Privacy Policy

1. Controller

The controller responsible for processing personal data on this website is:

Sylwias Ausmalwelt
Owner: Andreas Heckmann
Epplingser Halde 9
88239 Wangen
Germany

Email: [email protected]
Website: https://www.sylwias-ausmalwelt.de/

2. General Information About Data Processing

Protecting your personal data is important to us. We process personal data only to the extent necessary to operate this website, respond to inquiries, provide our content, or make services available that you have chosen to use voluntarily.

Personal data means any information relating to an identified or identifiable individual. This includes, for example, your name, email address, IP address, and information submitted through a contact form or guestbook entry.

Data is processed, in particular, on the basis of the following provisions:

• Article 6(1)(a) of the GDPR, if you have given your consent,
• Article 6(1)(b) of the GDPR, if processing is necessary for the performance of a contract or in order to take steps prior to entering into a contract,
• Article 6(1)(c) of the GDPR, if processing is necessary for us to comply with a legal obligation,
• Article 6(1)(f) of the GDPR, if processing is necessary for the purposes of our legitimate interests,
• Section 25 of the German Telecommunications Digital Services Data Protection Act (TDDDG), insofar as information is stored on or accessed from your device.

3. Hosting by Raidboxes

This website is hosted by:

Raidboxes GmbH
Hafenstraße 32
48153 Münster
Germany

When you visit this website, the hosting provider processes data that is technically necessary. This may include, in particular:

• the IP address of the device accessing the website,
• the date and time of access,
• the page or file accessed,
• the amount of data transferred,
• the referrer URL,
• the browser and browser version used,
• the operating system,
• the HTTP status code,
• the internet service provider.

This data is required, in particular, to deliver the website, ensure the stability and security of the system, detect technical errors, and prevent abusive access.

Processing is based on Article 6(1)(f) of the GDPR. Our legitimate interest lies in the secure, reliable, and technically error-free operation of this website.

Where required, we have entered into a data processing agreement with Raidboxes in accordance with Article 28 of the GDPR.

For more information, please refer to the Raidboxes Privacy Policy:

4. Server Log Files

The hosting provider automatically collects and stores information in server log files. As a general rule, this data is not combined with data from other sources.

Log data is stored only for as long as necessary to ensure the technical operation of the website, analyze errors, prevent attacks, or investigate a specific security incident. Data may be stored for a longer period if this is necessary for the establishment, exercise, or defense of legal claims.

5. Cloudflare

We use services provided by:

Cloudflare, Inc.
101 Townsend Street
San Francisco, CA 94107
USA

Cloudflare helps us provide our website securely and quickly. Among other things, content may be delivered through Cloudflare’s network, website traffic may be analyzed, and malicious or automated access attempts may be blocked.

The following information, in particular, may be processed:

• IP address,
• requested URL,
• date and time of access,
• browser and device information,
• technical connection data,
• information about potential security risks.

Processing is based on Article 6(1)(f) of the GDPR. Our legitimate interest lies in the security, stability, and fast delivery of our website.

Insofar as Cloudflare stores technically necessary cookies or similar information on your device or accesses information stored on your device, this is done on the basis of Section 25(2) of the TDDDG.

The transfer of data to the United States cannot be ruled out. Transfers to third countries are made only in compliance with applicable legal requirements, particularly on the basis of an applicable adequacy decision or appropriate safeguards such as the European Commission’s Standard Contractual Clauses.

For more information:

6. Encrypted Connection

This website uses SSL or TLS encryption. You can recognize an encrypted connection, in particular, by the fact that the address in your browser begins with “https://”.

Encryption helps prevent data that you send to us from being readily read by third parties.

7. Contacting Us by Email

If you contact us by email, we process the information you provide, particularly your email address, the content of your message, and, where applicable, your name and any files you attach.

