Privacy policy
Updated: 4 October 2026
1. Controller
The controller responsible for processing personal data on deruni.de is:
Marco Unverzagt
Teichstr. 22
04600 Altenburg
Germany
Email: info@deruni.de
Telephone: +49 179 5446087
2. Hosting and operation of the website
This website is hosted by STRATO GmbH, Otto-Ostrowski-Straße 7, 10249 Berlin, Germany. When you visit, technical data needed to deliver the website are processed. These may include your IP address, access time, requested page or file, browser information, operating system, referring page and request status.
This processing enables website delivery, technical security and the detection and investigation of errors and abusive access. The legal basis is Article 6(1)(f) GDPR. My legitimate interest is the secure and reliable operation of this website. STRATO receives the data required for these purposes and acts as a hosting processor under Article 28 GDPR.
Technical logs are retained only as long as necessary for operation, troubleshooting and security. The precise period depends on the type of log and the hosting provider’s settings and operational procedures. In the event of a specific security incident, necessary data may be retained until the matter is resolved and, where applicable, for legal proceedings. Information from STRATO: www.strato.de/datenschutz/.
3. Contact by email, telephone and contact form
If you contact me by email or telephone, I process the contact details you provide and the content of your enquiry to respond to it. Where a contact form is provided on the website, the same applies to the information submitted there, particularly your email address, message and, where provided, your name.
The legal basis is Article 6(1)(b) GDPR if your enquiry concerns a contract or steps prior to entering into one. For other enquiries, the legal basis is Article 6(1)(f) GDPR. My legitimate interest is responding to incoming enquiries. You only need to provide the information necessary to handle your request. Without a way to contact you, I cannot send a reply.
Email is handled through STRATO. Information you provide is not automatically used for newsletter advertising. Enquiries are deleted once they have been fully dealt with and no statutory retention requirements or legitimate reasons for further storage remain. Where such requirements apply, or storage is necessary to establish, exercise or defend legal claims, further retention is restricted to that purpose.
4. Newsletter and free PDF download
You can voluntarily subscribe to the uNi newsletter, which contains thoughts, stories and updates from me. As a welcome gift, you receive the PDF “7 Gedanken für deinen nächsten Schritt”. I need your email address and express consent for this. You may voluntarily provide your first name so that I can address you personally. The newsletter, its emails and the PDF are currently in German; this is stated on the English signup form.
Signup requires an additional confirmation of your email address. You receive a confirmation link and then confirm your signup on the website. The link is valid for three days. Only after confirmation do you receive the welcome email with the PDF link and become subscribed to the newsletter.
I store your first name if provided, email address, subscription status, signup and confirmation times, consent wording and technical information needed to process the signup and send email. Confirmation and unsubscribe tokens are stored in the database as hashes. These details support delivery, subscription management and evidence of consent. They are stored in this website’s WordPress database; email is sent through STRATO. The newsletter module does not measure email opens.
New personal PDF links lead to a download page. When you click the download button, the number of PDF requests and the time of the most recent request are stored against your subscription. A request does not prove that a download was completed. This processing supports administration of the download and evaluation of the offer. The legal basis is Article 6(1)(f) GDPR; my legitimate interest is traceable provision and improvement of my download offering. These request records are needed for no longer than the corresponding subscription data and are removed when those data are deleted.
The legal basis for sending newsletters is Article 6(1)(a) GDPR. You may withdraw your consent at any time with effect for the future, for example using the unsubscribe link in the welcome email or by emailing info@deruni.de. This does not affect the lawfulness of processing before withdrawal. Without consent and confirmation, you cannot use this newsletter offer with its PDF gift; you may continue to visit the rest of the website.
Data needed for ongoing delivery are retained until you unsubscribe. No further newsletters are sent after that. Where evidence of consent and unsubscription is still needed to defend against or clarify legal claims, it is retained for that limited purpose under Article 6(1)(f) GDPR. The period depends on the particular need for evidence and applicable statutory limitation periods; the data are then deleted. Unconfirmed signups are not used to send newsletters and are deleted when there is no legitimate reason to retain them.
To limit repeated or abusive signup attempts, the form uses temporary blocking and counter values. These use hashes derived from the IP address or from the IP address together with the email address. Depending on the check, these limits last ten minutes or one hour. The legal basis is Article 6(1)(f) GDPR; my legitimate interest is protecting the form and email delivery from abuse.
5. Koko Analytics without cookies
I use the locally installed WordPress plugin Koko Analytics to analyse website statistics. This helps me understand which pages are visited and how the use of the website develops. Statistical data remain on this website’s server and are not sent to an external analytics service. Koko Analytics is used without analytics cookies.
