Privacy Policy (Datenschutzerklärung)

Last updated: June 2026

1. Acceptance

By registering, or using the Ofloft website, you agree to the collection and use of your information as described in this Policy. If you do not agree, please do not use the service.

We may update this Policy at any time. The “Last Updated” date at the top reflects when this document was last revised. We will notify you of any material changes by posting a notice in the app or by sending you an email. Your continued use of the service after a material change takes effect constitutes your acceptance of the updated Policy.

2. Who we are

Welcome to Ofloft ("we", "our", or "us"). We are committed to protecting your privacy and handling your personal data in accordance with the General Data Protection Regulation (GDPR) and applicable German laws.

This Privacy Policy explains how we collect, use, and protect your information when you visit our website or use our services.

3. Controller responsible for data processing

The controller responsible for the processing of personal data on this website is:

Alessandro Dani,
Yorckstrasse 16,
Düsseldorf 40476
Email: info@ofloft.com

For all questions about data protection you can contact us at any time using the details above.

4. General information on data processing

We process personal data only where a legal basis exists or you have consented. "Personal data" means any information relating to an identified or identifiable natural person. The legal bases we rely on (Art. 6(1) GDPR) are:

  • Consent — Art. 6(1)(a) GDPR (e.g. non-essential cookies, marketing email).

  • Performance of a contract / pre-contractual steps — Art. 6(1)(b) GDPR (e.g. providing your account and access to the audio guides).

  • Legitimate interests — Art. 6(1)(f) GDPR (e.g. the secure, stable operation of the website), where your interests do not override ours.

  • Legal obligation — Art. 6(1)(c) GDPR (e.g. statutory retention duties).

Personal data is deleted as soon as the purpose for processing it ceases and no statutory retention period requires us to keep it.

5. Which data do we collect and how

When you access the site, the server automatically collects and stores information your browser transmits, in so-called log files:

  • IP address (usually shortened/anonymised by the host)

  • date and time of the request

  • the page/file requested

  • referrer URL

  • browser type and version, operating system and device info

  • Squarespace analytics (aggregated)

This data is not merged with other data sources and is used only to ensure the secure operation and stability of the site. Legal basis: Art. 6(1)(f) GDPR.

6. Hosting and content delivery

This website is hosted by Squarespace (Squarespace Ireland Ltd. / Squarespace, Inc.). When you visit the site, Squarespace processes data on our behalf as a processor, including data automatically transmitted by your browser (see §4). Audio files are delivered through Squarespace's content delivery network (CDN).

Legal basis: Art. 6(1)(f) GDPR (our legitimate interest in a secure and efficient provision of the website).

7. Cookies and consent

This website uses cookies and comparable technologies (e.g. local storage).

  • Technically necessary cookies are required for the site to function (e.g. keeping you logged in, remembering your consent choice). Legal basis: Art. 6(1)(f) GDPR and § 25(2) TDDDG.

  • Non-essential cookies/technologies (e.g. analytics, marketing) are only set with your consent, which you give via our consent banner and can withdraw at any time with effect for the future. Legal basis: § 25(1) TDDDG and Art. 6(1)(a) GDPR.

8. User account / registration

To create an account and access the audio guides, we process:

  • your email address

  • your password (stored only in encrypted/hashed form)

  • account and usage data necessary to provide access (e.g. login timestamps)

We use this data to create and manage your account and to give you access to the content. Legal basis: Art. 6(1)(b) GDPR (performance of the user agreement). We store this data for as long as your account exists; you can delete your account at any time, after which the data is erased unless a statutory retention period applies.

9. Marketing emails / newsletter

If you sign up for our newsletter or marketing emails, we process your email address [and name] to send you the communications you requested. We use a double opt-in process: you receive a confirmation email and your address is only added after you confirm.

Legal basis: Art. 6(1)(a) GDPR (consent). You can withdraw consent and unsubscribe at any time via the link in every email, with effect for the future.

10. Contact

If you contact us by email [or via a contact form], we process the data you provide (e.g. name, email address, the content of your message) to handle your request. Legal basis: Art. 6(1)(b) GDPR where it relates to a contract, otherwise Art. 6(1)(f) GDPR (our legitimate interest in responding to enquiries). We delete this data once your request is fully resolved and no retention duty applies.

11. Advertising and social media (Meta & Microsoft Clarity)

we use the Meta Pixel, a tool of Meta Platforms Ireland Ltd., to measure and optimise our advertising. When you visit the site, the pixel can establish a direct connection to Meta's servers and transmit data (e.g. your IP address, the pages visited, a device/identifier), including to the USA. For the collection and transmission via the pixel, we and Meta are jointly responsible (Art. 26 GDPR).

This processing only takes place with your consent. Legal basis: Art. 6(1)(a) GDPR and § 25(1) TDDDG. You can withdraw consent at any time via the consent banner. For Meta's own subsequent processing, see Meta's privacy policy.

We partner with Microsoft Clarity and Microsoft Advertising to capture how you use and interact with our website through behavioral metrics, heatmaps, and session replay to improve and market our products/services. Website usage data is captured using first and third-party cookies and other tracking technologies to determine the popularity of products/services and online activity. Additionally, we use this information for site optimization, fraud/security purposes, and advertising. For more information about how Microsoft collects and uses your data, visit the Microsoft Privacy Statement.

