Privacy Policy
Translation for convenience; the German version (Datenschutzerklärung) is legally binding.
Privacy Policy
1. Introduction
R&A Heeg GbR (Rüdiger and Alexander Heeg) operates this website.
It is very important to us to handle the data of our website visitors in a trustworthy manner and to protect it as well as possible. For this reason, we make every effort to meet the requirements of the GDPR.
Below we explain how we process your data on our website. We use language that is as clear and transparent as possible so that you really understand what happens to your data.
2. General information
2.1 Processing of personal data and other terms
Data protection applies to the processing of personal data. Personal means all data with which you can be personally identified – for example, the IP address of the device (PC, laptop, smartphone, etc.) you are currently using. Such data is processed when “something happens to it”. For example, the IP address is transmitted by the browser to our provider and automatically stored there. That is a processing (pursuant to Art. 4(2) GDPR) of personal data (pursuant to Art. 4(1) GDPR).
These and other legal definitions can be found in Art. 4 GDPR.
2.2 Applicable regulations/laws – GDPR, BDSG and TDDDG
The scope of data protection is governed by law. In this case, these are the GDPR (General Data Protection Regulation) as a European regulation and the BDSG (German Federal Data Protection Act) as national law.
In addition, the TDDDG (German Telecommunications Digital Services Data Protection Act) supplements the provisions of the GDPR with regard to cookies and access to information on your terminal device.
2.3 The controller
Responsible for data processing on this website is the controller within the meaning of the GDPR. This is the natural or legal person who, alone or jointly with others, decides on the purposes and means of processing personal data.
You can reach the controller at:
R&A Heeg GbR, represented by its partners Rüdiger Heeg and Alexander Heeg
Grevelsberger Weg 17, 53343 Wachtberg-Villip, Germany
Phone: +49 178 8170215
E‑mail: info@atmos-atelier.de
2.4 How data is generally processed on this website
As already stated, some data (e.g. the IP address) is collected automatically. This data is mainly required for the technical provision of the website. Where we use further personal data or collect other data, we will inform you about it or ask for your consent.
Other personal data you provide to us knowingly.
You will find detailed information on this below.
2.5 Your rights
The GDPR grants you comprehensive rights. These include, for example, free information about the origin, recipients and purpose of your stored personal data. You can also request the correction, erasure or restriction of processing of this data, or lodge a complaint with the competent data protection supervisory authority. You can withdraw any consent you have given at any time.
You will find details of these rights and how to exercise them in the last section of this privacy policy.
2.6 Data protection – our view
For us, data protection is more than just a tiresome obligation! Personal data is very valuable, and handling it with care should be a matter of course in our digital world. You as a website visitor should also be able to decide for yourself what “happens” to your data, when and by whom. We therefore undertake to comply with all legal provisions, collect only the data we need and, of course, treat it confidentially.
2.7 Disclosure and deletion
The disclosure and deletion of data are also important and sensitive topics. We would therefore like to briefly inform you of our general approach in advance.
Data is only disclosed on a legal basis and only when this is unavoidable. This may be the case in particular where a so-called processor is involved and a data processing agreement pursuant to Art. 28 GDPR has been concluded.
We delete your data when the purpose of and the legal basis for processing no longer apply and no other legal obligations prevent deletion. Art. 17 GDPR also gives a “good” overview of this.
Please refer to this privacy policy for all further information and contact the controller with any specific questions.
2.8 Hosting
This website is hosted externally. The personal data collected on this website is stored on the host’s servers. This includes the automatically collected and stored log files (see below for details) as well as all other data provided by website visitors.
External hosting serves the purpose of providing our website securely, quickly and reliably and, in this context, serves the performance of contracts with our potential and existing customers.
The legal basis for processing is Art. 6(1)(b) and (f) GDPR; our legitimate interest lies in providing our website securely and reliably. Where you have consented to the storage of cookies or to access to information on your terminal device, the additional legal basis is Art. 6(1)(a) GDPR in conjunction with § 25(1) TDDDG.
Our host only processes data that is necessary to fulfil its service obligations and acts as our processor, i.e. it is subject to our instructions. We have concluded a corresponding data processing agreement with our host.
We use the following host:
IONOS
IONOS SE, Elgendorfer Str. 57, 56410 Montabaur, Germany.
https://www.ionos.de/terms-gtc/datenschutzerklaerung/.
