Privacy notice

Last updated: 15 October 2026 (test phase)

Convenience translation. Only the German version is legally binding: Datenschutzerklärung.

This notice provides information on which personal data are processed when this website is used and which rights data subjects have.

1. Controller

Gipfelstürmer Agentur GmbH
Frankfurter Weg 6
33106 Paderborn
Represented by: Timm Westmark
Email: sponsio@gipfelstuermer-agentur.de
Telephone: 05251-6942350

No data protection officer has been appointed. For all questions concerning data protection, you can reach us using the contact details given above. We operate this service ourselves and are responsible for the processing described here. We handle requests concerning your rights and reports of illegal content.

2. Overview

This website is used to create the label and the transparency notice for political advertisements. In the process, information on sponsors, costs, the link to an election and, where applicable, targeting is collected. This information is used to produce a publicly accessible page, a machine-readable version (JSON), a short link with a QR code and ready-made label images for posters and advertisements.

3. Hosting, server log files and security software

The website is hosted with HostPress GmbH, Bahnhofstraße 34, 66571 Eppelborn (hereinafter the hosting provider). The servers are located exclusively in data centres in Germany (for transfers by the security software, see below). For this purpose, HostPress uses Hetzner Online GmbH (Gunzenhausen), Krämer IT Solutions GmbH (Eppelborn) and IP-Projects GmbH & Co KG (Waldbrunn) as sub-processors. A data processing agreement pursuant to Art. 28 GDPR is in place with HostPress.

When the website is accessed, the server automatically records: IP address, date and time, address accessed (URL), volume of data transferred, status code and browser and operating system information. This serves the secure and stable operation of the website. The legal basis is Art. 6(1)(f) GDPR (legitimate interest in secure operation). Depending on the load, the hosting provider retains the web server log files for between one week and a maximum of one month and then deletes them permanently.

To protect against attacks and automated access, the hosting provider uses the software “Imunify360” on the server (fra-1025) (hereinafter the security software), which is intended to detect and repel attacks and also protects this website. The manufacturer is Cloud Linux Software, Inc. (Estero, Florida, USA; the company also operates under the name TuxCare; hereinafter CloudLinux). According to CloudLinux, the software collects information about the visitors to every website located on a server protected by it. This includes the IP address, the address accessed (URI), browser information, the screen resolution and other location and browser metadata. Where applicable, the software also collects parameters of the address accessed, as a rule only in an irreversibly encrypted form (in CloudLinux’s terminology “one-way encryption”, for comparison and analysis). If an attack is detected, it collects the HTTP parameters of the request without this irreversible encryption; according to CloudLinux, however, it nevertheless encrypts these parameters for transmission to CloudLinux. The contract between the hosting provider and CloudLinux lists, among other things, names, addresses, email addresses, telephone numbers, IP addresses, user names and location data as possible data, without definitively specifying the categories of data in detail; neither CloudLinux’s privacy policy nor the contract states whether entries made in forms are also collected when an attack is detected. The legal basis is Art. 6(1)(f) GDPR (legitimate interest in the security of the service).

CloudLinux processes these data as a further processor (sub-processor) of the hosting provider. The company has its registered office in the USA and, according to the contract, currently uses sub-processors in Germany, Finland, Poland and the USA, among other things for servers, databases and data backup, and also uses AI-based services in the USA to support the automatic analysis; the contract permits further sub-processors to be engaged. According to the contract, the processing serves the provision and improvement of the security service; the AI-based processing serves security monitoring and the detection of threats, limited to targeted analyses that are necessary for this purpose. The contract does not state which data reach the AI services in this process. The hosting provider has concluded a data processing agreement with CloudLinux, including the EU standard contractual clauses; in it, CloudLinux undertakes, for any onward transfer to sub-processors outside the EEA, to ensure an appropriate transfer instrument in advance (for example standard contractual clauses). In addition, CloudLinux states that it is certified under the EU-U.S. Data Privacy Framework. On request, using the contact details in section 1, we will provide information about these safeguards and, where permissible, a copy of the standard contractual clauses. CloudLinux does not specify a fixed retention period for visitor data such as the IP address and the address accessed, either in its privacy policy or in the contract. According to the contract, CloudLinux processes the data until the contract ends or the processing is no longer necessary, and deletes them after the end of the contract unless a law requires otherwise; according to the contract, CloudLinux deletes files in which personal data are detected immediately after detection. The general deletion rule in CloudLinux’s privacy policy (deletion or anonymisation after a reasonable period) does not expressly concern these visitor data. According to the hosting provider’s own information, it retains the data of this software on the server (incident log and visitor data) for 100 days (default setting).

