Privacy Policy

The following privacy policy provides you with information about the nature, scope, and purposes of the collection and use of personal data when using this website, as well as your rights.

I. Controller for data processing (hereinafter referred to as "we")

OF Princess Agency Bianchi & Weber GbR Mühldorfstraße 8
81671 München

Contact
Email: info@of-princess-agency.com

For further details, please refer to our provider identification.

II. Personal data, purposes of processing, and legal bases

Personal data refers to any information relating to an identified or identifiable natural person (hereinafter referred to as the "data subject"). An identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier, or one or more specific characteristics expressing the identity of the natural person.

Personal data is processed on our website when it is necessary for the following purposes:

Based on your request and given consent (Legal basis: Article 6(1)(a) of the General Data Protection Regulation – GDPR) For the use of the website (Legal basis: Article 6(1)(b) GDPR) To safeguard our legitimate interests in improving user experience, promoting our services, and maintaining the security of the website (Legal basis: Article 6(1)(f) GDPR) For the use of services offered on the website and for pre-contractual measures, particularly for handling your inquiries (Legal basis: Article 6(1)(a) and/or Article 6(1)(b) GDPR) For the performance of a contract and contract fulfillment (Legal basis: Article 6(1)(b) GDPR) and/or To fulfill a legal obligation to which we are subject (such as tax regulations and retention obligations, Legal basis: Article 6(1)(c) GDPR)für die Nutzung der Website (Rechtsgrundlage: Artikel 6 Absatz 1 Unterabsatz 1 Buchstabe b DSGVO) zur Wahrung unseres Interesses an der Verbesserung der Nutzererfahrung, Bewerbung unserer Leistungen und der Aufrechterhaltung der Sicherheit der Nutzung (Rechtsgrundlage: Artikel 6 Absatz 1 Unterabsatz 1 Buchstabe f DSGVO) für die Nutzung der auf der Website angebotenen Leistungen sowie für vorvertragliche Maßnahmen, insbesondere etwa für Ihre Anfragen (Rechtsgrundlage: Artikel 6 Absatz 1 Unterabsatz 1 Buchstabe a und/ oder Artikel 6 Absatz 1 Unterabsatz 1 Buchstabe b DSGVO) für einen Vertragsabschluss und für die Vertragsdurchführung (Rechtsgrundlage: Artikel 6 Absatz 1 Unterabsatz 1 Buchstabe b DSGVO) und/oder zur Erfüllung einer rechtlichen Verpflichtung, der wir unterliegen (etwa steuerrechtliche Vorgaben und Aufbewahrungspflichten, Rechtsgrundlage: Artikel 6 Absatz 1 Unterabsatz 1 Buchstabe c DSGVO)

Further details on data processing can be found under the respective headings:

1. Access data / Server log files

When you visit our website, the servers of our website host automatically store the information sent by your browser, known as server log files. The information includes the following:

Referrer (previously visited website) Requested webpage or file Browser type and version Operating system used Device type used Access time IP address in anonymized form (used only to determine the location of access)

The temporary processing of this data by the system is necessary to enable the delivery of the website to your device. In particular, the IP address must be processed for this purpose. This data is not merged with other data sources. The information is used solely to control website traffic and to maintain the technical operation of the servers and network of our website host, as well as for preventing abuse. The legal basis for this processing is Article 6(1)(f) GDPR.

2. Cookies

Our website uses cookies or other technologies, especially those that are strictly necessary or functional cookies, in order to provide you with the requested website and its functions, § 25(2)(2) of the Telecommunications and Telemedia Data Protection Act (TTDSG), Article 6(1)(f) GDPR.

The following required / functional cookies are set:

Name: ofprincessagency_session Anbieter/Domain: of-princess-agency.de Purpose: Session cookie, browser session identification (necessary) Duration: 2 hours

Name: XSRF-TOKEN Anbieter/Domain: of-princess-agency.de Purpose: Security aspect, protection against CSRF attacks (necessary) Duration: 2 hours

Name: styleCookieName Anbieter/Domain: of-princess-agency.de Purpose: Storage of the theme (light/dark) (preference) Duration: 1 week

Most browsers also have an option to restrict or completely prevent the storage of cookies. However, it should be noted that the use and, in particular, the user experience may be limited without cookies.

Instructions for the most common browsers:

Mozilla Firefox, Google Chrome, Apple Safari, Microsoft Edge

3. Contact via email, forms, or other means

If you contact us via email, contact forms, or other means, the information you provide (such as name, email address, message) including the data you provide and additional data (IP address, time, privacy notice) will be processed for the purpose of handling your inquiry and, if necessary, for follow-up questions. The legal basis for this processing is Article 6(1)(b) GDPR.

If you have given your consent, the legal basis is Article 6(1)(a) GDPR and Article 9(2)(a) GDPR for special categories of personal data, depending on the individual case.

If you use our application form for collaboration, we collect the following data: name, email, telephone, date of birth, information about social media usernames and previous experience on these platforms, message, IP address, privacy notice, time, and any individual messages you provide. The legal basis is Article 6(1)(b) GDPR and/or Article 6(1)(a) GDPR and Article 9(2)(a) GDPR.

