Privacy Policy

Last updated: September 2026

This privacy policy applies to the website www.maskottchen-community.de and all subpages accessible through it.

1. Controller

The controller responsible for data processing on this website is:

Evamarie Pfitzner
Hans-Sachs-Str. 13
14471 Potsdam
Germany

Phone/WhatsApp: +49 176 36467542
Email: kontakt@maskottchen-community.de

2. Provision of the Website and Server Logs

When you access the website, technically necessary data is processed so the website can be delivered and operated securely. This may include, in particular: IP address, date and time of access, requested page/file, amount of data transferred, referrer URL, browser type, operating system, HTTP status code and requesting provider.

Purpose: Technical provision, stability, security and troubleshooting of the website.

Legal basis: Art. 6(1)(f) GDPR. The legitimate interest lies in the secure and functional operation of the website.

Retention period: Server log files are stored only for as long as necessary for security, troubleshooting and operation. The specific retention period depends on the hosting provider used and should be confirmed with the host before launch.

Note: The specific hosting provider should be added here before publication.

3. Cookies, Local Storage and Cookie Notice

At present, this website does not use marketing, analytics or tracking cookies. Google Analytics, Meta Pixel and comparable tracking services are not integrated.

To store your selection in the cookie/privacy notice, technically necessary local browser storage may be used. This includes storage via localStorage with an entry mc_cookie_consent_v2 and the cookie mc_cookie_consent, with a maximum cookie lifetime of 180 days. This allows the website to remember whether you acknowledged the notice or allowed external media.

For your selected display mode (Automatic, Light or Dark) the website also stores the technically necessary setting mc_theme_preference_v1. It is stored in local browser storage and additionally in a cookie restricted to maskottchen-community.de. The cookie contains only the value auto, light or dark, is not used for tracking and has a maximum lifetime of one year. This ensures that your selected display mode remains active when switching between subpages and between the domain with and without www.

Purpose: Storing your privacy selection and avoiding repeated display of the notice.

Legal basis: Art. 6(1)(f) GDPR and Section 25(2) TDDDG where storage is necessary for the function you requested.

You can delete local storage at any time through your browser settings. The notice will then be shown again.

Open cookie settings

4. Contact by Form, Email, Phone or WhatsApp

When you contact us, we process the data you provide, for example your name, company, email address, phone number, event/project, date, location, requested service, message and any submitted files or content.

When using the contact forms, the data entered is transmitted to our web server and processed to handle your inquiry. The message is handed to the locally configured mail server for forwarding to kontakt@maskottchen-community.de. An automatic confirmation is then submitted for delivery to the email address entered in the form. It contains an inquiry ID, the submission time and, where applicable, the selected service, date, number of people and calculated price estimate. To prevent misuse, free text, contact details, addresses and file names are excluded from this automatic confirmation. An optional JPG, PNG, WebP or PDF file is attached only to the internal inquiry email. Acceptance by the mail server does not yet confirm delivery to the respective inbox.

To protect against automated abuse, the form uses an invisible verification field, server-side limits by IP address and recipient address, and protection against duplicate sending. The private protection directory processes hashes of IP addresses and recipient addresses, timestamps, an inquiry hash and its technical delivery status with inquiry ID. Form contents and attachments are not stored there in plain text. These protection records are considered for rate limits and duplicate checks for up to one hour. Expired records are cleaned up during subsequent form submissions; without further submissions, the file may remain longer. Technically necessary server logs may also be generated as described above.

In addition, we use Cloudflare Turnstile (Cloudflare, Inc.) to protect the contact forms against bots and automated spam. When the contact page is loaded and during the security check, the browser connects to challenges.cloudflare.com. According to Cloudflare, Turnstile processes only the technical signals required for this security function and does not access the contents of the form fields. The short-lived verification token is submitted to our server together with the inquiry; our server validates the token through Cloudflare's Siteverify interface and also sends the IP address as a verification signal. The form is not sent unless the Turnstile check succeeds. Further information is available in the Cloudflare Turnstile Privacy Addendum.

Purpose: Handling your inquiry, preparing quotes, coordinating appointments, carrying out pre-contractual measures and communication.

Legal basis: Art. 6(1)(b) GDPR where your inquiry relates to a contract or pre-contractual measures; otherwise Art. 6(1)(f) GDPR based on our legitimate interest in handling inquiries.

Retention period: Inquiries are deleted once they are no longer required for processing and no statutory retention obligations apply. Communications relevant under commercial or tax law may be retained longer in accordance with statutory retention periods.

5. YouTube / External Media

A YouTube video may be embedded on the Christmas page using enhanced privacy mode. The video is loaded only if you actively click “Load video” or allow external media in the cookie notice.

Loading the video establishes a connection to YouTube/Google. In particular, your IP address, browser/device information, the page visited, time of access and possibly other data may be processed. Data may be transferred to third countries, particularly the United States.

Purpose: Displaying a sample video for Santa Claus & Angel video messages.

Legal basis: Your consent under Art. 6(1)(a) GDPR and Section 25(1) TDDDG. You may withdraw your consent at any time with future effect by deleting the cookie/media setting in your browser or resetting it through the cookie notice.

6. WhatsApp, Instagram, TikTok and External Links

The website may contain links to WhatsApp, Instagram, TikTok or other external services. When you click these links, you leave this website. The respective providers are responsible for any processing of personal data on their services.

When contacting us via WhatsApp, your phone number, profile information, message content, metadata and other data processed by WhatsApp/Meta may be involved. Use email or phone instead if you prefer not to use WhatsApp.

7. Recipients of Data

Personal data is disclosed to third parties only where necessary to handle your inquiry, perform an order, comply with legal obligations or operate the website technically. Potential recipients include hosting providers, email providers, communication services and, where applicable, service providers involved in a booked event.

8. Your Rights

Under the GDPR, you have in particular the following rights: access, rectification, erasure, restriction of processing, data portability, objection to processing based on legitimate interests, and withdrawal of consent with future effect.

You also have the right to lodge a complaint with a data-protection supervisory authority. The competent authority for Brandenburg is:

The Brandenburg Commissioner for Data Protection and Access to Information
Stahnsdorfer Damm 77
14532 Kleinmachnow
Phone: 033203 356-0
Email: poststelle@lda.brandenburg.de
Website: www.lda.brandenburg.de

9. Updates to this Privacy Policy

This privacy policy will be updated if the services used, technical functions or legal requirements change. Before launch, the hosting provider, form technology and integrated third-party providers in particular should be reviewed and completed as necessary.