Processing is carried out:

• on the basis of Article 6(1)(b) of the GDPR, if your inquiry relates to a contract or a potential business relationship,
• in all other cases, on the basis of Article 6(1)(f) of the GDPR.

Our legitimate interest lies in properly processing and responding to your inquiry.

The data will be deleted once your inquiry has been fully resolved and there are no statutory retention requirements or other legitimate reasons for continued storage.

8. Contact Form and File Uploads

A contact form is available on our website. The following information, in particular, may be processed:

• name,
• email address,
• message content,
• files uploaded voluntarily,
• technical connection data,
• date and time of submission.

Required fields are marked accordingly. Any additional information is provided voluntarily.

Your data is processed in order to handle your message. Processing is based on Article 6(1)(b) of the GDPR if your inquiry relates to entering into or performing a contract. In all other cases, processing is based on Article 6(1)(f) of the GDPR.

Please upload only files that are actually necessary for your inquiry. In particular, do not submit health information, copies of identification documents, confidential login credentials, or unnecessary personal information about children.

The data will be deleted once your inquiry has been fully resolved and there are no statutory retention requirements or legitimate reasons for continued storage.

9. Guestbook

We provide a guestbook on our website. When you submit a guestbook entry, the following information, in particular, may be processed:

• name or chosen display name,
• location,
• email address,
• website,
• content of the guestbook entry,
• IP address and technical connection data,
• date and time of submission.

Your email address will not be displayed publicly in the guestbook. Other information that you provide voluntarily may be published together with your guestbook entry.

Guestbook entries are moderated before publication. Moderation is intended, in particular, to prevent spam, unlawful content, insults, and abusive entries.

Your guestbook entry is published on the basis of your consent in accordance with Article 6(1)(a) of the GDPR. Technical processing and moderation are additionally based on Article 6(1)(f) of the GDPR. Our legitimate interest lies in providing a secure and moderated guestbook.

You may withdraw your consent at any time with effect for the future and request that your entry be deleted. The withdrawal of consent does not affect the lawfulness of processing carried out before the withdrawal.

We use the WordPress plugin “Gwolle Guestbook” for our guestbook. The information entered is generally stored in our website’s database.

10. Comments

If comments are enabled on individual pages or posts, the information processed when you submit a comment may include, in particular, the name you enter, your email address, the comment text, your IP address, the time of submission, and technical information relating to the transmission.

This data is processed in order to publish and moderate the comment and to prevent spam and unlawful content.

Publication is based on your consent in accordance with Article 6(1)(a) of the GDPR. Security and moderation measures are based on Article 6(1)(f) of the GDPR.

At your request, WordPress may store cookies so that you do not have to enter your name, email address, and website again when leaving another comment. This information is stored only with your consent.

11. Cookies and Similar Technologies

Our website uses cookies and similar technologies, such as your browser’s local storage.

Cookies are small data files stored on your device. Some cookies are technically necessary to ensure that the website can be provided securely and functions properly. Other cookies may be used, for example, for audience measurement, to display external content, or to save preferences that you have selected voluntarily.

Technically necessary cookies and similar technologies are used on the basis of Section 25(2) of the TDDDG. The associated processing of personal data is based, in particular, on Article 6(1)(f) of the GDPR.

Non-essential cookies, analytics services, and external content are used only after you have given your consent. The legal bases are Section 25(1) of the TDDDG and Article 6(1)(a) of the GDPR.

You may withdraw or change your consent at any time with effect for the future through the Privacy Settings.

Detailed information about the services used, cookies, retention periods, and recipients can be found in our Cookie Policy and in the Privacy Settings.

12. Consent Management with Real Cookie Banner

We use “Real Cookie Banner” to obtain, document, and manage consent for cookies, external content, and similar technologies.

The software provider is:

devowl.io GmbH
Tannet 12
94539 Grafling
Germany

Real Cookie Banner stores, in particular:

• your selected privacy settings,
• the time at which consent was granted or denied,
• a pseudonymous consent ID,
• technical information about the banner configuration used,
• information about subsequent changes or withdrawals.