4. Services and Content from Third Parties

Below, we include or link to the following services and content from third parties:

Social Media

We use social media platforms to promote and present our services and products, and to establish our presence. The legal basis for data processing by the providers can be found in their respective privacy policies:

Twitter: Twitter International Company, One Cumberland Place, Fenian Street, Dublin 2 D02 AX07, Ireland, Parent Company: Twitter Inc., 1355 Market Street, Suite 900, San Francisco, CA 94103, USA; Privacy Policy: https://twitter.com/privacy; Imprint: https://legal.twitter.com/de/imprint; Standard Contractual Clauses (ensuring an adequate level of data protection for transfers to third countries): https://gdpr.twitter.com/en/controller-to-controller-transfers.html;Datenschutzhinweise: https://twitter.com/privacy; Impressum: https://legal.twitter.com/de/imprint; Standarddatenschutzvertragsklauseln (Gewährleistung Datenschutzniveau bei Verarbeitung in Drittländern): https://gdpr.twitter.com/en/controller-to-controller-transfers.html;

Instagram:
Meta Platforms Ireland Ltd., 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland; Privacy Policy: https://www.facebook.com/help/instagram/155833707900388; Imprint: https://help.instagram.com/581066165581870/;

When you click on a social media icon on our site, you will leave our website and establish a connection to these third-party providers in a separate tab or window. We refer you to their respective privacy policies. Please note that data may be processed outside the European Union, as described in the section on international transfers below. This may entail risks, such as making it more difficult to enforce the rights of users. If you wish to exercise your rights as a data subject, it is most effective to address the respective platform provider. However, you can also contact us regarding our profiles.

WhatsApp Business API

If you contact us via the WhatsApp Business API, you will leave our service and use the service provided by WhatsApp LLC, 1601 Willow Road, Menlo Park, California 94025, USA.

When you contact us via WhatsApp, we use your phone number to communicate with you. Additionally, we process other personal data stored by WhatsApp or provided by you during communication, including your first and last name, device information, message content, read receipts, profile picture, and messages and files you send through the app.

WhatsApp collects data independently. Please refer to WhatsApp's privacy policy for the purpose and scope of data collection by WhatsApp, further processing of your data by WhatsApp, and your rights and privacy settings: https://www.whatsapp.com/legal/privacy-policy-eea or directly in the WhatsApp app.

Please note that when using WhatsApp, data may be processed outside the European Union, as described in the section on international transfers below. This may entail risks, such as making it more difficult to enforce the rights of users. If you wish to exercise your rights as a data subject, it is most effective to address the respective platform provider. However, you can also contact us regarding our profiles.

We process the personal data you provide (such as name, phone number, email address, messenger ID, profile picture, message content) for communication purposes, preparation and execution of any contractual relationship, and sending promotional information (e.g., offers) to you using the communication channel you have chosen. To use the communication channels, an existing WhatsApp account is required. The legal basis for our processing is Article 6(1)(a), (b), and/or (f) of the GDPR.

5. Applications

If you send us an application, we will process the personal data provided there to handle your application and get in touch with you. The personal data concerning you will not be disclosed to third parties without your explicit consent unless we are legally obligated to do so, you have requested it, or the data disclosure is necessary for establishing or conducting a contractual relationship with you or for the application process. The legal basis for this processing is Article 6(1) subparagraph 1 letters a, b GDPR, Article 88(1) GDPR, § 26(1) Federal Data Protection Act (BDSG).”

III. Recipients of personal data and transfers to third countries

Personal data will be disclosed to the following categories of recipients:

Our employees, as well as our data processors to the extent necessary, especially the website and hosting provider of our website: DigitalOcean LLC 101 Avenue of the Americas, 10th Floor New York 10013 United States and, if applicable, their respective subprocessors, as well as when using the website, individual designated service providers as mentioned above under II. 4.

In addition, your personal data will not be disclosed to third parties without your express consent, unless we are legally obligated to do so or the data disclosure is necessary to fulfill a contractual relationship.

Furthermore, we process personal data in a third country (i.e., outside the European Union (EU) or the European Economic Area (EEA)) if it is necessary for the fulfillment of our pre-contractual or contractual obligations, based on your consent, on a legal obligation, or based on our legitimate interests. The same applies to data processing by third parties on our behalf, disclosure of personal data to third parties, and their transfer to third parties. Service providers who process personal data on our behalf in a third country are only used if there is an "adequacy decision" of the European Commission for this third country (Article 45 GDPR), "appropriate safeguards" (Article 46 GDPR) are in place, including "standard contractual clauses" (Article 46(2)(c) GDPR), and/or "binding corporate rules" (Article 47 GDPR) are in place at the recipient. You can obtain general information about adequacy decisions at https://commission.europa.eu/law/law-topic/data-protection/international-dimension-data-protection/adequacy-decisions_en, about appropriate safeguards as internal rules at https://commission.europa.eu/law/law-topic/data-protection/international-dimension-data-protection/binding-corporate-rules-bcr_en, and about standard contractual clauses at https://commission.europa.eu/publications/standard-contractual-clauses-international-transfers_de. For

IV. Duration of Storage

We delete personal data after the purpose has been achieved, the legal basis no longer exists, or if there is no obligation to retain the data.

Stored server log files and IP addresses are automatically deleted after seven days.

Session cookies are deleted automatically after the end of the session. Additionally, cookies with an expiration date are stored on your device, and you have control over the use and deletion of cookies, as mentioned above.