2.9 Legal bases
The processing of personal data always requires a legal basis. Art. 6(1) sentence 1 GDPR provides for the following options:
a) the data subject has given consent to the processing of his or her personal data for one or more specific purposes;
b) processing is necessary for the performance of a contract to which the data subject is party or in order to take steps prior to entering into a contract at the request of the data subject;
c) processing is necessary for compliance with a legal obligation to which the controller is subject;
d) processing is necessary in order to protect the vital interests of the data subject or of another natural person;
e) processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller;
f) processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data, in particular where the data subject is a child.
In the following sections, we will state the specific legal basis for each processing operation.
3. What happens on our website
When you visit our website, we process personal data about you.
To protect this data as well as possible against unauthorised access by third parties, we use SSL/TLS encryption. You can recognise this encrypted connection by the fact that the address bar of your browser shows https:// or a padlock symbol.
Below you will learn which data is collected when you visit our website, for what purpose and on what legal basis.
3.1 Data collection when accessing the website
When the website is accessed, information is automatically stored in so-called server log files. This is the following information:
• Browser type and browser version
• Operating system used
• Referrer URL
• Host name of the accessing computer
• Time of the server request
• IP address
This data is temporarily required in order to display our website to you reliably and without problems. In particular, this data serves the following purposes:
• System security of the website
• System stability of the website
• Troubleshooting on the website
• Establishing a connection to the website
• Displaying the website
Data processing is carried out pursuant to Art. 6(1)(f) GDPR on the basis of our legitimate interest in processing this data, in particular our interest in the functionality and security of the website.
Where possible, this data is stored in pseudonymised form and deleted once the respective purpose has been achieved.
Insofar as the server log files allow the data subject to be identified, the data is stored for a maximum period of 14 days. An exception applies if a security-relevant event occurs. In that case, the server log files are stored until the security-relevant event has been eliminated and fully investigated.
This data is not combined with other data.
3.2 Cookies
3.2.1 General
This website uses so-called cookies. A cookie is a data record – a piece of information – that is stored in the browser of your terminal device and relates to our website.
Setting cookies can, in particular, make it easier for visitors to navigate the website.
3.2.2 Technically necessary cookies
We use technically necessary cookies on this website so that our website works without errors and in accordance with applicable law. They help make the website user-friendly. Some functions of our website cannot be provided without the use of cookies.
Depending on the individual case, the legal basis for this is Art. 6(1)(b), © and/or (f) GDPR. Access to your terminal device is based on § 25(2) no. 2 TDDDG, as it is strictly necessary for the service you have requested.
3.2.3 Technically non-necessary cookies
We also use cookies on our website that are not technically necessary. Among other things, these cookies serve to analyse the browsing behaviour of website visitors or to offer website functions that are not strictly technically necessary.
The legal basis for this is your consent pursuant to Art. 6(1)(a) GDPR and § 25(1) TDDDG.
Technically non-necessary cookies are only set with your consent, which you can withdraw at any time in the cookie banner.
3.2.4 Consent management (Complianz)
We request and manage your consent with the WordPress plugin Complianz by the Dutch provider Complianz B.V. The plugin runs on our own server; no data is transmitted to the provider. Complianz stores your choice in cookies in your browser (names beginning with “cmplz_”, storage period 365 days) so that we do not have to ask you again on every visit. You can change or withdraw your choice at any time via “Manage consent” at the edge of the screen.
The legal basis is Art. 6(1)© GDPR in conjunction with Art. 7(1) GDPR (proof of consent) and § 25(2) no. 2 TDDDG.
3.3 Contacting us
a) E‑mail
If you contact us by e‑mail, we process your e‑mail address and any other data contained in the e‑mail. This data is stored on the mail server and partly on the respective terminal devices. Depending on the matter, the legal basis for this is generally Art. 6(1)(f) GDPR or Art. 6(1)(b) GDPR. The data is deleted as soon as the respective purpose no longer applies and deletion is possible under the statutory requirements.
b) Telephone
If you contact us by telephone, the call data may be stored in pseudonymised form on the respective terminal device and by the telecommunications provider used. Personal data collected during the call is processed solely to handle your enquiry. Depending on the matter, the legal basis for this is generally Art. 6(1)(f) GDPR or Art. 6(1)(b) GDPR. The data is deleted as soon as the respective purpose no longer applies and deletion is possible under the statutory requirements.
c) Contact form
We offer a contact form and a form for purchase enquiries. Both serve to contact our company.
