Privacy Policy

1. Controller

The controller within the meaning of the General Data Protection Regulation (GDPR) and the Federal Data Protection Act (BDSG) is:

Manuel Beyer
c/o Impressumservice Dein-Impressum
Stettiner Str. 41
35410 Hungen
Germany

E-Mail: privacy@heymaru.com
Website: https://heymaru.com

The legal notice is available at: heymaru.com/imprint

2. General information and SSL/TLS encryption

This privacy policy informs you pursuant to Art. 13 and Art. 14 GDPR about the nature, scope and purpose of the processing of personal data on this website. Personal data means any information relating to an identified or identifiable natural person.

For security reasons and to protect the transmission of confidential content, this website uses SSL/TLS encryption. You can recognise an encrypted connection by the fact that the address line of the browser changes from "http://" to "https://" and by the lock symbol in your browser bar. When SSL/TLS encryption is activated, the data you transmit to us cannot be read by third parties.

Please note that data transmission over the Internet (e.g. when communicating by e-mail) may have security gaps. Complete protection of data against access by third parties is not possible.

3. Legal bases for processing

Art. 6 para. 1 GDPR provides six equivalent legal bases on which the processing of personal data may be based:

• Art. 6 para. 1 lit. a GDPR (Consent): The data subject has given consent to the processing of their personal data for one or more specific purposes.
• Art. 6 para. 1 lit. b GDPR (Contract performance): Processing is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract.
• Art. 6 para. 1 lit. c GDPR (Legal obligation): Processing is necessary for compliance with a legal obligation to which the controller is subject.
• Art. 6 para. 1 lit. d GDPR (Vital interests): Processing is necessary in order to protect the vital interests of the data subject or of another natural person.
• Art. 6 para. 1 lit. e GDPR (Public task): Processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller.
• Art. 6 para. 1 lit. f GDPR (Legitimate interests): Processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject.

Where we obtain consent for processing operations, Art. 6 para. 1 lit. a GDPR serves as the legal basis. For processing that is necessary to protect our legitimate interests, we rely on Art. 6 para. 1 lit. f GDPR and identify the specific interest in each relevant section.

4. Hosting and server operation

This website is hosted on a server in Germany. Hosting takes place on a server within the scope of the GDPR, so that no transfer of personal data to third countries is associated with this hosting.

When you access this website, the hosting provider technically processes the following data:

• IP address of the requesting device (personal data pursuant to ECJ, judgment of 19.10.2016, C-582/14)
• Date and time of access
• URL accessed (page/file)
• Volume of data transferred
• Notification of successful retrieval
• Browser type and version
• User's operating system
• Referrer URL (previously visited page)

Legal basis: Art. 6 para. 1 lit. f GDPR. Our legitimate interest lies in the stable and secure operation of the website and in the detection, defence against and investigation of attacks and misuse.

Where a data processing agreement pursuant to Art. 28 GDPR is required with the hosting provider, such an agreement has been or will be concluded.

Retention period: Server log files are generally stored for a period of up to 30 days and then deleted, unless there are specific indications of misuse that require longer retention.

5. Cookies and similar tracking technologies

This website uses cookies and similar technologies (e.g. local storage, pixels). Cookies are small text files stored on your device.

Note pursuant to § 25 TDDDG: The storing of information on your device and the reading of information already stored is generally only permitted with your explicit consent pursuant to § 25 para. 1 TDDDG. Exempt from this requirement pursuant to § 25 para. 2 TDDDG are strictly technically necessary cookies required to provide the service you have explicitly requested (e.g. session cookies for the basic functioning of the website).

This website uses Google Consent Mode v2. Analytics cookies are set to “denied” by default, meaning no analytics cookies are placed on your device and no personal data is transferred to Google Analytics without your consent. The analytics service therefore operates in a cookieless mode that processes only anonymised, aggregate signals. See Section 8 for full details.

