Privacy policy

The controller within the meaning of the General Data Protection Regulation (GDPR) is:

Name

Florida Hasani

Address

Legienstrasse 3, 51063 Cologne-Mülheim, Germany

Email

willkommen@floridahasani.com

Phone

+49 1578 5110135

No data protection officer has been designated.

Personal data are only collected to the extent necessary to provide information about the childcare offered, to initiate and perform a childcare contract, or to comply with legal obligations. No more data are collected than necessary (principle of data minimisation, Art. 5 (1) (c) GDPR).

This website is transmitted in encrypted form via HTTPS/TLS. Personal data are never sold to third parties.

This website runs on a Hostinger VPS in Frankfurt am Main, Germany. The underlying hosting account identifies Hostinger International Ltd., Cyprus, as the invoice issuer. Booking data and necessary processing and evidence records are stored in its database.

Technical connection and security data, in particular the requesting IP address and necessary request, time and technical result information, are processed to deliver the website and prevent abuse. Authorised persons may review necessary operational and error logs. The legal basis is Art. 6 (1) (f) GDPR, the legitimate interest in secure and reliable operation.

Application and proxy logs rotate by file size, with up to three files of around 10 MB each. A storage limit and a 30-day retention limit are configured for the system journal; forwarded entries may remain in other system logs. Authentication logs rotate weekly, with four archives in addition to the active file. These rules are not a uniform deletion period for all logs.

The hosting plan includes daily VPS backups; Lithuania is shown in the account as the storage location of existing backup copies.

If you contact us by email or telephone, we process your contact details and enquiry to respond and handle necessary follow-up questions. The legal basis is Art. 6 (1) (b) GDPR for pre-contractual or contractual matters, otherwise Art. 6 (1) (f) GDPR, the legitimate interest in responding to enquiries.

We use the configured Spacemail mailbox from Spaceship, Inc., USA, for email communication and necessary booking messages. Messages and required attachments may be processed by the mailbox provider and your email provider. Spaceship’s general privacy policy states that processing takes place on US servers.

Details are stored when a booking request is created; successful payment is not required for storage. The form processes the following data:

• name, email address and telephone number of the booking person
• care type, dates, location and number of children
• the family’s address for care at their home; an additional billing address is optional
• optional ages of the children and voluntary organisational notes
• calculated price, language and required acknowledgements, including any request for care to begin before the withdrawal period ends

For booking, confirmation, withdrawal, cancellation and any refund, we retain necessary declarations, timestamps, reference identifiers, protected access links, processing status and message status. Booking data are stored on the Hostinger VPS. Necessary messages may contain booking details and an invoice attachment where applicable. Acceptance by a mail server does not prove receipt in the destination mailbox.

Data of the booking person are processed under Art. 6 (1) (b) GDPR to arrange and perform the childcare contract. Necessary ordinary information about children is processed under Art. 6 (1) (f) GDPR to prepare safe, suitable care, taking particular account of children’s interests and rights. Legally required records are processed under Art. 6 (1) (c) GDPR.

Please do not enter health, allergy or medication information in the website form. We discuss what is needed for safe care personally before care begins. Before specifically processing or recording such information, we clarify what is necessary, who can give consent and the required explicit consent. This form does not obtain online consent for health information.

Only adult legal guardians or persons authorised by them may book through the form. The free-text field does not technically prevent unsolicited sensitive information from being submitted; such information is treated confidentially and handled only as necessary.

Online payments through Stripe and PayPal are not enabled yet. When a payment method is offered later, payment will take place through a redirect to the respective payment provider. A booking request may be stored beforehand without payment.

A later payment involves the data needed to allocate and process it, in particular amount, currency, booking reference, service description and status and return references. Stripe also receives the email address for checkout. Card, bank or PayPal login details are not requested in the booking form. The website stores the payment and refund references and processing status it needs.

The legal bases are Art. 6 (1) (b) GDPR for contract performance and Art. 6 (1) (c) GDPR for legally required records. Payment providers also process data for their own purposes under their privacy notices: stripe.com/privacy and paypal.com/de/legalhub/paypal/privacy-full.

The website does not use analytics or advertising trackers. Depending on your language choice, the NEXT_LOCALE session cookie may remember your language. The protected admin area uses necessary security and session cookies; an admin session is limited to eight hours. These functions support your requested language and secure access; the necessary device access is covered by Section 25 (2) no. 2 TDDDG.

Font files are served by this website; your browser does not need to retrieve them from Google. Before additional non-essential services are introduced, their privacy and any consent requirements will be reviewed separately.

Access is limited to Florida and authorised persons and service providers who need it to handle matters or operate the service. For the stated purposes, data may in particular be processed by:

• Hostinger for VPS hosting in Frankfurt am Main and VPS backup copies in Lithuania
• Spaceship, Inc. (USA) as the configured Spacemail mailbox provider and the providers involved in delivering messages
• the payment providers actually used if online payments are enabled in future
• authorised tax advisers and tax authorities where needed for legal obligations
• other authorities or bodies where required by law or another applicable legal basis

Hostinger’s and Spaceship’s general data processing agreements provide for EU standard contractual clauses for international data transfers. The Frankfurt server location does not mean that all processing takes place exclusively in Germany or the EU.

We retain personal data only as long as needed for its purpose or legal obligations. Copies of invoices and accounting vouchers generally require eight years of retention; other tax-related documents may require six or ten years depending on their category. The period generally starts at the end of the relevant calendar year. These duties apply to necessary records, not indiscriminately to all booking details, child data or care notes. Records relating to unresolved payments, refunds or disputes are retained as far as needed to resolve the matter or establish legal claims.

• Art. 6 (1) (a) and, where applicable, Art. 9 (2) (a) GDPR — separately required valid consent, explicit for health data; not inferred merely from voluntary free-text entries
• Art. 6 (1) (b) GDPR — initiation and performance of the childcare contract, including booking and payment
• Art. 6 (1) (c) GDPR — compliance with legal obligations, in particular tax retention obligations
• Art. 6 (1) (f) GDPR — legitimate interests, in particular secure operation of the website and responding to general enquiries

You have the following rights vis-à-vis the controller:

• access to the data stored about you (Art. 15 GDPR)
• rectification of inaccurate or incomplete data (Art. 16 GDPR)
• erasure of your data, unless retention obligations apply (Art. 17 GDPR)
• restriction of processing (Art. 18 GDPR)
• data portability in a structured, commonly used format (Art. 20 GDPR)
• objection to processing based on legitimate interests (Art. 21 GDPR)
• withdrawal of consent with effect for the future (Art. 7 (3) GDPR)
• lodging a complaint with a data protection supervisory authority (Art. 77 GDPR)

An informal message to the contact details above is sufficient to exercise these rights. The competent supervisory authority is the State Commissioner for Data Protection and Freedom of Information of North Rhine-Westphalia, Kavalleriestrasse 2-4, 40213 Düsseldorf, Germany.

Providing your data is neither legally nor contractually required. However, without the information required for a booking, a childcare contract cannot be concluded and the care cannot be carried out safely.

This privacy policy will be updated when actual processing or the law changes. The version published on this page is the applicable one.