Privacy Notice

1. Who is responsible

The controller responsible for the processing described here is Armen Geworgjan, CHIC IDEA, Regierungsstraße 37 D, 39104 Magdeburg, Germany. You can reach me at info@chicidea.de or by phone at 0391 50380874.

This notice concerns the planned business website at chicidea.de, the associated contact and customer management, and the integration services described below. It does not replace the privacy notice of a client business for its own WhatsApp communications or the notices of external platforms.

2. Website operation and server logs

STRATO GmbH, Otto-Ostrowski-Straße 7, 10249 Berlin, is the intended hosting provider for chicidea.de. Cloudflare is not used for this website.

When a page is requested, technically necessary connection data is processed, particularly the IP address, time, requested address, browser and device details, and, where applicable, the previously visited page. This enables delivery and helps detect errors and attacks. The legal basis is Article 6(1)(f) GDPR; my legitimate interest is the secure and reliable operation of the website.

STRATO states that visitor IP addresses are stored in its own security logs for no longer than seven days. These are distinct from independently configured web server and error logs on the server used. Their actual deletion period must be added before this version is published live. In the event of a specific security incident, necessary data may be retained until the incident is resolved or to assert or defend claims.

Hosting as processing on behalf of a controller must be governed by a contract under Article 28 GDPR. The documentation associated with the specific STRATO contract will be checked before launch.

3. Local fonts and data-minimizing presentation

The website fonts are provided locally with the website files. No connection to Google Fonts is established to display fonts. Images and graphic elements are also hosted by the website operator.

No visitor analytics, advertising tracking, or embedded social media widgets are planned for the new website. In particular, Google Analytics and Google Ads conversion tracking are not used. The moving dots, the fox, and the crew are design elements; they do not transmit any input to an AI service.

The pause-animation setting applies to the current website visit. The theme does not store it permanently in the browser. It does not itself set cookies for the public-facing website and does not use persistent local browser storage. Technically necessary login cookies apply only to the protected administration area. Before launch, the active WordPress extensions will also be checked for cookies actually set and external requests made.

4. Inquiries by email and phone

If you contact me, I process your contact details and the information about your inquiry so I can respond and, where applicable, prepare or carry out an order. Depending on the inquiry, this includes names, business contact details, message content, project information, and documents provided.

For an inquiry concerning a contract with you, the legal basis is Article 6(1)(b) GDPR. When processing information about company contacts or handling other inquiries, I rely on Article 6(1)(f) GDPR; my interest is handling business communications. Statutory obligations are fulfilled on the basis of Article 6(1)(c) GDPR.

The form on the contact page compiles your details into an email draft entirely within your browser. Clicking opens your email app; the website does not send the message automatically or store form data on a server. I receive the message only when you send the email yourself. The copy function copies the text you requested to your clipboard.

You decide which information to share with me. Without contact details that allow me to reach you and information about your inquiry, I may be unable to process it. Inquiries that are no longer needed are deleted unless retention obligations or legitimate reasons for further storage apply.

5. WhatsApp as an optional contact channel

The WhatsApp button is a normal external link. Simply visiting my website does not load a WhatsApp plugin or send data to WhatsApp through it. You switch to WhatsApp or its website only when you click it.

For users in the European Economic Area, WhatsApp is provided by WhatsApp Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland. The provider’s own terms and privacy notice apply there. Data processed may include phone numbers, usage data, and connection data. WhatsApp also describes transfers outside the EEA, including on the basis of adequacy decisions and EU standard contractual clauses; further information and the safeguards are available in the provider’s linked notice.

If you message me there, I use your phone number, your profile name where applicable, and the message content to handle your inquiry. The legal bases and deletion criteria are the same as those in the section on inquiries. Contact via WhatsApp is optional; email and phone are also available. Please do not send passwords or particularly sensitive documents through this channel.

The provider’s privacy notice: WhatsApp Privacy Policy for the EEA.