6. Retention periods and deletion policy

We process and store personal data only for as long as is necessary to achieve the respective processing purpose or as required by statutory retention obligations. Relevant statutory retention periods arise in particular from:

• Commercial law retention obligations (§ 257 HGB): 6 years for commercial letters, 10 years for accounting records and inventories.
• Tax law retention obligations (§ 147 AO): up to 10 years.

The following indicative retention periods apply by data category:

• Server log files: up to 30 days after collection, then deletion or anonymisation.
• Contact enquiries (e-mail): data is deleted once the enquiry has been fully processed and no retention obligations apply, generally after no more than 3 years (standard civil law limitation period pursuant to §§ 195, 199 BGB).
• Newsletter subscriber data (e-mail address): stored for the duration of the newsletter subscription; deleted upon unsubscribing or on request.

Once the processing purpose ceases to apply and any statutory retention periods have expired, the data will be routinely deleted or stored in a form that no longer permits identification of a specific individual.

7. Transfers to third countries

Some services used on this website transfer data to the USA. The relevant transfers and their legal bases are:

• Google Analytics 4 / Google Search Console (Google LLC, USA): In the Consent Mode v2 configuration we use, analytics cookies are denied by default and no personal data is transferred to Google Analytics. Should consent be granted in the future, transfers would be covered by the EU-US Data Privacy Framework (adequacy decision of the European Commission of 10 July 2023).
• Brevo (Newsletter) (Brevo GmbH, trading as “Brevo”, Germany): Transfers are covered by the EU-US Data Privacy Framework or, alternatively, by standard contractual clauses pursuant to Art. 46 para. 2 lit. c GDPR.

If additional services requiring third-country transfers are introduced in the future, they will be documented separately in this privacy policy.

8. Google Analytics 4 and Google Search Console

8.1 Google Analytics 4

This website uses Google Analytics 4 (GA4), a web analytics service provided by Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA.

We use GA4 with Google Consent Mode v2 configured to set analytics_storage to “denied” by default. No analytics cookies are placed on your device and no personal data (including IP address) is transmitted to Google Analytics. GA4 in this mode receives only anonymised, aggregated signals that cannot be attributed to any individual visitor. We have additionally disabled Google Signals and ad personalisation features.

Purpose: Obtaining statistical insights into website usage (pages visited, referral sources, session duration) in aggregated, non-personal form to improve content and user experience.

Legal basis: Art. 6 para. 1 lit. f GDPR. Our legitimate interest lies in understanding website usage to improve our content. Because Consent Mode v2 prevents processing of personal data by default, this interest is not overridden by any data subject rights or freedoms.

Further information: policies.google.com/privacy

8.2 Google Search Console

This website is registered with Google Search Console (Google LLC, USA), a tool that allows website operators to monitor their site's presence in Google Search. Google Search Console processes technical data about indexed pages and aggregate search performance metrics. No personal data of individual website visitors is transmitted to Google Search Console.

Legal basis: Art. 6 para. 1 lit. f GDPR. Our legitimate interest lies in monitoring and improving the discoverability of this website in search engines.

9. Newsletter (Brevo)

You can subscribe to our newsletter on this website. We use Brevo, a service provided by Brevo GmbH, trading as “Brevo”, Köpenicker Straße 126, 10179 Berlin, Germany, to manage subscriptions and send the newsletter.

When you subscribe, you provide your e-mail address, which is transmitted to and stored by Brevo for the purpose of managing the subscription and sending the newsletter.

Double opt-in: After submitting your e-mail address, you will receive a confirmation e-mail. Your subscription is activated only after you click the confirmation link in that e-mail. This ensures that no third party can subscribe using your e-mail address without your knowledge.

Legal basis: Art. 6 para. 1 lit. a GDPR (consent). You may withdraw your consent at any time by clicking the unsubscribe link in any newsletter e-mail or by contacting us at privacy@heymaru.com. Withdrawal does not affect the lawfulness of processing carried out prior to withdrawal.

Retention: Your e-mail address is stored for the duration of your newsletter subscription and deleted upon unsubscribing or on request.

