# Privacy policy

> Legally binding version is the German HTML at https://scentral-park.com/datenschutz. Last updated: 2026-08-22.

## 1. Controller

Exaptation GmbH, Osterbrooksweg 35–41, 22869 Schenefeld, Germany, represented by Managing Director Lasse Alexandros Diercks. Contact: legalexap.product172@passmail.net.

## 2. Data protection officer

Not required per § 38 BDSG. Data protection requests: the email address above.

## 3. Data collected when you visit

Server access logs record IP address, request timestamp, requested URL, HTTP status, bytes transferred, referer and user agent. Purpose: operate, troubleshoot and defend the site. Legal basis: Art. 6(1)(f) GDPR (legitimate interest). Retention: up to 14 days (`MaxRetentionSec=14d` enforced via node-level systemd-journald drop-in).

## 4. Cookies

Exactly one strictly necessary cookie: `country` (HttpOnly, Secure, SameSite=Lax, 365 days) remembering your country filter. Legal basis: § 25(2) no. 2 TDDDG. No tracking, no analytics, no behavioural profiling.

## 5. Processors and recipients

- **Hetzner Online GmbH** (Gunzenhausen, Germany) — VM hosting. AVV per Art. 28 GDPR (auto per AGB).
- **Internet Security Research Group (Let's Encrypt)** (USA) — TLS certificate issuance. Only domain names transmitted. SCCs.
- **BunnyWay d.o.o. (Bunny Fonts)** (Slovenia) — web font delivery. Legal basis: Art. 6(1)(f) GDPR.
- **Image CDNs of listed suppliers** — product images load directly from each supplier's CDN (Shopify Inc., Canada + Ireland — DPF; BigCommerce Inc., USA — DPF; some Cloudflare-fronted, USA — DPF). Browser transmits IP + UA to the CDN for image display. Legal basis: Art. 6(1)(f) GDPR. Third-country transfer under EU-US Data Privacy Framework + SCCs. Objection per Art. 21 GDPR possible.

No sale or advertising sharing.

## 6. Your rights

Under the GDPR: access (Art. 15), rectification (16), erasure (17), restriction (18), portability (20), and lodging a complaint with the competent supervisory authority — for us, the Independent State Centre for Data Protection Schleswig-Holstein (ULD), Holstenstraße 98, 24103 Kiel, datenschutzzentrum.de.

**Right to object (Art. 21 GDPR).** You may object, on grounds relating to your particular situation, to processing based on Art. 6(1)(f) — in particular the image-CDN delivery (section 5) and access logs (section 3). Informal email to the imprint address suffices; you may also block image loading for scentral-park.com in your browser.

Response time: statutory one-month period (Art. 12(3) GDPR).

## 7. Changes

We update this policy when data processing changes. Current version dated above.