YOUR DATA ON THIS WEBSITE
This policy explains how personal data is processed when you visit my website, contact me or register for an event.
1. Controller and contact details
Philipp Aff
Hunsrückblick 13
55595 Hüffelsheim, Germany
Email: info@philippaff.de
Phone: +49 170 4154873
You can contact me directly with privacy questions or to exercise your rights.
2. Hosting, email and technical access data
The website and email account are hosted by ALL-INKL.COM – Neue Medien Münnich, proprietor René Münnich, Hauptstraße 68, 02742 Friedersdorf, Germany. The provider uses servers in Germany and processes data to supply these technical services.
When you open a page, your IP address, the requested address, date and time, and technical information about the request and browser are transmitted to the server. Depending on your browser, this may include operating-system information and the address of the previous page. Technical server logs help deliver and protect the website. Their retention is governed by the need to investigate errors, detect misuse and resolve specific security incidents.
The legal basis is Article 6(1)(f) GDPR. My legitimate interest is to operate a reliable, secure website. See the provider's privacy information for further details.
3. Necessary functions and cookies
The website uses WordPress and Divi, with Polylang providing German and English versions. The pll_language cookie can remember the last language selected; its standard lifetime is one year. WordPress also uses login and security cookies for access to the protected administration area.
Where storing or accessing information on your device is strictly necessary to provide a service you expressly request, the legal basis is section 25(2), no. 2 of the German TDDDG. Related processing of personal data is based on Article 6(1)(f) GDPR. My legitimate interest is to provide the requested language and protect access. You can delete or block cookies in your browser, although this may limit some functions.
I do not use analytics or advertising trackers, embedded social-media plugins or Google reCAPTCHA on this website. Fonts are supplied locally or use fonts already available on your device.
4. Contact by form, email or phone
If you contact me, I process your contact details and the content of your enquiry. The contact form asks for your name, email address and message and sends the enquiry by email. Its arithmetic question helps prevent spam without an external CAPTCHA provider.
Article 6(1)(b) GDPR applies to enquiries about a booking, course or prospective contract. Other enquiries are processed under Article 6(1)(f) GDPR, based on my legitimate interest in answering messages.
I retain correspondence for as long as needed to handle the enquiry and follow-up questions. Documents subject to legal retention requirements, or needed to establish, exercise or defend legal claims, are retained for that purpose until the applicable periods expire.
5. Event registrations and enquiries
Depending on the event, registration may use an external link or a form on this website. The event page shows which method applies.
If you use an event form on this website, I process your first and last name, email address, message and the organisational details requested in that form. Records also include the associated event, registration type and status, language and originating page, and creation and modification times. These details are managed in my WordPress installation. Where group registration is offered, the names of additional participants are also recorded. I receive these names from the person submitting the registration. Please tell those people about this policy.
I use these details to handle your enquiry or registration, organise the event and inform you about your registration status or changes. Depending on the event, you may receive related emails such as confirmations and personal cancellation or download links. These messages are not a newsletter.
Article 6(1)(b) GDPR applies to arranging and providing your participation. Other event enquiries and the organisation of additional participants are based on Article 6(1)(f) GDPR. My legitimate interest is to handle the enquiry and organise the event reliably. Confirming that you have read the privacy policy is not consent to advertising.
Automatic cleanup of registrations stored in the event plugin is set to 90 days after the last event date that has not been cancelled. If there is no such date, the period starts when the registration or enquiry is received. Cleanup runs through WordPress scheduling when the website is visited and also removes associated additional participants. This function does not delete emails, any exports or backups; the retention purposes and legal obligations described here apply to those separately.
Required fields are identified in each form. Without those details, I cannot process the relevant enquiry or registration through that form.
6. Protection of event forms
Event forms use local technical checks against automated submissions. To limit excessive requests, a temporary pseudonymous identifier and counter are generated from the IP address. This does not create a plain-text IP entry in the registration table. The counter expires ten minutes after the last counted request.
The legal basis is Article 6(1)(f) GDPR. My legitimate interest is to prevent spam and misuse and keep the forms available.
7. Personal download links and calendars
If you receive protected event materials, the plugin associates a personal download link with your email address, the event and the file. It also stores a hash of the link token, creation and expiry times, and any revocation. The link's validity is set when issued. Expired link records are cleaned up after an additional retention period of 90 days. This does not automatically delete the associated files. Processing serves to provide the agreed materials and is based on Article 6(1)(b) GDPR.
Calendar files and subscriptions contain public event information, not registration data or participant lists. If you add an event to your calendar, your calendar app's privacy information also applies to its subsequent processing.
8. External registrations and links
Some events link to Xoyondo or the organiser's website, such as callerschool.eu, for registration. These are ordinary links; the external forms are not embedded in this website. Opening a link sends the technical data needed to access the other provider's site. For information you enter there, consult that provider's and the relevant organiser's privacy notices.
According to its legal notice, Xoyondo is offered by Veit Technologies in the United States. Its processing and services are described in Xoyondo's privacy policy. This does not mean that all of its processing takes place exclusively in Germany.
9. Recipients and retention
I have access to the data described here, as do the technical hosting and email providers to the extent needed for their work. Data may be disclosed to authorities or other bodies where legally required or necessary to establish or defend legal claims.
I delete personal data when its purpose no longer applies and there are no legal obligations or legitimate grounds for retaining it. Documents subject to retention requirements are restricted to that purpose. Where legal retention requirements apply, further storage is based on Article 6(1)(c) GDPR. Backups support recovery after technical failures and may contain data until the relevant backup is replaced.
10. Your rights
Under the conditions set out in the GDPR, you may request access to your personal data, correction of inaccurate information, erasure or restriction of processing. You also have a right to data portability where the legal conditions apply. Where processing is based on your consent, you may withdraw it at any time for the future.
Right to object: If I process data under Article 6(1)(f) GDPR, you may object on grounds relating to your particular situation. I will then stop that processing unless I demonstrate compelling legitimate grounds that override your interests, rights and freedoms, or the processing serves to establish, exercise or defend legal claims.
To exercise your rights, email info@philippaff.de. You may also complain to a supervisory authority, particularly in the country of your habitual residence, place of work or the alleged infringement. The authority responsible for my location is the State Commissioner for Data Protection and Freedom of Information Rhineland-Palatinate, Postfach 30 40, 55020 Mainz, Germany. Further information and a complaint form are available at datenschutz.rlp.de.
The website functions described here do not make decisions based solely on automated processing that have legal or similarly significant effects on you.
Last updated: October 28, 2026