6. Business customers, projects, and invoices

To prepare and carry out orders, I process the necessary company and contact details, contract and project information, and invoicing and payment data. Personal data is processed on the basis of Article 6(1)(b) or (f) GDPR, depending on the contractual relationship; statutory accounting and retention obligations are based on Article 6(1)(c) GDPR.

WooCommerce is intended for internal customer record and invoice creation. The new business website will not offer a public checkout or customer registration. Before launch, the extensions used, such as those for invoices and product options, will be checked for their actual data processing and any external services. Using a plugin does not automatically mean that customer data is transferred to its manufacturer.

Retention depends on the purpose and the applicable statutory periods, particularly for invoicing and business records under Section 147 of the German Fiscal Code (AO) and Section 257 of the German Commercial Code (HGB). Under the relevant provision, the period generally begins at the end of the calendar year concerned. When the period ends, the data is deleted unless it is still needed for other permitted purposes, such as ongoing litigation.

Where required, project-related data processing on behalf of my clients is governed by a separate agreement under Article 28 GDPR. The AI or other service providers used in a client project are agreed for that project; the description of my AI services does not imply any automatic transfer of website visitor data.

7. AI and platform integrations on behalf of clients

If your company commissions an AI, Meta, or WhatsApp Business integration, access to the agreed accounts and systems occurs only after authorization by an authorized person. Simply visiting this website does not connect a business account or retrieve platform or conversation data.

Depending on the commission, company, portfolio, WhatsApp Business account, and asset IDs, permissions, configurations, approved knowledge content, and technical status and log data may be processed. Personal interaction or message content is included only where necessary for the agreed function and where its processing is permitted. The purposes are technical integration, provision, error analysis, quality assurance, and agreed further development.

Where I process personal data for a client business according to its instructions, that business remains responsible for the purposes and legal bases of its customer communications. Processing on behalf of the client is governed by an agreement under Article 28 GDPR. My own processing for inquiries, contract administration, and statutory obligations is described in the other sections. Granting technical account access does not replace a required legal basis for processing data about affected individuals.

The specific platform, hosting, and AI service providers used, the data transferred, storage locations, retention periods, and any transfers to third countries are determined before each use and documented in the required information and agreements. There is no blanket sharing of all content with all services offered. I do not sell platform data or use it for my own advertising, third-party marketing, profiling unrelated to the commission, or training my own general-purpose AI models.

The client business can revoke access it has granted in its platform or business settings. This does not automatically delete data already processed. Data is returned or deleted in accordance with the commission, instructions, and statutory retention obligations; access no longer needed is removed. For inquiries about access or deletion, you can reach me at info@chicidea.de. If an inquiry concerns data from communications with a client business, it will be handled in coordination with the responsible business.

8. Data recipients and protection

Only people and service providers who need data for the relevant purpose receive it. These may include hosting and email providers, commissioned technical support, tax advisors, payment service providers, and authorities where legally required. Processors are engaged in accordance with Article 28 GDPR. Specific additional project service providers are agreed before they are used.

The website is delivered over encrypted HTTPS. Access to administration is restricted. Even with appropriate protective measures, absolute security cannot be guaranteed in electronic communications. We agree on a suitable transmission channel for confidential documents.

I do not use the data described for solely automated decisions with legal or similarly significant effects within the meaning of Article 22 GDPR.

9. Your privacy rights

Subject to the statutory requirements, you have the right to access your personal data, rectification, erasure, restriction of processing, and data portability. You may withdraw consent at any time with effect for the future; this does not affect the lawfulness of prior processing.

Right to object: Where processing is based on Article 6(1)(f) GDPR, you may object on grounds relating to your particular situation. For direct marketing, you may object at any time without giving such grounds.

To exercise your rights, contact info@chicidea.de. You may also lodge a complaint with a data protection supervisory authority, particularly where you live, work, or suspect an infringement has occurred. The data protection supervisory authority of the state of Saxony-Anhalt is generally responsible for my business: datenschutz.sachsen-anhalt.de.

10. Updates to this notice

I update this notice when the actual features, service providers used, or legal requirements change. Services no longer used are not described as active processing. You can find the last update date at the top of this page.