This processing is necessary to save your choices and to provide evidence of whether consent was granted or denied.

The legal bases are Article 6(1)(c) of the GDPR, Article 6(1)(f) of the GDPR, and Section 25(2) of the TDDDG.

Our legitimate interest lies in the legally compliant documentation and management of your privacy settings.

For more information:

13. Language Selection with Polylang

We use the WordPress plugin “Polylang” to provide our website in multiple languages.

Polylang may set a technically necessary cookie named “pll_language”. This cookie stores the language you selected or most recently used so that the website can be displayed in the appropriate language when you return.

The information is stored on the basis of Section 25(2) of the TDDDG. The associated processing is based on Article 6(1)(f) of the GDPR.

Our legitimate interest lies in providing our multilingual website in a user-friendly and technically reliable manner.

14. Website Protection with Wordfence

We use the “Wordfence” security solution provided by Defiant, Inc., USA.

Wordfence helps us detect and block attacks, malware, unauthorized login attempts, and other security risks.

The following data, among other information, may be processed:

• IP address,
• requested URL,
• time of access,
• browser and device information,
• information about failed or suspicious access attempts.

Processing is based on Article 6(1)(f) of the GDPR. Our legitimate interest lies in protecting our website, our content, and the data stored on it against unauthorized access and technical attacks.

The processing of data in the United States cannot be completely ruled out. Such processing takes place only in compliance with the legal requirements governing transfers to third countries.

For more information:

15. Google Tag Manager

We use Google Tag Manager. For users in the European Economic Area, the provider is generally:

Google Ireland Limited
Gordon House
Barrow Street
Dublin 4
Ireland

Google Tag Manager is used to manage other website services and tags. Google Tag Manager itself generally does not create separate user profiles. However, when it is loaded, technical data, particularly your IP address, may be transmitted to Google.

Google Tag Manager is loaded only after you have given your consent through the cookie banner.

The legal bases are Section 25(1) of the TDDDG and Article 6(1)(a) of the GDPR.

You may withdraw your consent at any time with effect for the future through the Privacy Settings.

The transfer of data to Google companies in the United States cannot be ruled out. Such transfers take place only in compliance with the legal requirements governing transfers to third countries.

For more information:

16. Google Analytics 4

Subject to your consent, this website uses Google Analytics 4, a web analytics service provided by Google Ireland Limited.

Google Analytics helps us understand how our website is used. The following information, in particular, may be processed:

• pages and content viewed,
• time and duration of the visit,
• approximate geographic origin of the visit,
• device used,
• browser and operating system,
• interactions on the website,
• referrer URL,
• shortened or otherwise technically processed IP address,
• pseudonymous identifiers.

Google Analytics uses cookies and similar technologies. The service is activated only after you have given your consent through the cookie banner.

The legal bases are Section 25(1) of the TDDDG and Article 6(1)(a) of the GDPR.

Consent is voluntary and may be withdrawn at any time with effect for the future through the Privacy Settings.

The transfer of data to Google companies in the United States cannot be ruled out. Such transfers take place only in compliance with the legal requirements governing transfers to third countries.

For more information:

17. Google reCAPTCHA

We may use Google reCAPTCHA to protect our forms against automated submissions and spam.

For users in the European Economic Area, the provider is generally Google Ireland Limited.

When reCAPTCHA is loaded, the following information, among other data, may be processed:

• IP address,
• browser and device information,
• date and time,
• mouse and keyboard interactions,
• referrer URL,
• existing Google cookies,
• information about user behavior.

Google reCAPTCHA is loaded only after you have given your consent through the cookie banner.

The legal bases are Section 25(1) of the TDDDG and Article 6(1)(a) of the GDPR.

You may withdraw your consent at any time with effect for the future. Without your consent, you may need to contact us by another method.

