Privacy Policy

This English version is provided for convenience. Only the German version is legally binding.

1. Controller

The controller responsible for the processing of personal data on this website (himmelfreund.de, himmelfreund.com, himmelfreund.net), on himmelmail.de and in the Himmelmail e-mail service within the meaning of the General Data Protection Regulation (GDPR, DSGVO) is:

Himmelfreund DP GmbH
Wilhelmstraße 32
51379 Leverkusen
Germany

Represented by its managing director (Geschäftsführer) Marco Antonio Di Prato
Phone: +49 (0)214 76073983
E-mail: datenschutz@himmelfreund.de
Register court: Local Court (Amtsgericht) Cologne, HRB 108115
VAT ID: DE359534246

Data protection officer

We have appointed a data protection officer (Datenschutzbeauftragter):

Mr. Maximilian Klaus
c/o Himmelfreund DP GmbH
Wilhelmstraße 32
51379 Leverkusen
E-mail: datenschutz@himmelfreund.de

2. General information

We only process personal data insofar as this is necessary to provide our website, to deliver our services (web hosting, domains, servers, software, AI solutions) or on the basis of your consent.

Legal bases

Storage period

We delete personal data as soon as the purpose no longer applies and there is no retention obligation. We keep invoices and accounting records for eight or ten years in accordance with § 147 of the German Fiscal Code (Abgabenordnung, AO) and § 257 of the German Commercial Code (Handelsgesetzbuch, HGB), and commercial and business letters for six years. We delete customer data after the end of the contract unless such an obligation prevents this.

3. Hosting and server log files

This website runs on Himmelfreund DP GmbH’s own servers. The servers are located in our own data center and in a rented data center (colocation), both in Germany. No data is transferred to an external hosting provider. The operator of the rented data center only provides space, power and network connectivity and has no access to the stored data.

By way of exception, our e-mail service Himmelmail and the website himmelmail.de run on a rented server at Hetzner Online GmbH (see section 7).

When you visit the website, the server automatically stores the following data in log files:

• IP address of the requesting device
• date and time of access
• page or file accessed and amount of data transferred
• HTTP status code
• referrer URL (previously visited page)
• browser type, browser version and operating system

The processing serves to deliver the website, to keep it stable and to fend off attacks. The legal basis is Art. 6(1)(f) GDPR. The log files are deleted or anonymized after 14 days, unless a security incident requires longer retention.

4. Website use, contact and customer account

Cookies

Our website and our customer center use technically necessary cookies, for example for the session, the shopping cart, the language selection and the login. The legal basis is § 25(2) of the German Telecommunications Digital Services Data Protection Act (TDDDG) in conjunction with Art. 6(1)(b) and (f) GDPR. These cookies are deleted at the latest when you close the browser or when the session expires.

We only set non-essential cookies with your consent via our cookie banner (§ 25(1) TDDDG, Art. 6(1)(a) GDPR). You can withdraw your consent at any time via the “Cookie settings” link in the footer.

Visitor statistics

To evaluate and improve the use of our website, we keep visitor statistics. We run the statistics ourselves on our own servers; the data is not passed on to third parties. We record the pages accessed, date and time, referrer, browser, operating system and a truncated IP address. The statistics only run with your consent via the cookie banner (§ 25(1) TDDDG, Art. 6(1)(a) GDPR).

Google Analytics and Google Tag Manager

In addition, with your consent to the cookie category “Analytics”, we use Google Tag Manager and Google Analytics 4. The provider for users in the EU is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (“Google”).

Google Tag Manager is a tool we use to manage measurement codes on our website. It does not set any cookies itself and does not evaluate any user data. When it loads, however, a connection to Google’s servers is established and your IP address is transmitted. We therefore only load Tag Manager once you have given your consent.

Google Analytics helps us understand how visitors use our website so that we can improve our content and offers. For this purpose, the following data, among other things, is processed:

• pages accessed, time spent, clicks and scroll depth
• origin of the visit (e.g. search engine or linking website)
• approximate location (country, region, city), derived from the IP address
• technical information such as browser, operating system, screen resolution and device type
• a random identifier (client ID) used to recognize repeat visits

In Google Analytics 4, IP addresses from the EU are not stored; they are only used briefly to determine the approximate location. We cannot identify you personally from this data and do not combine it with other data, such as your customer account. Google Signals and advertising features are disabled in our Analytics account.

