) and LinkedIn's privacy policy (https://de.linkedin.com/legal/privacy-policy?trk=lithograph_footer-privacy-policy).

Please note that LinkedIn Ireland can also collect and process data about you when you visit www.linkedin.com, even if you do not have a LinkedIn account or are not logged in. We do not know what data LinkedIn Ireland collects from you or for what purposes it processes it.

(4) YouTube

We maintain a YouTube channel at https://www.youtube.com/@spaceplusstore2869

When visiting our profile, various data is collected and processed. For some of the data processing activities occurring on YouTube, we share joint responsibility with Google Ireland Limited, based in Gordon House, Barrow Street, Dublin 4, Ireland, for users of Google services residing in the European Economic Area or Switzerland, while we or Google Ireland Limited are solely responsible for other data processing activities.

For more information on data protection when using the channel, please refer to https://policies.google.com/privacy

(5) Enquiries via Facebook and Instagram (Meta Lead Ads)

We use advertisements with integrated contact forms on Facebook and Instagram, known as “Lead Ads”. The platforms are provided by Meta Platforms Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland (“Meta”). If you fill in and submit such a form, we receive the data you have entered. Depending on the form, this may include, for example, your name, your email address, your telephone number and details of your enquiry. We use this data to process your enquiry and to contact you via the contact method you have requested, for example to send you a quote or to provide advice you have asked for. Providing your data is voluntary. However, without the information required to process your enquiry, we will be unable to respond to it, or only to a limited extent.

Transfer to our CRM system HubSpot

The data transmitted to us via the Meta Lead Ads contact forms is automatically transferred to our CRM system HubSpot. There, we store and manage your details in order to process your enquiry and to document the related communication.

HubSpot processes this data on our behalf on the basis of a data processing agreement pursuant to Art. 28 GDPR. Further information on the provider can be found in section 3 D a) (3) of this privacy policy.

In this context, personal data may also be transferred to the USA. HubSpot, Inc. is certified under the EU-U.S. Data Privacy Framework. For transfers covered by this certification, an adequacy decision of the European Commission pursuant to Art. 45 GDPR is in place.

In HubSpot, too, we use your data to process your enquiry. The information in the section “Storage period” applies to its deletion.

Legal basis

Insofar as we require your data to prepare a contract with you at your request or to fulfil an existing contract with you, processing is based on Art. 6 (1) (b) GDPR. For other enquiries, in particular if you are acting as a representative of a company, processing is based on Art. 6 (1) (f) GDPR. Our legitimate interest lies in the proper handling of and response to your enquiry. Any use beyond your specific enquiry for advertising that requires consent, such as promotional emails, will only take place if you have given separate consent for this. In that case, the legal basis is Art. 6 (1) (a) GDPR. You can withdraw your consent at any time with effect for the future using the contact details provided in this privacy policy. The lawfulness of processing carried out before the withdrawal remains unaffected.

Storage period

We delete the data stored by us as soon as your enquiry has been fully processed or is no longer being pursued and the data is no longer required for this purpose. Data will only be stored for longer if there is a separate legal reason for doing so, for example consent to further advertising, statutory retention obligations, or where it is necessary for the establishment, exercise or defence of legal claims. We do not use data that is required solely to comply with retention obligations or for legal proceedings for any further advertising.

Data processing by Meta

The contact form is provided within Facebook or Instagram. Meta also processes personal data in connection with the provision and use of its platforms. We are responsible for the subsequent independent processing of the enquiry transmitted to us. Information on how Meta processes your data, in particular on the purposes of processing, legal bases, storage periods, international data transfers and your setting options, can be found in Meta’s privacy policy at https://www.facebook.com/privacy/policy/. As part of the processing by Meta, personal data may also be transferred to the USA. Meta Platforms, Inc. is certified under the EU-U.S. Data Privacy Framework. For transfers covered by this framework, an adequacy decision of the European Commission is in place.

Your rights and contact options

Information on your data protection rights, in particular your right to object to processing based on legitimate interests, can be found in section 5. Our contact details can be found in section 1, and the contact details of our data protection officer in section 2.

F Communication Channels

(1) Contacting via WhatsApp

You have the option of requesting Space Plus to contact you via WhatsApp. The provider is WhatsApp Ireland Limited, 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland.

If we communicate over WhatsApp we may also receive other personal data stored in your WhatsApp profile (e.g., name, profile picture, messages we exchange, and metadata if applicable).

Your personal data will be processed: in accordance with Art. 6 (1) (b) GDPR, if your inquiry serves to initiate or execute a contract, or on the basis of Art. 6 (1) (a) GDPR, provided you have consented to be contacted.

We only store your data for as long as necessary to process your request or as long as statutory retention periods apply.

Note on data processing outside the EU: WhatsApp is part of the Meta group of companies based in the USA. It cannot be ruled out that personal data will be processed on servers outside the EU.

If you do not want WhatsApp to process your data, please do not choose the WhatsApp contact option and use phone instead.

Further information on data processing by WhatsApp can be found at: https://www.whatsapp.com/legal/privacy-policy-eea

4. How long are data stored?

Unless otherwise specified, Space Plus stores personal data as long as necessary to carry out the purposes outlined above. This is subject to legal retention obligations. Space Plus employees are instructed to regularly review the duration of personal data storage and delete it if necessary.

5. What data protection rights do affected individuals have?

Affected individuals have the right to information under Art. 15 EU GDPR regarding the processing of their personal data by Space Plus (including the purpose of processing, any recipients, and the expected duration of storage), the right to correct inaccurate data (Art. 16 EU GDPR), deletion (Art. 17 EU GDPR), restriction of processing, and data portability (Art. 18, 20 EU GDPR), as well as the right to object to processing for marketing purposes and based on legitimate interests of Space Plus (Art. 21 EU GDPR).

Once given, consents can generally be withdrawn at any time with effect for the future. To exercise these rights, affected individuals can contact the data protection officer of Space Plus or Space Plus directly (see sections 1 and 2). Additionally, there is the right to lodge a complaint with a supervisory authority. Affected individuals can address their complaint to the authority in their place of residence, or in principle, to any other data protection authority.

The responsible supervisory authority for data protection at Space Plus is:

The State Commissioner for Data Protection and
Freedom of Information North Rhine-Westphalia
Kavalleriestr. 2-4
40213 Düsseldorf
Phone 0211/38424-0
Fax 0211/38424-10
Email poststelle@ldi.nrw.de
Website www.ldi.nrw.de