For more information:

18. Embedded YouTube Content

Our website may include videos or other content from YouTube.

For users in the European Economic Area, the provider is generally Google Ireland Limited.

YouTube content is initially blocked by the Real Cookie Banner content blocker. No direct connection to YouTube is established before you give your consent.

Only after you consent to the display of the content can a connection be established to YouTube’s or Google’s servers. The following data, in particular, may be processed:

• IP address,
• browser and device information,
• page accessed,
• time of access,
• interactions with the video,
• cookies and similar storage technologies,
• information associated with any Google account you may be signed in to.

The legal bases are Section 25(1) of the TDDDG and Article 6(1)(a) of the GDPR.

Consent is voluntary and may be withdrawn at any time with effect for the future through the Privacy Settings.

The transfer of data to the United States cannot be ruled out.

For more information:

19. Links to Social Networks and External Platforms

Our website contains regular links to external platforms, including:

• Facebook,
• Instagram,
• Pinterest,
• YouTube,
• Spotify,
• Apple Podcasts,
• Amazon Music,
• Amazon.

When regular external links are used, a connection to the respective provider is generally established only after you click the link.

After clicking the link, you leave our website. The operator of the respective platform is generally responsible for any subsequent processing of personal data.

If you are signed in to a platform, the provider may be able to associate your visit with your user account. For more information, please refer to the privacy policy of the respective platform operator.

20. Amazon Associates Program and Affiliate Links

We participate in the Amazon Associates Program. Our website therefore contains links to products or offer pages on Amazon.

If you click one of these links, you will be redirected to an Amazon website. Amazon may use cookies or similar technologies and process information about your visit and any subsequent purchase.

We may earn a commission through affiliate links. This does not change the price of the product for you.

The use and disclosure of affiliate links are based on Article 6(1)(f) of the GDPR. Our legitimate interest lies in helping finance and economically support our website.

Amazon is generally responsible for any processing that takes place after you click the link.

For more information:

21. Content for Children

Much of the content on our website is intended for families and children. However, the contact form, guestbook, comment feature, and other ways of submitting information are generally intended for use by adults, specifically parents or other legal guardians.

Children should submit personal data only with the consent and assistance of their parents or legal guardians.

Please do not send us unnecessary personal information about children or upload images or documents in which children can be identified unless this is expressly necessary and legally permitted.

22. Recipients of Personal Data

To the extent necessary, personal data may be transferred to technical service providers that assist us with hosting, website security, consent management, analytics, or the provision of external content.

Where possible, service providers that process personal data on our behalf are contractually bound in accordance with Article 28 of the GDPR.

Personal data is disclosed to other recipients only if:

• you have given your consent,
• disclosure is necessary for the performance of a contract,
• we are legally required to disclose the data,
• or disclosure is necessary to protect legitimate interests and is legally permissible.

23. Transfers of Data to Third Countries

Some of the service providers we use are based outside the European Union or the European Economic Area or use servers located there.

Data is transferred to a third country only if the requirements of Articles 44 through 49 of the GDPR are met. Transfers may be based, in particular, on an adequacy decision by the European Commission, the European Commission’s Standard Contractual Clauses, or explicit consent.

Despite appropriate safeguards, it cannot be completely ruled out that public authorities in certain third countries may access personal data.

24. Retention Period

Unless a specific retention period is stated in this Privacy Policy, we store personal data only for as long as necessary for the respective purpose.

The data is then deleted unless statutory retention requirements, ongoing contractual relationships, security reasons, or legitimate interests require continued storage.

Data may also be stored until the applicable statutory limitation periods have expired if this is necessary for the establishment, exercise, or defense of legal claims.

25. Withdrawal of Consent

You may withdraw any consent you have given at any time with effect for the future.

The withdrawal of consent does not affect the lawfulness of processing carried out before the withdrawal.

You can change or withdraw your consent to cookies, analytics services, and external content directly through the Privacy Settings on our website.

