atmosphere

Privacy Policy

This Privacy Notice explains how we process personal data when you use wecreateatmosphere.com and the customer portal provided on this site.

1. Controller

The controller within the meaning of the GDPR is:

atmosphere media GmbH
Im Mediapark 5b
50670 Cologne, Germany

Email:
Managing Directors:

2. Purposes and legal bases

We process personal data as necessary for the following purposes:

  • Operating and securing the website (server/access logs, security, troubleshooting, abuse prevention)
    Legal basis: Art. 6(1)(f) GDPR (legitimate interest in secure operation).
  • Handling enquiries (contact form/email)
    Legal basis: Art. 6(1)(b) GDPR (pre-contractual/contract communication) and/or Art. 6(1)(f) GDPR.
  • Customer portal/login (customers with an active atmosphere365 subscription)
    Legal basis: Art. 6(1)(b) GDPR (contract performance: account/portal and support).
  • Security/authentication logs in the portal (login/logout, failed logins)
    Legal basis: Art. 6(1)(f) GDPR (security and abuse prevention).
  • Embedded video (Vimeo) in the portal (demo video)
    Legal basis: Art. 6(1)(a) GDPR where the embed is loaded only after user action (click-to-play); otherwise Art. 6(1)(f) GDPR only where strictly necessary.

3. Data categories

Depending on your use, we may process:

  • Contact and communication data (e.g., name, email address, phone number, message content).
  • Portal account data (e.g., name, email, phone, address, role information).
  • Portal security/auth logs (e.g., login/logout timestamps, failed logins).
  • Server/access logs (IP address, timestamp, requested URL/resource, status code, referrer if provided, user agent).

4. Cookies

As of today, we do not use marketing or tracking tools (e.g., analytics, retargeting). Cookies, if any, are used only to the extent strictly necessary for technical operation (in particular for login/portal). No consent tool/cookie banner is used as of today.

5. Processors and recipients

We use service providers (processors) who process data on our behalf (Art. 28 GDPR), in particular:

  • atmosphere MXT, Ltd. (Ireland): Operation/hosting of website/portal functions, account and log data, monitoring/remote support (technical platform services).
  • Hosting/cloud infrastructure: AWS and Scalloway European Cloud.
  • TeamViewer: Remote support software (where used).
  • Vimeo: Video service for embedded videos in the portal (demo video).
  • Dropbox: Content delivery/CDN (where used).

6. International transfers

Depending on service providers, processing outside the EU/EEA cannot be fully excluded. Where required, appropriate safeguards are applied, in particular EU Standard Contractual Clauses and supplementary measures.

7. Retention

We delete personal data once it is no longer necessary for the purposes and no statutory retention obligations apply. Current retention periods include:

  • Server/access logs: up to 90 days.
  • Portal security/auth logs: up to 12 months.
  • General enquiries without a contractual relationship: typically deleted 24 months after completion of the communication.
  • Customer/account data:

    • Stored during the active term of the contract.
    • Minimized or deleted after contract termination, subject to statutory retention obligations.
    • After 36 months of inactivity, personal contact data is minimized (unless open claims, active support cases, or legal obligations exist).
    • Minimal company data may be retained to facilitate potential re-onboarding.

8. Access controls and security

Access is role-based (e.g., admin/support/programming). Admin/support access is limited to a small number of authorized persons (CTO, lead developer, hotline manager). Backups of productive systems (database/storage) are created regularly (daily).

We maintain an internal incident reporting and escalation process (incident lead; escalation to management/CTO/lead developer; assessment whether personal data is affected; documentation of measures).

9. Your rights

Subject to the statutory requirements, you have the right of access, rectification, erasure, restriction, data portability, and the right to object (where processing is based on Art. 6(1)(f)). Where applicable, you may withdraw consent with effect for the future.

You also have the right to lodge a complaint with a supervisory authority.

10. Updates

We may update this Privacy Notice if our processing activities, website functions, or legal requirements change.

atmosphere