According to its developer, in “Cookieless” mode Koko Analytics uses the IP address, browser identifier and a secret key that changes daily to generate a temporary hash to distinguish visits within a single day. The IP address and browser identifier are not stored in plain text for this purpose; the developer states that temporary identification data are reset daily. Visitors are not recognised across multiple days. Aggregated statistics may be retained for longer. Further information: Koko Analytics tracking methods.
To the extent that personal data are processed, the legal basis is Article 6(1)(f) GDPR. My legitimate interest is data-minimising analysis and improvement of my own website. Information about your right to object appears below.
6. Technically necessary functions and installable web app
WordPress may use technically necessary cookies for certain functions, particularly login to the administration area. Koko Analytics does not use analytics cookies in the configuration described here. Technically necessary storage of information on, or access to information on, your device takes place under section 25(2) of the German Telecommunications Digital Services Data Protection Act (TDDDG), where the statutory conditions are met. To the extent that personal data are processed, the legal basis is Article 6(1)(f) GDPR; my legitimate interest is providing the relevant technical function.
Supported browsers allow you to install the website on your home screen. For this purpose, the website provides an app manifest and a service worker, both loaded from this website. The service worker provides a simple offline notice and does not contain its own visitor tracking. Installation is voluntary and can be reversed through your browser or device settings.
7. Links to YouTube and TikTok
The website contains links to my channels on YouTube and TikTok. Videos are not currently embedded. Displaying these links alone does not cause the theme to load a video player from either provider. You visit the platform only when you open a link; its privacy information and terms then apply. The respective providers are responsible for processing data on their platforms.
8. Recipients, security and retention
Only people and service providers who need access for the purposes described receive access to data. These include STRATO for hosting and email. For the website’s own functions described here, I do not envisage transferring your information to providers outside the European Union or European Economic Area. External platforms you open have their own processing activities. For payment processing, see the PayPal section below.
I take appropriate technical and organisational measures to protect personal data. Complete security of every internet transmission cannot nevertheless be guaranteed. Data are generally stored only as long as needed for the relevant purpose or required by statutory retention obligations. They are deleted when the purpose and grounds for retention cease to apply.
9. Your rights
Subject to the statutory conditions, you have the right of access to your personal data (Article 15 GDPR), rectification (Article 16), erasure (Article 17), restriction of processing (Article 18) and data portability (Article 20). You may withdraw consent at any time with effect for the future.
Right to object: Where processing is based on Article 6(1)(e) or (f) GDPR, you may object at any time on grounds relating to your particular situation. I will then stop processing the data unless I can demonstrate compelling legitimate grounds that override your interests, rights and freedoms, or processing is needed to establish, exercise or defend legal claims. You may object to processing for direct marketing at any time without giving particular reasons; this also applies to related profiling.
To exercise your rights, contact info@deruni.de. Under Article 77 GDPR, you may also lodge a complaint with a data protection supervisory authority, particularly in the place of your habitual residence, workplace or the alleged infringement. The authority for Thuringia is the Thüringer Landesbeauftragte für den Datenschutz und die Informationsfreiheit: www.tlfdi.de.
10. Automated decisions
The processing described here does not involve automated decision-making, including profiling, within the meaning of Article 22 GDPR.
11. Purchasing the journal and PayPal
When you place an order, I process your name, email address, country of residence (and, for earlier orders where applicable, billing address), product, price, order reference, payment reference, status, time and the contractual information you confirmed. These data are used to perform and document the contract. The legal basis is Article 6(1)(b) GDPR, and Article 6(1)(c) GDPR for statutory retention obligations. Purchase-related data are retained in accordance with applicable statutory retention obligations; technical download links and data no longer required are deleted when no longer needed for fulfilment.
Payment is handled through PayPal (Europe) S.à r.l. et Cie, S.C.A., 22–24 Boulevard Royal, L-2449 Luxembourg. If you choose PayPal, you are redirected there. The website transmits the payment amount, currency, product description, order reference and return URLs. PayPal processes the payment details you provide there under its own responsibility and returns payment status and transaction references. Information about PayPal’s processing is available in its privacy statement. No PayPal JavaScript is embedded on the ordinary book page.
The order confirmation and protected download link are sent through the existing STRATO email service. Purchasers are not automatically subscribed to the newsletter. PDF requests are counted per order to protect the file and manage delivery. This count represents download requests, not reliably completed downloads; the order email contains no tracking pixels for email opens.
For withdrawal statements, I process the name, contact address, contract details, statement, receipt time and delivery status of the acknowledgement. These details are used to handle and document the withdrawal and fulfil legal obligations. The legal bases are Article 6(1)(b) and (c) GDPR.