Privacy notice

1. Controller

BeforeSunrise Internetagentur e.K. · Proprietor: Tobias Lorenz

Wennigser Str. 1 b · 30974 Wennigsen · Germany · Email: info@beforesunrise.de · Telephone: +49 5109 5630405

2. Website access, security and server logs

When you access the site, the server necessarily processes data including IP address, date and time, requested resource, referrer, browser and operating-system identifier, transferred volume and HTTP status. This supports secure and reliable delivery, error diagnosis and abuse prevention. The legal basis is Article 6(1)(f) GDPR; our legitimate interests are the secure and stable operation of the service.

The server configuration rotates individual log files by volume at 10 MB and keeps no more than ten rotated files, so the actual time period depends on traffic. Data connected with a security or evidentiary incident may be retained until it is resolved. Application-level abuse-prevention records are deleted after seven days.

3. Necessary storage on your device

The second_orbit_session cookie protects the session and forms and expires with the browser session. Your language is stored locally as second-orbit-language and, after you use the audio control, the mute preference as second-orbit-audio-muted until you delete or change that browser data.

These operations are necessary for the language, controls and secure functionality you request (section 25(2)(2) TDDDG). No optional analytics, advertising or retargeting services are used.

4. Return route, email and story state

When you request a return route, we process your email address, language, timestamps, privacy-notice version, double-opt-in state and evidence, and a technical identifier derived from the requesting IP address by HMAC. After confirmation, data also includes the provisional CIR identifier, story and delivery states, decisions and event history. The email address is used only for the requested Second Orbit experience and its management.

The legal bases are your consent to email communication (Article 6(1)(a) GDPR), performance of the experience you expressly request (Article 6(1)(b) GDPR), and our legitimate interest in security and abuse prevention (Article 6(1)(f) GDPR). Unconfirmed registrations are deleted after seven days. Active story states remain until you request deletion; the personal management link lets you pause messages and request deletion. Providing an email address is voluntary but required for the email return route.

5. Recipients and transfers

The website and outgoing email operate on European server infrastructure. Technical hosting, administration and delivery providers receive data only as needed for operation and delivery and where a data-protection agreement or other legal basis applies. The current service has no analytics or advertising recipients, sends no personal data to an external AI service, and does not intend a third-country transfer. This notice will be updated before that changes.

6. Your rights and complaints

Where the legal conditions apply, you may request access, correction, erasure, restriction and portability. You may object to processing based on legitimate interests and withdraw consent at any time for the future. You may also complain to a supervisory authority, in particular the State Commissioner for Data Protection of Lower Saxony, Prinzenstraße 5, 30159 Hannover, Germany, www.lfd.niedersachsen.de. Send requests to info@beforesunrise.de.

7. Automated decisions

There is no solely automated decision with legal or similarly significant effect and no profiling.