We process personal data from your email inquiries or form submissions, or inquiries through other means, until your request is fully processed and completed. After that, the information will be deleted unless there is a legal obligation to retain it. You can delete your customer account at any time. However, please note that certain data may be subject to commercial and tax retention obligations for a minimum of six years (§ 257 HGB) or ten years (§147 AO) due to a contractual relationship with you, which may also apply to the content of contact inquiries and emails.

We delete applications no later than six months after the completion of the application process. If the data should be required for legal purposes after the completion of the application process, data processing may take place based on the conditions of Article 6 GDPR, especially to exercise legitimate interests according to Article 6(1) subparagraph 1 letter f GDPR. Our legitimate interest in this case is to assert or defend claims. If your application is successful, we will continue processing the personal data concerning you for the purposes of the employment relationship. If you have expressly given your consent, you can revoke your consent at any time with effect for the future, so that we delete your data. The revocation of consent does not affect the lawfulness of the processing carried out based on the consent before the revocation.

Furthermore, in relation to all tools, services, and the information provided above, data is reviewed annually to determine whether deletion is possible. This is the case when the purpose of processing and the conditions of the legal basis for processing no longer exist, and there is no longer a legal obligation to retain the data.

V. Provision of Personal Data and Rights of Data Subjects

You are not legally obligated to provide personal data. However, providing such data may be necessary for entering into a contract or for the functionality of the website. Failure to provide the data may result in the inability to offer a contract or a specific feature on the website.

There is no automated decision-making on the website, and no profiling takes place on our website.

The rights of data subjects are derived in particular from Articles 15 to 23 and Article 77 of the GDPR, as well as Sections 32 to 37 of the Federal Data Protection Act (BDSG-new).

In relation to personal data concerning you, you have the right to:

Access, Article 15 GDPR Rectification, Article 16 GDPR Erasure, Article 17 GDPR Restriction of processing, Article 18 GDPR Data portability, Article 20 GDPR

If you have given consent to the processing of personal data, you have the right to:

Withdraw your consent, Article 7 GDPR, with effect for the future. The lawfulness of processing based on consent before its withdrawal remains unaffected.

You also have the right to:

Object to the processing of personal data, Article 21 GDPR

For further information, please refer to section VI below.

Please direct all inquiries, requests, and communications to us, as indicated above under section I.

If you believe that the processing of personal data concerning you violates data protection laws, you have the

Right to lodge a complaint

with the supervisory authority, pursuant to Article 77 GDPR. Without prejudice to any other administrative or judicial remedy, you have the right to lodge a complaint with a supervisory authority, particularly in the Member State of your habitual residence, place of work, or the place of the alleged infringement, if you consider that the processing of personal data relating to you infringes the GDPR.

You can find the contact details of the data protection officers in the federal states, the supervisory authorities for the non-public sector, broadcasting, churches, in Europe and in other countries, as well as the Virtual Data Protection Office at https://www.bfdi.bund.de/DE/Infothek/Anschriften_Links/anschriften_links-node.html.

VI. Information about the Right to Object under Article 21 GDPR

You have the right to object, on grounds relating to your particular situation, at any time to the processing of personal data concerning you which is based on Article 6(1)(f) GDPR (processing for the purposes of legitimate interests).

If you object, we will no longer process your personal data unless we can demonstrate compelling legitimate grounds for the processing which override your interests, rights, and freedoms, or the processing serves the establishment, exercise, or defense of legal claims.

If personal data is processed for direct marketing purposes, you have the right to object at any time to the processing of personal data concerning you for such marketing. If you object to processing for direct marketing purposes, your personal data will no longer be processed for such purposes.

The objection can be made informally and should preferably be addressed to us, as indicated above under section I.

The following privacy policy provides you with information about the nature, scope, and purposes of the collection and use of personal data when using this website, as well as your rights.

I. Controller for data processing (hereinafter referred to as "we")

OF Princess Agency
Bianchi & Weber GbR
Mühldorfstraße 8
81671 München

Contact
Email: info@of-princess-agency.com

For further details, please refer to our provider identification.

II. Personal data, purposes of processing, and legal bases

Personal data refers to any information relating to an identified or identifiable natural person (hereinafter referred to as the "data subject"). An identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier, or one or more specific characteristics expressing the identity of the natural person.

Personal data is processed on our website when it is necessary for the following purposes:

Based on your request and given consent (Legal basis: Article 6(1)(a) of the General Data Protection Regulation – GDPR) For the use of the website (Legal basis: Article 6(1)(b) GDPR) To safeguard our legitimate interests in improving user experience, promoting our services, and maintaining the security of the website (Legal basis: Article 6(1)(f) GDPR) For the use of services offered on the website and for pre-contractual measures, particularly for handling your inquiries (Legal basis: Article 6(1)(a) and/or Article 6(1)(b) GDPR) For the performance of a contract and contract fulfillment (Legal basis: Article 6(1)(b) GDPR) and/or To fulfill a legal obligation to which we are subject (such as tax regulations and retention obligations, Legal basis: Article 6(1)(c) GDPR)für die Nutzung der Website (Rechtsgrundlage: Artikel 6 Absatz 1 Unterabsatz 1 Buchstabe b DSGVO) zur Wahrung unseres Interesses an der Verbesserung der Nutzererfahrung, Bewerbung unserer Leistungen und der Aufrechterhaltung der Sicherheit der Nutzung (Rechtsgrundlage: Artikel 6 Absatz 1 Unterabsatz 1 Buchstabe f DSGVO) für die Nutzung der auf der Website angebotenen Leistungen sowie für vorvertragliche Maßnahmen, insbesondere etwa für Ihre Anfragen (Rechtsgrundlage: Artikel 6 Absatz 1 Unterabsatz 1 Buchstabe a und/ oder Artikel 6 Absatz 1 Unterabsatz 1 Buchstabe b DSGVO) für einen Vertragsabschluss und für die Vertragsdurchführung (Rechtsgrundlage: Artikel 6 Absatz 1 Unterabsatz 1 Buchstabe b DSGVO) und/oder zur Erfüllung einer rechtlichen Verpflichtung, der wir unterliegen (etwa steuerrechtliche Vorgaben und Aufbewahrungspflichten, Rechtsgrundlage: Artikel 6 Absatz 1 Unterabsatz 1 Buchstabe c DSGVO)

