Legal

Privacy policy

This is a translation for convenience. The legally binding version is the German original.

1. Controller

The controller responsible for data processing on this website is:

Coretica
Owner: Raphael Moser
Tal 44
80331 München
Germany
Email: kontakt@coretica.de

2. General information

The protection of your data is important to us. This website is deliberately built to be lean: there is one single functional cookie – it is only set when you open the QR code from our letter, and is described in Section 5 –, no analysis of user behaviour takes place, and no advertising networks or social networks are embedded. For this reason, this site does not need a consent banner either.

Fonts are not loaded from external servers but are provided locally. As a result, your IP address is not transmitted to third parties.

3. Hosting and server logs

This website is hosted by ALL-INKL.COM – Neue Medien Münnich, owner René Münnich, Hauptstraße 68, 02742 Friedersdorf, Germany. The provider processes data on our behalf; a data processing agreement pursuant to Art. 28 GDPR is in place for this purpose. The servers are located in Germany.

When the website is accessed, the server automatically logs information transmitted by your browser:

  • page accessed and date and time of access
  • amount of data transferred and notification of whether the request was successful
  • browser type and version, operating system used
  • previously visited page (referrer)
  • IP address, truncated by the last digits (11.22.33.44 becomes 11.22.0.0)

This data is required for the technical operation and security of the website. The legal basis is Art. 6(1)(f) GDPR (legitimate interest in trouble-free and secure operation). This data is not combined with other data sources. The logs are deleted after seven days at the latest.

From these logs, our hosting provider compiles aggregated access statistics: number of requests, pages accessed, referring pages, browser types and operating systems. The analysis works without cookies, without any identifier in the browser, without tracking pixels and without any embedded third-party service; it is based exclusively on the logs mentioned above with truncated IP addresses. The statistics are password-protected and accessible only to us. The legal basis is Art. 6(1)(f) GDPR (legitimate interest in identifying which content is in demand and where the website needs technical improvement). The underlying logs are deleted after seven days at the latest.

4. Contact form and getting in touch

If you write to us via the contact form, the following information is processed:

  • your name
  • your email address
  • the topic you selected for your enquiry
  • company and telephone number, if you provide them voluntarily
  • your message
  • date and time of submission and your IP address
  • the confirmation that you have consented to the data processing, with a timestamp

The processing serves exclusively to handle your enquiry. The IP address is additionally used to prevent mass automated submissions.

Protection against misuse of the contact form. For this count we store an irreversible checksum (hash) of your IP address and of the email address provided — in this counter, not the information itself. It serves exclusively to prevent mass misuse of the form; the legal basis is our legitimate interest (Art. 6(1)(f) GDPR). Counting takes place in two windows – at most three submissions per hour and at most ten per 24 hours per origin and per destination address, plus, across all senders combined, at most twenty per hour and one hundred per day –, and the entries are deleted automatically after seven days at the latest. For IPv6 addresses, only the network portion (the first 64 bits) is included in the checksum. In addition, we check whether the domain of your email address can receive messages at all; if it cannot, the message is not sent. The form also carries an invisible time field signed by the server, which only indicates when the page was touched; it contains no information about you.

If you scan the QR code from our letter, we set a short-lived cookie coretica_brief. It contains exclusively the reference code of the letter and the name and town of your business, and serves solely to pre-fill the contact form for you. It expires after five minutes, is not transmitted to third parties and is not used for tracking. If the reference code is unknown, a cookie of the same length but with empty content is set, so that it cannot be detected from outside which reference codes exist. If your browser blocks the cookie, the form remains fully usable — it is then simply not pre-filled. The letter route also includes the rate limiter described in Section 5.

No disclosure to third parties takes place. The message is processed on our hosting provider's server and forwarded directly as an email to our mailbox. No external form service is involved.

If you have received a promotional letter from us and its reference code is sent along when you submit the form – from the QR code or because it appears in your message –, your email address is not only forwarded but stored and assigned to the associated case. Purpose, legal basis and storage period are set out in Section 5. Without a valid reference code, this does not happen.