In these forms, we generally process your first and last name, your telephone number, your e‑mail address, a postal address (for purchase enquiries, e.g. to send you a shipping box), details of your clock and the content of the message. The data is stored on our web server and forwarded internally to the responsible e‑mail addresses.
The forms run on our own server using the WordPress plugin Contact Form 7. No data is transmitted to the plugin’s developer.
You can optionally attach photos to your message. We use them exclusively to process your enquiry (Art. 6(1) sentence 1(b) GDPR). Your browser usually reduces the size of the photos before sending and removes metadata such as the location where they were taken. The photos are only stored temporarily on our web server, sent to us by e‑mail and then deleted from the web server.
Depending on the matter, the legal basis for this is generally Art. 6(1) sentence 1(f) GDPR or Art. 6(1) sentence 1(b) GDPR. The data is deleted as soon as the respective purpose no longer applies and deletion is possible under the statutory requirements.
To protect against spam and automated requests, we use the hCaptcha service in our forms. The provider is
Intuition Machines, Inc., 1065 SW 8th St #704, Miami, FL 33130, United States of America
https://www.hcaptcha.com/privacy
hCaptcha checks whether the form is being filled in by a human or by an automated program. For this purpose, in particular your IP address, information about your browser, operating system and terminal device, and your interactions with the page (e.g. mouse, scroll, keyboard and touch events) are transmitted to hCaptcha and evaluated. hCaptcha may set cookies for this (e.g. “hmt_id” with a storage period of up to 30 days).
The legal basis is Art. 6(1) sentence 1(f) GDPR; our legitimate interest lies in protecting our forms against spam and automated attacks. Access to information on your terminal device is based on § 25(2) no. 2 TDDDG (German Telecommunications Digital Services Data Protection Act), as it is strictly necessary for sending the form at your request. The transfer to the USA is based on the European Commission’s adequacy decision on the EU‑U.S. Data Privacy Framework, under which Intuition Machines, Inc. is certified.
d) WhatsApp
To communicate with customers or third parties, we use WhatsApp as an instant messaging service. This service is offered by WhatsApp Ireland Limited, 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland.
On our website we link to WhatsApp via a button. A connection to WhatsApp is only established when you click it.
To prevent WhatsApp or third parties from gaining access to the content of communications, communication takes place via end-to-end encryption. However, this generates metadata to which WhatsApp has access and which WhatsApp shares with its parent company Meta in the USA.
You can find more information here:
https://www.whatsapp.com/legal/#privacy-policy.
This data is stored until the data subject requests its deletion, withdraws consent to storage, or the purpose for storage no longer applies. Mandatory statutory provisions on retention periods remain unaffected.
For data transfers to the USA, the standard contractual clauses (SCC) of the European Commission apply.
Details:
https://www.whatsapp.com/legal/business-data-transfer-addendum.
The legal basis for this is Art. 6(1)(f) GDPR. The legitimate interest lies in communicating with customers and third parties as quickly and effectively as possible.
Where consent has been requested, the legal basis is Art. 6(1)(a) GDPR. This consent can be withdrawn at any time.
3.4 Website system
3.4.1 WordPress
Our website is built with the free software WordPress, which we run ourselves on the servers of our host IONOS (see 2.8). No data is transmitted to the developers of WordPress.
WordPress only sets technically necessary cookies, for example for our editors to log in to the administration area.
The legal basis is Art. 6(1)(f) GDPR; our legitimate interest lies in operating our website securely and conveniently.
3.5 Newsletter
3.5.1 Sign-up and delivery
When you subscribe to our newsletter, we process your e‑mail address, your name if provided, the selected language and the time and IP address of your sign-up. After signing up, you will receive an e‑mail with a confirmation link; your subscription is only complete once you click it (double opt-in). This ensures that nobody signs up with someone else’s e‑mail address and allows us to prove your consent.
We send the newsletter with the WordPress plugin “Newsletter” (developer: Web Agile Srl, Italy). The plugin runs on our own server at IONOS; your data is not transmitted to the developer. The plugin can record whether an issue was opened and which links in it were clicked (via a small image or redirect links). We use this analysis only to improve the newsletter.
The legal basis is your consent pursuant to Art. 6(1)(a) GDPR and § 7(2) no. 2 UWG (German Act against Unfair Competition). You can unsubscribe at any time via the unsubscribe link in every issue or by e‑mail to info@atmos-atelier.de. This does not affect the lawfulness of the processing carried out until then.