According to the technical and organisational measures in the contract with the hosting provider, the hosting provider’s firewall logs access attempts with IP addresses; the retention period for these logs is determined by the hosting provider.

4. Cookies, third-party providers and links

This website sets no cookies for visitors and stores no information on your terminal device. It does not use any audience measurement or advertising services, and we do not evaluate the views of the notices statistically; this is without prejudice to the security functions described in section 3. Content from third-party providers (for example fonts, maps or videos) is not loaded. The QR code is generated on the server of this website. Only in the administration area does WordPress set technically necessary cookies for logged-in editors.

Notices may contain links to external sites provided by the sponsors (for example election information, notification mechanism, privacy information). When you click on such a link, the privacy information of the respective site applies.

5. “Create a new ad” form

When you use the form, we process the information you enter:

  • information on the sponsor: name, email address, postal address, where applicable registration number, contact person and V.i.S.d.P. (person responsible for the content under German press law);
  • where applicable, information on entities ultimately controlling the sponsor and on paying entities;
  • information on the election, referendum or initiative, on amounts, the origin of the funds, the period and the channel;
  • in the case of targeting, the information requested in this respect;
  • information on the notification mechanism and on any suspension of the advertisement, as well as the name of the advertisement and, where applicable, the uploaded advertisement artwork.

Information on other persons and entities: Where the form contains information on persons or entities that do not fill in the form themselves (for example contact person, V.i.S.d.P., entity ultimately controlling the sponsor or paying entity, the controller responsible for targeting), we receive this information from the person filling in the form and not from the data subjects themselves. This concerns name, email address, address and function. Please only enter information on other persons if they have been informed of this and the information may be published.

Purpose and legal basis: We provide this form to sponsors and publish the notices on the basis of the information they provide. The information is required in order to create and provide the label and the transparency notice pursuant to Regulation (EU) 2024/900. The legal basis is Art. 6(1)(b) GDPR (provision of the service you have requested) and Art. 6(1)(f) GDPR. Our legitimate interest under point (f) lies in enabling sponsors to provide proper labelling and a proper transparency notice and in ensuring the traceability of the information, in particular for information on persons who do not fill in the form themselves. We operate the service and decide on the means of processing. The person making the entry or the organisation represented must ensure that the information is correct and complete in substance; this is an obligation under Regulation (EU) 2024/900 and not a question of data protection responsibility for the operation of the service. This information also serves as information for persons whose details are entered by others (Art. 14 GDPR): the source of the information is the person making the entry or the organisation represented, and the information is published (see “Publication”).

Special categories: This service is aimed exclusively at parties and other organisations; private individuals should not use it. Where names of natural persons appear in a notice (for example V.i.S.d.P., persons authorised to represent the organisation or contact persons), this is information in connection with the activities of the organisation. The information as to which election or cause is being promoted may allow conclusions to be drawn about political opinions.

Publication: The transparency notice can be accessed by anyone without logging in, as can the machine-readable version, the QR code, the label images and the label text. The information listed in the notice is published, including the name, email address and address of the sponsor and, where provided, of the entity ultimately controlling the sponsor, the paying entity and the controller responsible for targeting, as well as your free-text entries. The images and the label text additionally show the V.i.S.d.P. statement. The email address for the link and QR code, the contact person and the advertisement artwork are not published. Published email addresses can be read by third parties, including by automated means.