Further details on data processing can be found under the respective headings:

1. Access data / Server log files

When you visit our website, the servers of our website host automatically store the information sent by your browser, known as server log files. The information includes the following:

Referrer (previously visited website) Requested webpage or file Browser type and version Operating system used Device type used Access time IP address in anonymized form (used only to determine the location of access)

The temporary processing of this data by the system is necessary to enable the delivery of the website to your device. In particular, the IP address must be processed for this purpose. This data is not merged with other data sources. The information is used solely to control website traffic and to maintain the technical operation of the servers and network of our website host, as well as for preventing abuse. The legal basis for this processing is Article 6(1)(f) GDPR.

2. Cookies

Unsere Website verwendet teilweise sog. Cookies oder andere Technologien, vor allem auch solche, die unbedingt erforderlich sind bzw. funktionale Cookies, damit wir Ihnen die abgerufene Website nebst Funktionen zur Verfügung stellen können, § 25 Absatz 2 Ziffer 2 Telekommunikation-Telemedien-Datenschutz-Gesetz (TTDSG), Artikel 6 Absatz 1 Unterabsatz 1 Buchstabe f DSGVO.

The following required / functional cookies are set:

Name: ofprincessagency_session Anbieter/Domain: of-princess-agency.de Purpose: Session cookie, browser session identification (necessary) Duration: 2 hours

Name: XSRF-TOKEN Anbieter/Domain: of-princess-agency.de Purpose: Security aspect, protection against CSRF attacks (necessary) Duration: 2 hours

Name: styleCookieName Anbieter/Domain: of-princess-agency.de Purpose: Storage of the theme (light/dark) (preference) Duration: 1 week

Most browsers also have an option to restrict or completely prevent the storage of cookies. However, it should be noted that the use and, in particular, the user experience may be limited without cookies.

Instructions for the most common browsers:

Mozilla Firefox, Google Chrome, Apple Safari, Microsoft Edge

3. Contact via email, forms, or other means

If you contact us via email, contact forms, or other means, the information you provide (such as name, email address, message) including the data you provide and additional data (IP address, time, privacy notice) will be processed for the purpose of handling your inquiry and, if necessary, for follow-up questions. The legal basis for this processing is Article 6(1)(b) GDPR.

If you have given your consent, the legal basis is Article 6(1)(a) GDPR and Article 9(2)(a) GDPR for special categories of personal data, depending on the individual case.

If you use our application form for collaboration, we collect the following data: name, email, telephone, date of birth, information about social media usernames and previous experience on these platforms, message, IP address, privacy notice, time, and any individual messages you provide. The legal basis is Article 6(1)(b) GDPR and/or Article 6(1)(a) GDPR and Article 9(2)(a) GDPR.

4. Services and Content from Third Parties

Below, we include or link to the following services and content from third parties:

Social Media

We use social media platforms to promote and present our services and products, and to establish our presence. The legal basis for data processing by the providers can be found in their respective privacy policies:

Twitter: Twitter International Company, One Cumberland Place, Fenian Street, Dublin 2 D02 AX07, Ireland, Parent Company: Twitter Inc., 1355 Market Street, Suite 900, San Francisco, CA 94103, USA; Privacy Policy: https://twitter.com/privacy; Imprint: https://legal.twitter.com/de/imprint; Standard Contractual Clauses (ensuring an adequate level of data protection for transfers to third countries): https://gdpr.twitter.com/en/controller-to-controller-transfers.html;Datenschutzhinweise: https://twitter.com/privacy; Impressum: https://legal.twitter.com/de/imprint; Standarddatenschutzvertragsklauseln (Gewährleistung Datenschutzniveau bei Verarbeitung in Drittländern): https://gdpr.twitter.com/en/controller-to-controller-transfers.html;

Instagram:
Meta Platforms Ireland Ltd., 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland; Privacy Policy: https://www.facebook.com/help/instagram/155833707900388; Imprint: https://help.instagram.com/581066165581870/;

When you click on a social media icon on our site, you will leave our website and establish a connection to these third-party providers in a separate tab or window. We refer you to their respective privacy policies. Please note that data may be processed outside the European Union, as described in the section on international transfers below. This may entail risks, such as making it more difficult to enforce the rights of users. If you wish to exercise your rights as a data subject, it is most effective to address the respective platform provider. However, you can also contact us regarding our profiles.

WhatsApp Business API

If you contact us via the WhatsApp Business API, you will leave our service and use the service provided by WhatsApp LLC, 1601 Willow Road, Menlo Park, California 94025, USA.