You automatically receive an acknowledgement of receipt at the email address you provided. It states only the topic you selected and the time of receipt – it does not repeat the text of your message. This way, if someone mistypes their own address, no content reaches a stranger.

The legal basis is Art. 6(1)(b) GDPR if your enquiry is aimed at concluding a contract, otherwise Art. 6(1)(f) GDPR (legitimate interest in responding to enquiries).

We store your enquiry until it has been fully dealt with and no statutory retention obligations prevent deletion. For an email address assigned to the case, the period stated in Section 5 applies. You may object to the storage at any time.

5. Promotional letters to businesses (Art. 14 GDPR)

We contact businesses once by post, pointing out a specific observation about their publicly accessible website. The information used for this does not come from you yourself, but from publicly accessible sources. This is why we inform you here pursuant to Art. 14 GDPR. We write exclusively to companies, practices and law or accounting firms at their business address – not to private individuals and not to private addresses.

What data we process

  • name of the business, business address and town
  • web address (domain) and industry
  • business contact details from the legal notice (Impressum), where they appear there (telephone number, email address, name of the person authorised to represent the business)
  • the date of our review and the observations about the website visible at that time, together with the address accessed as evidence
  • a five-character reference code assigned to the letter, and the date of dispatch
  • if the QR code on the letter is opened: reference code, time of access and the name of the business belonging to that reference code – without IP address
  • for the rate limiter of the letter response route: a salted, irreversible checksum (hash) of your IP address (for IPv6 only of the network portion) together with the times of your requests in the last 24 hours. It prevents anyone from trying out reference codes one after another; the legal basis is our legitimate interest (Art. 6(1)(f) GDPR). Without the secret on our server, the checksum cannot be traced back to the address; its file is stored outside the web directory and is deleted by the daily clean-up run no later than seven days after the last request – the timestamps themselves already after 24 hours. This is the same mechanism as for the contact form (Section 4).
  • if you subsequently submit the contact form: reference code and time of submission. This entry only records that a reply to a letter was made – not what it said. It contains neither your name nor your email address nor the text of your message.
  • likewise for a submission with a reference code: the email address you entered in the form. It is not only forwarded to our mailbox but stored and assigned to the respective case. The purpose is to be able to assign a later message from the same business to this case, even if the reference code is no longer sent along at that point. The legal basis is our legitimate interest (Art. 6(1)(f) GDPR). If you write several times from different addresses, all of them are recorded with the case; none is replaced by a later one. Without a valid reference code, nothing is assigned and nothing is stored – your address then appears exclusively in the email to us. We do not store your name or the text of your message here; both appear only in that email.

Where the data comes from

  • the publicly accessible website of the business, including the legal notice (Impressum) required by law there
  • publicly accessible industry and directory listings
  • generally accessible search engine results

We do not buy addresses and do not take data from sources that are not publicly accessible.

Purpose and legal basis

The purpose is a one-time initial contact by post with an individual observation and the offer of a free, non-binding draft. If you reply via the contact form, assigning your reply to this case also forms part of this purpose: it records which letter was replied to and prevents further post to businesses that have already responded. The legal basis is Art. 6(1)(f) GDPR. Our legitimate interest is direct marketing to traders and businesses (cf. Recital 47 GDPR); only business contact details that the business has published itself are processed for this purpose.

Who receives the data

For printing, enveloping and dispatch, we use a letter service provider as a processor pursuant to Art. 28 GDPR; it receives only the information necessary for dispatch and processes it in accordance with our instructions. Opening the QR code runs via our hosting provider (see Section 3). No disclosure for other purposes, no sale and no transfer to a third country takes place.