Findability: The notices can only be reached via their link and the QR code. We do not list them in the sitemap of this website and ask search engines not to include them (“noindex” tag); this is a request, not a guarantee. Anyone who knows the link can access the notice.

Generated images: From your information, we generate label images (PNG, with QR code) and store them temporarily on the server so that they can be retrieved quickly. The images contain the information that also appears on the poster, in particular the name, address and email address of the sponsor and the V.i.S.d.P. statement. They are deleted together with the notice.

Advertisement artwork: We store uploaded advertisement artwork on the server of this website. Uploading is voluntary. The artwork is not included in the notice, is currently not processed further and is deleted together with the entry. Please only upload artwork for which you hold the necessary rights, and no images of persons without their knowledge.

Retention period: Regulation (EU) 2024/900 requires political advertising publishers to retain their transparency notices for a period of seven years after the last publication of the political advertisement concerned (Art. 12(4)). For this purpose, we keep the notice available for the sponsor (Art. 6(1)(b) and (f) GDPR) and delete it thereafter. As a rule daily, an automated run checks whether at least seven years have passed since the end of the stated advertising period and since the last modification of the notice (the later of the two dates being decisive), and then deletes the entry, the public page and the generated images. In each case, the current version is stored; the service does not currently keep a version history of earlier versions. Entries marked as spam without a published page are deleted after 30 days. If an entry is deleted at your request, the public page and the generated images disappear with it immediately. The email address for sending (section 6) is removed from the entry after sending. Drafts and incomplete file uploads are deleted automatically after 30 days and after one day respectively.

6. Email address for link and QR code

In the form, you provide an email address to which we send the link to the notice, the QR code and the label images. This address is not published and is used only to send you this message (Art. 6(1)(b) and (f) GDPR). Our legitimate interest is the reliable delivery of the results to the person who filled in the form. The address is removed from the entry after the message has been sent. It still remains in the mail server logs at the hosting provider (according to the hosting provider, essentially 7 days) and as a check value (generated using a secret key of this website, not in plain text) in the abuse counter (section 8), which becomes invalid no later than 24 hours after the last counting operation and is then deleted automatically. Replies to the message go to our contact address and are treated as a contact enquiry (section 9). For every notice that is created we also receive an internal notification at our contact address with the link, the ad title, the sponsor’s name, the language and the sending status (without your email address).

The message is sent directly via the server of this website at the hosting provider. The email contains the link to the notice, the QR code, the label text with the information on the sponsor and the label images as attachments. Whether the message is transmitted in encrypted form on its way to your mailbox depends on the provider of your address. Please only provide an address that belongs to you.

7. Saving a draft

When you use “Save as draft”, we temporarily store your entries so far, including the email address provided and any uploaded artwork, on the server and generate a link through which you can continue working later. Anyone who knows the link can see the stored information; do not pass it on. The link appears in the address bar and therefore also in the server log files; it may also be contained in the data of the security software described in section 3. Drafts are deleted automatically after 30 days. Your IP address and browser type are not stored in the draft (for log files and security software, see section 3). Uploaded files belonging to an incomplete draft are removed after one day; you will then have to upload any artwork again. If you have the link sent to you by email, we use the address provided only for that purpose. The legal basis is Art. 6(1)(b) and (f) GDPR; our legitimate interest is to enable you to continue your entry later without having to re-enter everything.

8. Protection against abuse

To protect against automated submissions, we use a field that is invisible to humans and limit submissions per IP address (no more than 10 per hour), the sending of emails per recipient address (no more than 10 per day) and retrievals of the label images per IP address (no more than 60 per hour). For this purpose, we store counter values whose key is derived from the IP address or the email address respectively (a check value generated using a secret key of this website; the addresses themselves are not contained in it in plain text). The counter values become invalid no later than 24 hours after the last counting operation and are then deleted automatically. Because such check values can be attributed again with additional knowledge, we treat them as personal data. The legal basis is Art. 6(1)(f) GDPR (legitimate interest in trouble-free operation). Technical blocks may reject a submission; they have no further effect on you.