26. Your Data Protection Rights

Subject to the applicable legal requirements, you have the following rights, in particular:

• the right of access under Article 15 of the GDPR,
• the right to rectification under Article 16 of the GDPR,
• the right to erasure under Article 17 of the GDPR,
• the right to restriction of processing under Article 18 of the GDPR,
• the right to data portability under Article 20 of the GDPR,
• the right to object under Article 21 of the GDPR,
• the right to withdraw consent under Article 7(3) of the GDPR.

To exercise your rights, you may contact us using the contact information provided above.

27. Objection to Processing Based on Legitimate Interests

Insofar as we process personal data on the basis of Article 6(1)(f) of the GDPR, you have the right to object to such processing at any time on grounds relating to your particular situation.

We will then no longer process the personal data concerned unless we can demonstrate compelling legitimate grounds for the processing that override your interests, rights, and freedoms, or unless the processing is necessary for the establishment, exercise, or defense of legal claims.

28. Right to Lodge a Complaint with a Supervisory Authority

You have the right to lodge a complaint with a data protection supervisory authority.

In Baden-Württemberg, the following authority is particularly responsible:

The State Commissioner for Data Protection and Freedom of Information of Baden-Württemberg
Heilbronner Straße 35
70191 Stuttgart
Germany

Website:

You may also contact another data protection supervisory authority, particularly the authority for your habitual residence or place of work.

29. No Automated Decision-Making

No solely automated decision-making, including profiling within the meaning of Article 22 of the GDPR, takes place on this website.

30. Submissions to the “Your Artwork” Gallery

Adults may submit artwork they have created or colored themselves, as well as artwork created or colored by a child, for publication in our “Your Artwork” gallery, provided they have the necessary rights to submit the artwork and authorize its publication. If the artwork was created or colored by a child, the submitting adult must be the child’s parent or legal guardian or otherwise be authorized by the child’s parent or legal guardian to submit it and consent to the publication of the artwork and, if provided, the child’s first name or nickname.

When you submit artwork, we process the following data:

• the uploaded image,
• the first name or nickname provided,
• the email address,
• the image title or caption,
• any accompanying text provided voluntarily.

We use this data to review the submission, contact you with any follow-up questions, and publish the artwork in the gallery if we approve it. Each submission is reviewed manually before publication and does not appear on the website automatically. The FooGallery User Uploads add-on allows uploaded images to be held for manual approval before they appear in the gallery.

If the submission is approved, the artwork, the first name or nickname provided, the image title or caption, and any accompanying text will be displayed publicly on our website. The email address will not be published.

The processing and publication of the personal data described above are based on your consent pursuant to Article 6(1)(a) of the GDPR. Information about the intended processing and publication is provided directly alongside the upload form.

Technical processing is carried out using WordPress and the “FooGallery User Uploads” add-on. The data is stored on the server operated by our hosting provider. Access is limited to us and the technical service providers we use, to the extent necessary to operate and secure the website.

Submissions that are rejected or otherwise not published, together with the related contact details, will be deleted no later than 30 days after we complete our review. For published submissions, we retain the artwork and the related submission data for as long as the artwork remains displayed in the gallery.

You may withdraw your consent at any time. To do so, simply send us a message through our contact form or email [email protected]. Please include, if possible, the title of the artwork and the email address used for the upload so that we can identify the submission. If consent is withdrawn, we will remove the artwork from the gallery and delete the related personal data unless another legal basis permits or requires continued retention. Withdrawing consent does not affect the lawfulness of processing carried out before the withdrawal.

The data protection rights described elsewhere in this Privacy Policy also apply, including the rights of access, rectification, erasure, restriction of processing, and data portability where applicable, as well as the right to lodge a complaint with a supervisory authority.

31. Changes to This Privacy Policy

We update this Privacy Policy if legal requirements, our website, or the services we use change.

The version currently published on this website applies.

Last updated: July 26, 2026