Privacy policy

1. Controller

The controller within the meaning of the GDPR is Exaptation GmbH, Osterbrooksweg 35–41, 22869 Schenefeld, Germany, represented by its Managing Director Lasse Alexandros Diercks. Contact: legalexap.product172@passmail.net.

2. Data protection officer

A data protection officer is not required by § 38 BDSG. Please send data protection requests to the email address above.

3. Data collected when you visit the site

When you access Scentral-Park our servers automatically process technical data your browser transmits: IP address, date and time of the request, requested URL, HTTP status code, transmitted volume, referrer URL and user agent. We use this data solely to keep the site running, to troubleshoot issues and to defend against attacks. Legal basis: Art. 6(1)(f) GDPR (legitimate interest in a secure, functioning service). Retention: up to 14 days. A node-level DaemonSet sets MaxRetentionSec=14d in systemd-journald; older entries are automatically rotated out.

4. Cookies and traffic measurement

Scentral-Park sets exactly one strictly necessary cookie (country) that remembers your country selection in the shipping-country filter. It is essential to the feature you actively use and is deleted automatically after 365 days. Legal basis: § 25(2) no. 2 TDDDG (strictly necessary for a telemedia service the user has explicitly requested). We set no tracking cookies and embed no third-party analytics services.

For traffic measurement we run our own server-side, pseudonymized statistics: when a page is requested, our servers store the page path, the country from your filter selection, the truncated referrer (scheme and host only), a coarse browser family (e.g. "Chrome"), and a hash of your IP address (SHA-256 with a random value that changes daily). The raw IP is never stored; the daily key rotation makes cross-day re-identification impossible. Raw data is deleted after 14 days and kept only as aggregated daily counts (views, unique visitors per day). No third parties are involved; the data never leaves our servers. Legal basis: Art. 6(1)(f) GDPR (legitimate interest in measuring and improving our own service). You may object at any time under Art. 21 GDPR (see section 6).

5. Processors and recipients

We rely on the following service providers to operate the site:

• Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany — hosting for the virtual machine. Servers located in Germany. Data processing agreement per Art. 28 GDPR in place.
• Internet Security Research Group (Let's Encrypt), USA — issuance of TLS certificates for encrypted transport. Only domain names are transmitted; no user data. Legal basis Art. 6(1)(f) GDPR; transfer to a third country covered by EU Standard Contractual Clauses.
• BunnyWay d.o.o. (Bunny Fonts), Slovenia — delivery of the web fonts used on the site. Your IP address is transmitted to Bunny's servers when fonts are loaded. Bunny Fonts is explicitly operated GDPR-compliant without tracking cookies. Legal basis Art. 6(1)(f) GDPR.
• Image CDNs of the listed suppliers — Scentral-Park is a catalogue: the product images shown are loaded directly from each supplier's CDN, including cdn.shopify.com (Shopify Inc., Canada, and Shopify International Ltd, Ireland — DPF-certified), cdn11.bigcommerce.com (BigCommerce Inc., USA — DPF-certified) and other supplier-specific hosts, some of which are fronted by Cloudflare Inc. (USA — DPF-certified). Your browser transmits your IP address and user-agent to the respective CDN operator; the sole purpose is to display the product image in the catalogue. Legal basis: Art. 6(1)(f) GDPR (legitimate interest in a workable visual catalogue that does not require running a server-side image proxy). Third-country transfer is covered by the EU-US Data Privacy Framework and supplementary EU Standard Contractual Clauses. An objection under Art. 21 GDPR is possible (see section 6).

We do not sell your data or share it for advertising purposes.

6. Your rights

Under the GDPR you have the right to:

• access the personal data we store about you (Art. 15 GDPR)
• rectify inaccurate data (Art. 16 GDPR)
• erasure (Art. 17 GDPR)
• restriction of processing (Art. 18 GDPR)
• data portability (Art. 20 GDPR)
• lodge a complaint with a supervisory authority — for us the competent authority is the Independent State Centre for Data Protection Schleswig-Holstein (ULD), Holstenstraße 98, 24103 Kiel, Germany, datenschutzzentrum.de

We answer requests within the statutory one-month period (Art. 12(3) GDPR).

Right to object under Art. 21 GDPR. You have the right, on grounds relating to your particular situation, to object at any time to processing based on Art. 6(1)(f) GDPR. This concerns in particular the delivery via image CDNs (section 5) and the server-side access logs (section 3). An informal e-mail to the address given in the imprint suffices; you may also technically prevent transmission to image CDNs by disabling image loading for scentral-park.com in your browser.

7. Changes to this policy

We update this policy when data processing changes. The current version is dated at the top.