We do not store the IP address and browser type of persons submitting the form in the entry: the form system is configured so that neither is stored. The entry only includes the page accessed and the time of submission.

9. Contacting us

If you contact us by email or telephone, we process your information (for example name, contact details, content of the enquiry) in order to respond to your enquiry. The legal basis is Art. 6(1)(b) GDPR if the enquiry is connected with a contractual relationship or pre-contractual measures, otherwise Art. 6(1)(f) GDPR (legitimate interest in handling enquiries). We delete the data as soon as the enquiry has been dealt with and no retention obligations prevent this, at the latest six months after handling has been completed.

If you report illegal content to us (see Legal notice), we process your name, your email address and the content of your report in order to examine it and inform you of our decision. The legal basis is Art. 6(1)(f) GDPR. We delete this information as soon as the report has been concluded and no retention obligations prevent this, at the latest after six months.

10. Recipients and backups

The recipients of your data are the hosting provider HostPress GmbH with the sub-processors named in section 3, CloudLinux as a further processor of the hosting provider for the security software on the server (together with the sub-processors used by CloudLinux, see section 3) and, insofar as the information is published, the public. We do not specifically pass on entries made in the form to other services (for example spam filter, analytics or mailing services). The transmissions to CloudLinux described in section 3 may contain parameters of the address accessed and, where attacks are detected, also HTTP parameters of the request. CloudLinux’s privacy policy and the contract do not state whether these also include entries made in forms. With the exception of the transmissions to CloudLinux (registered office in the USA) described in section 3, we do not transfer your data to countries outside the EU or the EEA; based on our current knowledge, we initiate a transfer to the USA only in this context. The notice can be accessed worldwide, and the email goes to the address you provide; we have no influence over its provider.

The hosting provider backs up the server data regularly and in encrypted form on backup servers set up specifically for this purpose; we delete our own backups of the database after 30 days at the latest. Deleted data remain contained in the hosting provider’s backups for its retention period and no longer thereafter.

11. Your rights

You have the right of access (Art. 15 GDPR), the right to rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18) and data portability (Art. 20), and the right to object to processing (Art. 21). To exercise these rights, please contact the controller named above. We amend the information in the entry; the public page then shows the amendment. Please note that the erasure of information in a transparency notice may be restricted by the statutory retention obligation.

Information about your right to object under Art. 21 GDPR. You have the right to object, on grounds relating to your particular situation, at any time to the processing of personal data concerning you which is based on Art. 6(1)(f) GDPR. We will then no longer process the data unless we can demonstrate compelling legitimate grounds which override your interests, rights and freedoms, or the processing serves the establishment, exercise or defence of legal claims. The objection must be addressed to the controller named in section 1.

You also have the right to lodge a complaint with a data protection supervisory authority. The competent authority is the State Commissioner for Data Protection and Freedom of Information of North Rhine-Westphalia (Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen), Kavalleriestraße 2–4, 40213 Düsseldorf (www.ldi.nrw.de).

12. Obligation to provide data, automated decisions

The information on the sponsor, on the election or occasion, on the amounts and on targeting is required in order to create the transparency notice pursuant to Regulation (EU) 2024/900. Without it, we cannot create the notice. The email address for sending is required so that we can send you the link and QR code. Mandatory fields are marked with an asterisk in the form. The processing of the server log files is necessary for technical operation. No automated decision-making, including profiling, within the meaning of Art. 22 GDPR is carried out by us. The automatic protective blocks (sections 3 and 8) only affect technical access; we do not see any legal or similarly significant effect on you.

13. Changes

We adapt this notice when the service or the legal situation changes. The version published here at the relevant time applies.