How long we store data

  • Address and review findings: until the contact process is completed, at most twelve months after the letter was sent.
  • Reference code and time of a scan: likewise at most twelve months. After that, a daily routine removes the rows concerned.
  • Reference code and time of a form submission: likewise at most twelve months, for the same reason and by the same routine. We need this information to recognise which letters were replied to, and to avoid sending you further post if you have replied. After one year, the contact process is completed and the information no longer serves any purpose.
  • The email address assigned to the case has no storage period of its own: it is deleted together with the case to which it belongs – so the period from the first item of this list applies. The transfer file on our server from which the assignment is created is kept, like the other letter files, for at most twelve months; after that, the same daily routine removes the rows concerned.
  • If you respond to our letter – by telephone or via the form –, the contact process ends and the initiation of a business relationship begins. From then on, we keep your information for 24 months after the last contact, or 36 months if a quotation has been submitted (standard limitation period). After that, the case is deleted.
  • If you object to advertising, we add your address to a suppression list. This is stored permanently – exclusively for the purpose of not sending you any further post (Art. 21(3) GDPR).

Your rights, in particular the right to object to advertising

You may object to the use of your data for advertising at any time and without giving reasons. You will then receive no further post from us. An informal message to kontakt@coretica.de is sufficient – ideally with the reference code from the letter, so that the assignment is unambiguous. You are also entitled to the rights listed in Section 8, as well as the right to lodge a complaint under Section 9.

6. Storage in the browser – one cookie, no banner

This website sets exactly one single functional cookie (coretica_brief, only after a letter QR code has been opened, valid for five minutes, described in Section 5) and does not embed any external services: no analytics or advertising tools, no map services, no fonts from third-party servers, no videos from third-party providers. The cookie is strictly necessary for pre-filling the form (§ 25(2) no. 2 TDDDG – German Telecommunications Digital Services Data Protection Act) and does not require consent; this is why there is no consent banner here either.

Two items of information are stored locally in your browser – both only if you press the respective button yourself:

  • coretica.vorschau.pause (sessionStorage) – remembers whether you have paused the automatically running preview of the web packages using the pause button. It disappears as soon as you close the browser tab.
  • coretica-bewegung (localStorage) – remembers whether you have switched off the animations on this site using the “Pause motion” switch. This information remains stored so that the site also stays calm on your next visit. You can delete it at any time by switching the toggle back or by deleting the website data in your browser. If your browser refuses persistent storage, the value is instead remembered only for the current session (sessionStorage).

When the motion switch is toggled, the site also briefly remembers your reading position (coretica-scrollstand, sessionStorage) so that you can continue reading at the same place after the page reloads; this value is removed again immediately afterwards.

This information contains no personal reference whatsoever and is not transmitted to us or to third parties. It serves exclusively the function that you yourself triggered with the respective click, and is strictly necessary for that purpose (§ 25(2) no. 2 TDDDG). No consent is required for this. If your browser refuses the storage, the site works unchanged – only the pause is then not retained across page changes.

7. Encryption

This website uses SSL or TLS encryption. You can recognise this by the padlock symbol in your browser's address bar. When encryption is active, the data you transmit to us cannot be read by third parties.

8. Your rights

You have the following rights vis-à-vis us with regard to your personal data:

  • Access to information about which data we process about you (Art. 15 GDPR)
  • Rectification of inaccurate data (Art. 16 GDPR)
  • Erasure of your data (Art. 17 GDPR)
  • Restriction of processing (Art. 18 GDPR)
  • Data portability (Art. 20 GDPR)
  • Objection to processing (Art. 21 GDPR)

To exercise these rights, an informal message to the email address stated above is sufficient.

9. Right to lodge a complaint

You have the right to lodge a complaint with a data protection supervisory authority about the processing of your personal data. As a rule, the competent authority is the one for your place of residence or for our registered place of business: Bayerisches Landesamt für Datenschutzaufsicht (BayLDA – Bavarian Data Protection Authority), Promenade 18, 91522 Ansbach, www.lda.bayern.de.

10. Changes to this policy

We update this privacy policy as soon as the functions of the website or the legal requirements change. The current version applies to each of your future visits.

As of: October 2026