When you contact us via WhatsApp, we use your phone number to communicate with you. Additionally, we process other personal data stored by WhatsApp or provided by you during communication, including your first and last name, device information, message content, read receipts, profile picture, and messages and files you send through the app.

WhatsApp collects data independently. Please refer to WhatsApp's privacy policy for the purpose and scope of data collection by WhatsApp, further processing of your data by WhatsApp, and your rights and privacy settings: https://www.whatsapp.com/legal/privacy-policy-eea or directly in the WhatsApp app.

Please note that when using WhatsApp, data may be processed outside the European Union, as described in the section on international transfers below. This may entail risks, such as making it more difficult to enforce the rights of users. If you wish to exercise your rights as a data subject, it is most effective to address the respective platform provider. However, you can also contact us regarding our profiles.

We process the personal data you provide (such as name, phone number, email address, messenger ID, profile picture, message content) for communication purposes, preparation and execution of any contractual relationship, and sending promotional information (e.g., offers) to you using the communication channel you have chosen. To use the communication channels, an existing WhatsApp account is required. The legal basis for our processing is Article 6(1)(a), (b), and/or (f) of the GDPR.

5. Applications

If you send us an application, we will process the personal data provided there to handle your application and get in touch with you. The personal data concerning you will not be disclosed to third parties without your explicit consent unless we are legally obligated to do so, you have requested it, or the data disclosure is necessary for establishing or conducting a contractual relationship with you or for the application process. The legal basis for this processing is Article 6(1) subparagraph 1 letters a, b GDPR, Article 88(1) GDPR, § 26(1) Federal Data Protection Act (BDSG).”

III. Recipients of personal data and transfers to third countries

Personal data will be disclosed to the following categories of recipients:

Our employees, as well as our data processors to the extent necessary, especially the website and hosting provider of our website: DigitalOcean LLC 101 Avenue of the Americas, 10th Floor New York 10013 United States and, if applicable, their respective subprocessors, as well as when using the website, individual designated service providers as mentioned above under II. 4.

In addition, your personal data will not be disclosed to third parties without your express consent, unless we are legally obligated to do so or the data disclosure is necessary to fulfill a contractual relationship.

Furthermore, we process personal data in a third country (i.e., outside the European Union (EU) or the European Economic Area (EEA)) if it is necessary for the fulfillment of our pre-contractual or contractual obligations, based on your consent, on a legal obligation, or based on our legitimate interests. The same applies to data processing by third parties on our behalf, disclosure of personal data to third parties, and their transfer to third parties. Service providers who process personal data on our behalf in a third country are only used if there is an "adequacy decision" of the European Commission for this third country (Article 45 GDPR), "appropriate safeguards" (Article 46 GDPR) are in place, including "standard contractual clauses" (Article 46(2)(c) GDPR), and/or "binding corporate rules" (Article 47 GDPR) are in place at the recipient. You can obtain general information about adequacy decisions at https://commission.europa.eu/law/law-topic/data-protection/international-dimension-data-protection/adequacy-decisions_en, about appropriate safeguards as internal rules at https://commission.europa.eu/law/law-topic/data-protection/international-dimension-data-protection/binding-corporate-rules-bcr_en, and about standard contractual clauses at https://commission.europa.eu/publications/standard-contractual-clauses-international-transfers_de. For

IV. Duration of Storage

We delete personal data after the purpose has been achieved, the legal basis no longer exists, or if there is no obligation to retain the data.

Stored server log files and IP addresses are automatically deleted after seven days.

Session cookies are deleted automatically after the end of the session. Additionally, cookies with an expiration date are stored on your device, and you have control over the use and deletion of cookies, as mentioned above.

We process personal data from your email inquiries or form submissions, or inquiries through other means, until your request is fully processed and completed. After that, the information will be deleted unless there is a legal obligation to retain it. You can delete your customer account at any time. However, please note that certain data may be subject to commercial and tax retention obligations for a minimum of six years (§ 257 HGB) or ten years (§147 AO) due to a contractual relationship with you, which may also apply to the content of contact inquiries and emails.

We delete applications no later than six months after the completion of the application process. If the data should be required for legal purposes after the completion of the application process, data processing may take place based on the conditions of Article 6 GDPR, especially to exercise legitimate interests according to Article 6(1) subparagraph 1 letter f GDPR. Our legitimate interest in this case is to assert or defend claims. If your application is successful, we will continue processing the personal data concerning you for the purposes of the employment relationship. If you have expressly given your consent, you can revoke your consent at any time with effect for the future, so that we delete your data. The revocation of consent does not affect the lawfulness of the processing carried out based on the consent before the revocation.

Furthermore, in relation to all tools, services, and the information provided above, data is reviewed annually to determine whether deletion is possible. This is the case when the purpose of processing and the conditions of the legal basis for processing no longer exist, and there is no longer a legal obligation to retain the data.

V. Provision of Personal Data and Rights of Data Subjects

You are not legally obligated to provide personal data. However, providing such data may be necessary for entering into a contract or for the functionality of the website. Failure to provide the data may result in the inability to offer a contract or a specific feature on the website.

There is no automated decision-making on the website, and no profiling takes place on our website.

The rights of data subjects are derived in particular from Articles 15 to 23 and Article 77 of the GDPR, as well as Sections 32 to 37 of the Federal Data Protection Act (BDSG-new).