Google Analytics sets the following cookies:

The data collected is automatically deleted in Google Analytics after 14 months.

The legal basis is your consent under Art. 6(1)(a) GDPR and § 25(1) TDDDG. Without your consent, neither Google Tag Manager nor Google Analytics is loaded. We have concluded a data processing agreement with Google under Art. 28 GDPR. It cannot be ruled out that data is transferred to Google LLC in the USA; Google LLC is certified under the EU-US Data Privacy Framework (adequacy decision under Art. 45 GDPR).

You can withdraw your consent at any time via “Cookie settings” in the footer. Google Analytics will then no longer be loaded, and the Analytics cookies in your browser will be deleted. More information: policies.google.com/privacy

Contact by e-mail, phone or form

When you contact us, we process the information you provide (name, e-mail, phone number, message) to handle your request. The legal basis is Art. 6(1)(b) GDPR for contract-related requests, otherwise Art. 6(1)(f) GDPR. We delete the data once your request has been fully dealt with, unless there is a retention obligation.

Customer account, orders and support

To place orders and process contracts, you create a customer account. In doing so, we process your name, company, address, e-mail, phone number, payment and billing data, contract and usage data as well as support requests (tickets). The legal basis is Art. 6(1)(b) and (c) GDPR.

For nonprofit organizations and clubs, we check proof of eligibility for the club discount (tax exemption notice (Freistellungsbescheid) or articles of association (Vereinssatzung)), which you send by e-mail to charity-start@himmelfreund.de. We store it for the duration of the contract and the retention period required under tax law.

Remote maintenance

For setup, migration or support, we use remote maintenance via AnyDesk, TeamViewer or Zoom at your request. In doing so, we can see the content of your screen. The session only starts once you actively grant access; we do not record it. The legal basis is Art. 6(1)(b) GDPR. The providers process connection data under their own responsibility or as processors; their privacy notices also apply.

Partner program

If you take part in our partner program, we process your master data, your bank details for commission payouts and the orders referred via your partner link. To attribute referrals, we set a cookie with a lifetime of 90 days with your consent. The legal basis is Art. 6(1)(b) GDPR, and for the tracking cookie § 25(1) TDDDG and Art. 6(1)(a) GDPR.

5. Payment, domains and our customers’ data

Payment service providers

To process payments, we pass the necessary payment data on to the payment service provider you have chosen. The legal basis is Art. 6(1)(b) GDPR.

For SEPA direct debits, we process the account holder, IBAN and mandate reference and transmit them to our bank for collection.

Stripe and PayPal may transfer data to their parent companies in the USA (Stripe, Inc. and PayPal, Inc. respectively). Both are certified under the EU-US Data Privacy Framework; standard contractual clauses also apply. Both providers also process payment data for fraud prevention under their own responsibility.

Domain registration

If you register a domain through us, we transmit the registrant data (name, address, e-mail, phone) to the responsible registry, e.g. DENIC eG for .de domains, and, where applicable, to an ICANN-accredited registrar. This is strictly necessary for the registration (Art. 6(1)(b) GDPR). For generic and some country-code extensions, the registry may be located outside the EU; the transfer then takes place under Art. 49(1)(b) GDPR for the performance of the contract. Whether registrant data appears publicly in WHOIS or RDAP depends on the rules of the respective registry.

Data on hosted services

We process data that you or your users store on web space, servers or in e-mail mailboxes with us as a processor under Art. 28 GDPR. You, as the customer, are the controller for this data. We provide the data processing agreement (Auftragsverarbeitungsvertrag) for download in the customer center. This privacy policy does not apply to such data.

6. Third-party services, recipients and third countries

Embedded services

With the exception of Google Tag Manager and Google Analytics, which are only loaded with your consent (see section 4), we do not embed any third-party services on our website. We run forms, fonts and all other features ourselves on our own servers. Without your consent, no data is therefore transferred to third-party providers when you visit the website.

Recipients

Your data is only received by parties that need it for the purposes stated: our employees, registries and registrar partners, payment service providers, our tax advisor, for Himmelmail our data center operator Hetzner (as a processor) and authorities, insofar as there is a legal obligation. We use external service providers as processors under Art. 28 GDPR.