Further information: brevo.com/legal/privacypolicy

10. Data subject rights

As a data subject, you have the following rights against the controller. To exercise your rights, please contact the e-mail address provided in the "Controller" section above.

8.1 Right of access (Art. 15 GDPR)

You have the right to obtain confirmation as to whether we are processing personal data relating to you. If so, you have the right of access to that data and to further information, including the purposes of processing, the categories of data, recipients, planned retention period, origin of the data and the existence of automated decision-making.

8.2 Right to rectification (Art. 16 GDPR)

You have the right to obtain without undue delay the rectification of inaccurate personal data concerning you. Taking into account the purposes of the processing, you also have the right to have incomplete personal data completed.

8.3 Right to erasure (Art. 17 GDPR)

You have the right to obtain the erasure of personal data concerning you without undue delay, where one of the grounds listed in Art. 17 para. 1 GDPR applies (e.g. the purpose of processing has ceased, consent has been withdrawn, data has been unlawfully processed) and no exception under Art. 17 para. 3 GDPR applies (e.g. a statutory retention obligation).

8.4 Right to restriction of processing (Art. 18 GDPR)

You have the right to obtain restriction of processing where one of the conditions in Art. 18 para. 1 GDPR is met, e.g. if you contest the accuracy of the data or the processing is unlawful and you request restriction rather than erasure.

8.5 Right to data portability (Art. 20 GDPR)

You have the right to receive personal data concerning you that you have provided to us in a structured, commonly used and machine-readable format, and you have the right to transmit that data to another controller, where the processing is based on consent (Art. 6 para. 1 lit. a GDPR) or on a contract (Art. 6 para. 1 lit. b GDPR) and the processing is carried out by automated means.

8.6 Right to withdraw consent (Art. 7 para. 3 GDPR)

Where processing is based on consent, you have the right to withdraw your consent at any time. Withdrawal of consent does not affect the lawfulness of processing based on consent before its withdrawal. Consents relating to cookies and tracking technologies can be withdrawn at any time via the consent management tool used on this website.

8.7 Right to object (Art. 21 GDPR)

You have the right to object at any time, on grounds relating to your particular situation, to processing of personal data concerning you which is based on Art. 6 para. 1 lit. e or lit. f GDPR, including profiling based on those provisions. The controller shall no longer process the personal data unless it can demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms, or the processing is for the establishment, exercise or defence of legal claims (Art. 21 para. 1 GDPR).

Where personal data are processed for direct marketing purposes, you have the right to object at any time to the processing of personal data concerning you for such marketing, including profiling to the extent that it is related to such direct marketing. If you object to processing for direct marketing purposes, the personal data shall no longer be processed for such purposes (Art. 21 para. 2 GDPR).

11. Right to lodge a complaint with a supervisory authority (Art. 77 GDPR)

Without prejudice to any other administrative or judicial remedy, you have the right to lodge a complaint with a supervisory authority, in particular in the Member State of your habitual residence, place of work or place of the alleged infringement, if you consider that the processing of personal data relating to you infringes the GDPR.

The controller is domiciled in Hungen (Hesse, Germany). The competent supervisory authority is therefore:

The Hessian Commissioner for Data Protection and Freedom of Information (HBDI)
Gustav-Stresemann-Ring 1
65189 Wiesbaden, Germany
Phone: +49 611 1408-0
E-Mail: poststelle@datenschutz.hessen.de
Website: https://datenschutz.hessen.de

12. Automated decision-making and profiling (Art. 22 GDPR)

We do not use automated decision-making including profiling within the meaning of Art. 22 GDPR. No decisions are made that are based solely on automated processing — including profiling — and that produce legal effects concerning you or similarly significantly affect you.

13. Currency and changes to this privacy policy

This privacy policy reflects the current legal position and was last revised in 21 August 2026. As this website continues to develop or due to changes in legal or regulatory requirements, it may become necessary to update this privacy policy. The current version of the privacy policy is available at any time on this website at https://heymaru.com.

Last updated: 21 August 2026