In relation to personal data concerning you, you have the right to:

Access, Article 15 GDPR Rectification, Article 16 GDPR Erasure, Article 17 GDPR Restriction of processing, Article 18 GDPR Data portability, Article 20 GDPR

If you have given consent to the processing of personal data, you have the right to:

Withdraw your consent, Article 7 GDPR, with effect for the future. The lawfulness of processing based on consent before its withdrawal remains unaffected.

You also have the right to:

Object to the processing of personal data, Article 21 GDPR

For further information, please refer to section VI below.

Please direct all inquiries, requests, and communications to us, as indicated above under section I.

If you believe that the processing of personal data concerning you violates data protection laws, you have the

Right to lodge a complaint

with the supervisory authority, pursuant to Article 77 GDPR. Without prejudice to any other administrative or judicial remedy, you have the right to lodge a complaint with a supervisory authority, particularly in the Member State of your habitual residence, place of work, or the place of the alleged infringement, if you consider that the processing of personal data relating to you infringes the GDPR.

You can find the contact details of the data protection officers in the federal states, the supervisory authorities for the non-public sector, broadcasting, churches, in Europe and in other countries, as well as the Virtual Data Protection Office at https://www.bfdi.bund.de/DE/Infothek/Anschriften_Links/anschriften_links-node.html.

VI. Information about the Right to Object under Article 21 GDPR

You have the right to object, on grounds relating to your particular situation, at any time to the processing of personal data concerning you which is based on Article 6(1)(f) GDPR (processing for the purposes of legitimate interests).

If you object, we will no longer process your personal data unless we can demonstrate compelling legitimate grounds for the processing which override your interests, rights, and freedoms, or the processing serves the establishment, exercise, or defense of legal claims.

If personal data is processed for direct marketing purposes, you have the right to object at any time to the processing of personal data concerning you for such marketing. If you object to processing for direct marketing purposes, your personal data will no longer be processed for such purposes.

The objection can be made informally and should preferably be addressed to us, as indicated above under section I.

The following privacy policy provides you with information about the nature, scope, and purposes of the collection and use of personal data when using this website, as well as your rights.

I. Controller for data processing (hereinafter referred to as "we")

OF Princess Agency
Bianchi & Weber GbR
Mühldorfstraße 8
81671 München

Contact
Email: info@of-princess-agency.com

For further details, please refer to our provider identification.

II. Personal data, purposes of processing, and legal bases

Personal data refers to any information relating to an identified or identifiable natural person (hereinafter referred to as the "data subject"). An identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier, or one or more specific characteristics expressing the identity of the natural person.

Personal data is processed on our website when it is necessary for the following purposes:

Based on your request and given consent (Legal basis: Article 6(1)(a) of the General Data Protection Regulation – GDPR) For the use of the website (Legal basis: Article 6(1)(b) GDPR) To safeguard our legitimate interests in improving user experience, promoting our services, and maintaining the security of the website (Legal basis: Article 6(1)(f) GDPR) For the use of services offered on the website and for pre-contractual measures, particularly for handling your inquiries (Legal basis: Article 6(1)(a) and/or Article 6(1)(b) GDPR) For the performance of a contract and contract fulfillment (Legal basis: Article 6(1)(b) GDPR) and/or To fulfill a legal obligation to which we are subject (such as tax regulations and retention obligations, Legal basis: Article 6(1)(c) GDPR)für die Nutzung der Website (Rechtsgrundlage: Artikel 6 Absatz 1 Unterabsatz 1 Buchstabe b DSGVO) zur Wahrung unseres Interesses an der Verbesserung der Nutzererfahrung, Bewerbung unserer Leistungen und der Aufrechterhaltung der Sicherheit der Nutzung (Rechtsgrundlage: Artikel 6 Absatz 1 Unterabsatz 1 Buchstabe f DSGVO) für die Nutzung der auf der Website angebotenen Leistungen sowie für vorvertragliche Maßnahmen, insbesondere etwa für Ihre Anfragen (Rechtsgrundlage: Artikel 6 Absatz 1 Unterabsatz 1 Buchstabe a und/ oder Artikel 6 Absatz 1 Unterabsatz 1 Buchstabe b DSGVO) für einen Vertragsabschluss und für die Vertragsdurchführung (Rechtsgrundlage: Artikel 6 Absatz 1 Unterabsatz 1 Buchstabe b DSGVO) und/oder zur Erfüllung einer rechtlichen Verpflichtung, der wir unterliegen (etwa steuerrechtliche Vorgaben und Aufbewahrungspflichten, Rechtsgrundlage: Artikel 6 Absatz 1 Unterabsatz 1 Buchstabe c DSGVO)

Further details on data processing can be found under the respective headings:

1. Access data / Server log files

When you visit our website, the servers of our website host automatically store the information sent by your browser, known as server log files. The information includes the following:

Referrer (previously visited website) Requested webpage or file Browser type and version Operating system used Device type used Access time IP address in anonymized form (used only to determine the location of access)

The temporary processing of this data by the system is necessary to enable the delivery of the website to your device. In particular, the IP address must be processed for this purpose. This data is not merged with other data sources. The information is used solely to control website traffic and to maintain the technical operation of the servers and network of our website host, as well as for preventing abuse. The legal basis for this processing is Article 6(1)(f) GDPR.