Transfers to third countries

Data is only transferred to countries outside the EU or the EEA if there is an adequacy decision (e.g. the EU-US Data Privacy Framework for certified US providers), standard contractual clauses have been agreed or an exception under Art. 49 GDPR applies.

7. Himmelmail (himmelmail.de)

The information in this privacy policy applies to our e-mail service Himmelmail and the website himmelmail.de, with the following specifics.

Hosting

Himmelmail and the website himmelmail.de run on a dedicated server that we rent from Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany. The server is located in a data center in Germany. We operate it ourselves; Hetzner provides the hardware, power and network connectivity. The server’s storage media are fully encrypted. Insofar as Hetzner may come into contact with personal data in this context, Hetzner is our processor under Art. 28 GDPR. Section 3 applies accordingly to the server log files of himmelmail.de (deletion after 14 days).

Website himmelmail.de

The website himmelmail.de does not set any cookies, does not collect visitor statistics and does not embed any third-party services – no analytics tools, no external fonts, no scripts. The information in section 4 on cookies, visitor statistics and Google Analytics does not apply to himmelmail.de.

Webmail (webmail.himmelmail.de), the customer area (kunden.himmelmail.de) and the sign-in page (sso.himmelmail.de) set technically necessary cookies for sign-in and the session (§ 25(2) TDDDG in conjunction with Art. 6(1)(b) and (f) GDPR). They are deleted when you sign out or when the session expires.

Mailbox contents

We process e-mails, calendars, contacts and other data in Himmelmail mailboxes as a processor (see section 5, “Data on hosted services”). For church customers, we also conclude the data processing agreement under the Catholic Church Data Protection Act (KDG) or the Data Protection Act of the Protestant Church in Germany (DSG-EKD).

Spam and virus checks

Incoming and outgoing e-mails are automatically checked for spam and malware. Sender, recipient, subject, content and attachments are analyzed by machine; staff do not read them in the process. The legal basis is Art. 6(1)(b) and (f) GDPR.

Mail traffic logs

For delivery, troubleshooting and abuse prevention, our mail servers log connection data (IP addresses of the servers involved, sender and recipient address, time, size, result of the spam check, delivery status), but not the content of the messages. The legal basis is Art. 6(1)(b) and (f) GDPR. The logs are deleted after 30 days.

Access by AI assistants (MCP)

If you connect an AI assistant to your mailbox via our MCP server, we transmit the content that the assistant retrieves within the scope of your authorization to the provider of the assistant. This only happens on your express instruction and only to the extent you specify; you can revoke the authorization at any time in the customer area. The provider of the assistant is responsible for any further processing; its privacy notices apply. If the provider is located outside the EU or the EEA, the transfer takes place on your instruction for the performance of the contract.

8. Your rights

You have the right at any time to:

• access to your stored data (Art. 15 GDPR)
• rectification of inaccurate data (Art. 16 GDPR)
• erasure (Art. 17 GDPR)
• restriction of processing (Art. 18 GDPR)
• data portability (Art. 20 GDPR)
• withdrawal of consent with effect for the future (Art. 7(3) GDPR)

Right to object (Art. 21 GDPR): If we process your data on the basis of a legitimate interest (Art. 6(1)(f) GDPR), you can object at any time on grounds relating to your particular situation. You can object to direct marketing without giving reasons.

To exercise your rights, a message to the contact details given in section 1 is sufficient.

Right to lodge a complaint

You can lodge a complaint with a data protection supervisory authority. The authority responsible for us is:

Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen (LDI NRW; State Commissioner for Data Protection and Freedom of Information of North Rhine-Westphalia)
Kavalleriestraße 2–4
40213 Düsseldorf
www.ldi.nrw.de

SSL/TLS encryption

For security reasons, this website uses SSL or TLS encryption. You can recognize an encrypted connection by “https://” and the padlock icon in your browser.

Obligation to provide data

For a contract with us, we need the data marked as mandatory fields in the ordering process. Without it, we cannot conclude the contract. There is no automated decision-making, including profiling, under Art. 22 GDPR.

Changes

We update this privacy policy when our services or the legal situation change. The version published here at any given time applies.

Last updated: November 2026