12. Donation processing

We offer an optional way to support Oflfot financially through a donation feature on our website, powered by “Buy me a coffe”. Donating is entirely voluntary and has no bearing whatsoever on your access to Ofloft. If you choose to donate, the following data is processed:

Payment details (card number, expiry, CVC), processed exclusively by “Buy me a coffe”. We never see or store your card data.

Name and email address (to send a donation confirmation).

Transaction metadata (amount, date, currency, country), visible to us for accounting purposes.

IP address and device data, collected by “Buy me a coffe” for fraud prevention.

“Buy me a coffe” acts as an independent data controller for payment processing, meaning they have their own privacy obligations towards you, separate from ours. We recommend reading “Buy me a coffe”’s Privacy Policy before donating. The legal basis for processing your donation data is Art. 6(1)(b) GDPR (transaction you initiated) and Art. 6(1)(c) GDPR (statutory accounting obligations). Transaction records are retained for 10 years in accordance with German commercial law (§ 147 AO).

13. International Data Transfer

Some of our technical service providers (Stripe, Squarespace) are based in the United States. Where technical or pseudonymous data is transferred to these providers, no personal health data is included. All such transfers are protected by Standard Contractual Clauses (SCCs) approved by the European Commission.

Where providers participate in the EU–US Data Privacy Framework, we additionally rely on that framework. If you’d like a copy of the safeguards for any specific transfer, contact us at: info@ofloft.com

14. Data Protection and Your Privacy Rights

You have the following rights regarding your personal data:

14.1 For Users in the European Union and EEA

Your data is processed on the basis of your explicit consent pursuant to GDPR Art. 6(1)(a) and Art. 9(2)(a). You may withdraw your consent at any time without this affecting the lawfulness of processing prior to withdrawal.

Under the GDPR, you have the following rights, which you may exercise at any time by contacting us at info@ofloft.com:

  • Right of access (Art. 15 GDPR): to obtain confirmation of whether and what personal data we process about you.

  • Right to rectification (Art. 16 GDPR): to correct inaccurate or incomplete data.

  • Right to erasure / “right to be forgotten” (Art. 17 GDPR): to request deletion of your data.

  • Right to restriction of processing (Art. 18 GDPR): to limit how we use your data in certain circumstances.

  • Right to data portability (Art. 20 GDPR): to receive your data in a structured, machine-readable format.

  • Right to object (Art. 21 GDPR): to object to processing based on our legitimate interests.

  • Right to lodge a complaint with your national supervisory authority, in particular the supervisory authority in your EU country of residence.

Lead supervisory authority: Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen (LDI NRW), Kavalleriestraße 2–4, 40213 Düsseldorf — www.ldi.nrw.de

You also have the right to complain to the supervisory authority in your country of residence. A list of EEA authorities can be found at edpb.europa.eu. We will respond to all GDPR requests within one month of receipt. Complex or numerous requests may be extended by a further two months, in which case we will inform you within the first month.

14.2 For Users in the United States

California residents (CCPA/CPRA): You have the right to know what personal information we collect and how it is used, the right to delete your personal information, the right to opt out of any sale or sharing of your information (note: we do not sell or share your data), the right to correct inaccurate information, the right to limit use of sensitive personal information, and the right not to be discriminated against for exercising these rights. To submit a request, contact us at info@ofloft.com. We respond within 45 days, extendable by a further 45 days for complex requests. This service is free of charge.

In the last 12 months, we have shared the following categories of personal information with service providers for business purposes: identifiers (Category A), internet or network activity (Category F). We have not sold or shared any personal information.

Washington State residents (WPA): Washington residents have the right to access, correct, delete, and port their personal data, and to opt out of targeted advertising and automated profiling. We do not engage in either. To exercise these rights, contact info@ofloft.com. We respond within 45 days (extendable by 45 days with notice).

Residents of other US states: Similar rights to access, delete, correct, and obtain a copy of your personal data apply. Please contact us at info@ofloft.com.

We do not knowingly collect personal information from residents of the United States who are under the age of 18, consistent with COPPA and applicable state laws.

Do Not Track (DNT): Our website does not currently respond to Do Not Track browser signals. You can limit tracking through your device’s privacy settings.

California Shine the Light Law (Civil Code § 1798): We do not share personal data with third parties for their direct marketing purposes. If you have questions, contact us at info@ofloft.com.

15. Data security

We use appropriate technical and organisational measures (including encryption in transit, e.g. TLS/SSL) to protect your data against unauthorised access, loss or manipulation.

16. Children’s Privacy

Ofloft is not intended for children under 16 (EU/EEA/UK) or under 13 (United States) without verified parental or guardian consent. We do not knowingly collect personal data from children below these thresholds. If you believe a child has registered without appropriate consent, please contact us at info@ofloft.com and we will delete the account promptly.

17. Changes to this privacy policy

We may update this privacy policy to reflect changes to our service or to legal requirements. The current version is always available on this page, with the date of the last update shown at the top.

18. Contact Us

Questions, requests, concerns, we’re always happy to hear from you!

Email: info@ofloft.com

Post: Alessandro Dani, Yorckstrasse 16, 40476 Düsseldorf, Germany

Website: www.ofloft.com

We will acknowledge your request within 5 business days and respond fully within the timeframes required by applicable law.