2. Cookies

Unsere Website verwendet teilweise sog. Cookies oder andere Technologien, vor allem auch solche, die unbedingt erforderlich sind bzw. funktionale Cookies, damit wir Ihnen die abgerufene Website nebst Funktionen zur Verfügung stellen können, § 25 Absatz 2 Ziffer 2 Telekommunikation-Telemedien-Datenschutz-Gesetz (TTDSG), Artikel 6 Absatz 1 Unterabsatz 1 Buchstabe f DSGVO.

The following required / functional cookies are set:

Name: ofprincessagency_session Anbieter/Domain: of-princess-agency.de Purpose: Session cookie, browser session identification (necessary) Duration: 2 hours

Name: XSRF-TOKEN Anbieter/Domain: of-princess-agency.de Purpose: Security aspect, protection against CSRF attacks (necessary) Duration: 2 hours

Name: styleCookieName Anbieter/Domain: of-princess-agency.de Purpose: Storage of the theme (light/dark) (preference) Duration: 1 week

Most browsers also have an option to restrict or completely prevent the storage of cookies. However, it should be noted that the use and, in particular, the user experience may be limited without cookies.

Instructions for the most common browsers:

Mozilla Firefox, Google Chrome, Apple Safari, Microsoft Edge

3. Contact via email, forms, or other means

If you contact us via email, contact forms, or other means, the information you provide (such as name, email address, message) including the data you provide and additional data (IP address, time, privacy notice) will be processed for the purpose of handling your inquiry and, if necessary, for follow-up questions. The legal basis for this processing is Article 6(1)(b) GDPR.

If you have given your consent, the legal basis is Article 6(1)(a) GDPR and Article 9(2)(a) GDPR for special categories of personal data, depending on the individual case.

If you use our application form for collaboration, we collect the following data: name, email, telephone, date of birth, information about social media usernames and previous experience on these platforms, message, IP address, privacy notice, time, and any individual messages you provide. The legal basis is Article 6(1)(b) GDPR and/or Article 6(1)(a) GDPR and Article 9(2)(a) GDPR.

4. Services and Content from Third Parties

Below, we include or link to the following services and content from third parties:

Social Media

We use social media platforms to promote and present our services and products, and to establish our presence. The legal basis for data processing by the providers can be found in their respective privacy policies:

Twitter:
Twitter International Company, One Cumberland Place, Fenian Street, Dublin 2 D02 AX07, Ireland, Parent Company: Twitter Inc., 1355 Market Street, Suite 900, San Francisco, CA 94103, USA; Privacy Policy: https://twitter.com/privacy; Imprint: https://legal.twitter.com/de/imprint; Standard Contractual Clauses (ensuring an adequate level of data protection for transfers to third countries): https://gdpr.twitter.com/en/controller-to-controller-transfers.html;

Instagram:
Meta Platforms Ireland Ltd., 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland; Privacy Policy: https://www.facebook.com/help/instagram/155833707900388; Imprint: https://help.instagram.com/581066165581870/;

When you click on a social media icon on our site, you will leave our website and establish a connection to these third-party providers in a separate tab or window. We refer you to their respective privacy policies. Please note that data may be processed outside the European Union, as described in the section on international transfers below. This may entail risks, such as making it more difficult to enforce the rights of users. If you wish to exercise your rights as a data subject, it is most effective to address the respective platform provider. However, you can also contact us regarding our profiles.

WhatsApp Business API

If you contact us via the WhatsApp Business API, you will leave our service and use the service provided by WhatsApp LLC, 1601 Willow Road, Menlo Park, California 94025, USA.

When you contact us via WhatsApp, we use your phone number to communicate with you. Additionally, we process other personal data stored by WhatsApp or provided by you during communication, including your first and last name, device information, message content, read receipts, profile picture, and messages and files you send through the app.

WhatsApp collects data independently. Please refer to WhatsApp's privacy policy for the purpose and scope of data collection by WhatsApp, further processing of your data by WhatsApp, and your rights and privacy settings: https://www.whatsapp.com/legal/privacy-policy-eea or directly in the WhatsApp app.

Please note that when using WhatsApp, data may be processed outside the European Union, as described in the section on international transfers below. This may entail risks, such as making it more difficult to enforce the rights of users. If you wish to exercise your rights as a data subject, it is most effective to address the respective platform provider. However, you can also contact us regarding our profiles.

We process the personal data you provide (such as name, phone number, email address, messenger ID, profile picture, message content) for communication purposes, preparation and execution of any contractual relationship, and sending promotional information (e.g., offers) to you using the communication channel you have chosen. To use the communication channels, an existing WhatsApp account is required. The legal basis for our processing is Article 6(1)(a), (b), and/or (f) of the GDPR.

5. Applications

If you send us an application, we will process the personal data provided there to handle your application and get in touch with you. The personal data concerning you will not be disclosed to third parties without your explicit consent unless we are legally obligated to do so, you have requested it, or the data disclosure is necessary for establishing or conducting a contractual relationship with you or for the application process. The legal basis for this processing is Article 6(1) subparagraph 1 letters a, b GDPR, Article 88(1) GDPR, § 26(1) Federal Data Protection Act (BDSG).”

III. Recipients of personal data and transfers to third countries

Personal data will be disclosed to the following categories of recipients:

Our employees, as well as our data processors to the extent necessary, especially the website and hosting provider of our website: DigitalOcean LLC 101 Avenue of the Americas, 10th Floor New York 10013 United States and, if applicable, their respective subprocessors, as well as when using the website, individual designated service providers as mentioned above under II. 4.

In addition, your personal data will not be disclosed to third parties without your express consent, unless we are legally obligated to do so or the data disclosure is necessary to fulfill a contractual relationship.

Furthermore, we process personal data in a third country (i.e., outside the European Union (EU) or the European Economic Area (EEA)) if it is necessary for the fulfillment of our pre-contractual or contractual obligations, based on your consent, on a legal obligation, or based on our legitimate interests. The same applies to data processing by third parties on our behalf, disclosure of personal data to third parties, and their transfer to third parties. Service providers who process personal data on our behalf in a third country are only used if there is an "adequacy decision" of the European Commission for this third country (Article 45 GDPR), "appropriate safeguards" (Article 46 GDPR) are in place, including "standard contractual clauses" (Article 46(2)(c) GDPR), and/or "binding corporate rules" (Article 47 GDPR) are in place at the recipient. You can obtain general information about adequacy decisions at https://commission.europa.eu/law/law-topic/data-protection/international-dimension-data-protection/adequacy-decisions_en, about appropriate safeguards as internal rules at https://commission.europa.eu/law/law-topic/data-protection/international-dimension-data-protection/binding-corporate-rules-bcr_en, and about standard contractual clauses at https://commission.europa.eu/publications/standard-contractual-clauses-international-transfers_de. For

IV. Duration of Storage

We delete personal data after the purpose has been achieved, the legal basis no longer exists, or if there is no obligation to retain the data.

Stored server log files and IP addresses are automatically deleted after seven days.

Session cookies are deleted automatically after the end of the session. Additionally, cookies with an expiration date are stored on your device, and you have control over the use and deletion of cookies, as mentioned above.

We process personal data from your email inquiries or form submissions, or inquiries through other means, until your request is fully processed and completed. After that, the information will be deleted unless there is a legal obligation to retain it. You can delete your customer account at any time. However, please note that certain data may be subject to commercial and tax retention obligations for a minimum of six years (§ 257 HGB) or ten years (§147 AO) due to a contractual relationship with you, which may also apply to the content of contact inquiries and emails.

We delete applications no later than six months after the completion of the application process. If the data should be required for legal purposes after the completion of the application process, data processing may take place based on the conditions of Article 6 GDPR, especially to exercise legitimate interests according to Article 6(1) subparagraph 1 letter f GDPR. Our legitimate interest in this case is to assert or defend claims. If your application is successful, we will continue processing the personal data concerning you for the purposes of the employment relationship. If you have expressly given your consent, you can revoke your consent at any time with effect for the future, so that we delete your data. The revocation of consent does not affect the lawfulness of the processing carried out based on the consent before the revocation.

Furthermore, in relation to all tools, services, and the information provided above, data is reviewed annually to determine whether deletion is possible. This is the case when the purpose of processing and the conditions of the legal basis for processing no longer exist, and there is no longer a legal obligation to retain the data.

V. Provision of Personal Data and Rights of Data Subjects

You are not legally obligated to provide personal data. However, providing such data may be necessary for entering into a contract or for the functionality of the website. Failure to provide the data may result in the inability to offer a contract or a specific feature on the website.

There is no automated decision-making on the website, and no profiling takes place on our website.

The rights of data subjects are derived in particular from Articles 15 to 23 and Article 77 of the GDPR, as well as Sections 32 to 37 of the Federal Data Protection Act (BDSG-new).

In relation to personal data concerning you, you have the right to:

Access, Article 15 GDPR Rectification, Article 16 GDPR Erasure, Article 17 GDPR Restriction of processing, Article 18 GDPR Data portability, Article 20 GDPR

If you have given consent to the processing of personal data, you have the right to:

Withdraw your consent, Article 7 GDPR, with effect for the future. The lawfulness of processing based on consent before its withdrawal remains unaffected.

You also have the right to:

Object to the processing of personal data, Article 21 GDPR

For further information, please refer to section VI below.

Please direct all inquiries, requests, and communications to us, as indicated above under section I.

If you believe that the processing of personal data concerning you violates data protection laws, you have the

Right to lodge a complaint

with the supervisory authority, pursuant to Article 77 GDPR. Without prejudice to any other administrative or judicial remedy, you have the right to lodge a complaint with a supervisory authority, particularly in the Member State of your habitual residence, place of work, or the place of the alleged infringement, if you consider that the processing of personal data relating to you infringes the GDPR.

You can find the contact details of the data protection officers in the federal states, the supervisory authorities for the non-public sector, broadcasting, churches, in Europe and in other countries, as well as the Virtual Data Protection Office at https://www.bfdi.bund.de/DE/Infothek/Anschriften_Links/anschriften_links-node.html.

VI. Information about the Right to Object under Article 21 GDPR

You have the right to object, on grounds relating to your particular situation, at any time to the processing of personal data concerning you which is based on Article 6(1)(f) GDPR (processing for the purposes of legitimate interests).

If you object, we will no longer process your personal data unless we can demonstrate compelling legitimate grounds for the processing which override your interests, rights, and freedoms, or the processing serves the establishment, exercise, or defense of legal claims.

If personal data is processed for direct marketing purposes, you have the right to object at any time to the processing of personal data concerning you for such marketing. If you object to processing for direct marketing purposes, your personal data will no longer be processed for such purposes.

The objection can be made informally and should preferably be addressed to us, as indicated above under section I.