We store your data until you unsubscribe. After that, we keep your e‑mail address separately from other data on a suppression list so that we do not write to you again by mistake and can prove your earlier consent. The legal basis for this is Art. 6(1)(f) GDPR.
3.6 Third-party content
3.6.1 Google Fonts
We have integrated Google Fonts locally on our server. As a result, no data is transmitted to Google despite their use.
3.6.2 Showcase and Instagram – images and videos via Supabase
We load the photos of the clocks in our showcase (home page and sales pages) and the photos and videos on our “Instagram” page from a storage of the Supabase service. The provider is Supabase Pte. Ltd., 65 Chulia Street #38–02/03, OCBC Centre, Singapore 049513 (https://supabase.com/privacy). The data is stored in a data centre in Frankfurt am Main, Germany (Amazon Web Services); images and videos are delivered via the Cloudflare network.
When retrieving images and videos, your browser necessarily transmits your IP address, information about your browser and operating system, the requested address and the time to Supabase. No cookies are set. We have concluded a data processing agreement with Supabase (Art. 28 GDPR). Where data is transferred to countries outside the EU (in particular Singapore and the USA), this is safeguarded by the European Commission’s standard contractual clauses.
The legal basis is Art. 6(1)(f) GDPR; our legitimate interest lies in displaying our current offers and posts quickly and reliably.
3.6.3 Instagram posts
On our “Instagram” page we show posts from our Instagram account. Our server retrieves images, videos and texts via Instagram’s interface and stores them in the Supabase storage described in section 3.6.2. Your browser therefore does not connect to Instagram when you view the page or open a post. Only when you click a link to Instagram (such as “View post on Instagram”) are you taken to Instagram, a service of Meta Platforms Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland. The legal basis is Art. 6(1)(f) GDPR; our legitimate interest lies in presenting our work.
3.7 Other services
3.7.1 Gwolle Guestbook
On our website we use the WordPress plugin “Gwolle Guestbook” by Marcel Pol, https://wordpress.org/plugins/gwolle-gb/.
This is a guestbook. The data collected in connection with the use of Gwolle Guestbook is stored exclusively on the servers of this website and used only to display the guestbook on this website.
When an entry is made in the guestbook, the text of the entry, including any contact details provided, and the time of creation are stored. The data is not passed on.
The legal basis for processing is Art. 6(1)(a) GDPR. Consent can be withdrawn at any time.
This data is stored until the data subject requests its deletion, consent to storage has been withdrawn, or the purpose for storage no longer applies. Mandatory statutory provisions on retention periods remain unaffected.
Further information:
https://de.wordpress.org/plugins/gwolle-gb/.
3.7.2 Timeline – serial number search
On our “Timeline” page you can look up the year of manufacture of an Atmos by its serial number. The search runs on our own server. To protect against automated mass queries, we count search requests per IP address for 10 minutes. If there is an unusually high number of requests, the search is temporarily blocked and we receive a notification e‑mail containing the IP address. The counter is deleted automatically after 10 minutes; we delete notification e‑mails as soon as they are no longer needed.
The legal basis is Art. 6(1)(f) GDPR; our legitimate interest lies in protecting our data and our server against misuse.
3.8 Analytics and advertising
3.8.1 Google Tag Manager
We use Google Tag Manager by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (“Google”). We use this tool to manage the services listed below. Tag Manager itself does not set cookies or analyse data. However, your IP address is transmitted when it loads. We load Tag Manager partly via our own subdomain (load.ddfyzokd.atmos-atelier.de), which runs on a European server of the service provider Stape, Inc., 901 N Market St., Suite 100, Wilmington, DE 19801, USA, and partly directly from Google (www.googletagmanager.com). The legal basis is Art. 6(1)(f) GDPR; our legitimate interest lies in technically implementing your choice in the cookie banner and managing the services used centrally.
3.8.2 Google Analytics 4
If you consent to “Statistics” in the cookie banner, we use Google Analytics 4 by Google. This tells us how visitors use our website, for example which pages are viewed, for how long and from which source. For this purpose, Google sets cookies (e.g. “_ga”, “_ga_T2FV3Y70YK”, storage period up to 2 years) and processes information about your device, browser, approximate location and page views. Google Analytics 4 does not store full IP addresses. If you have allowed personalised advertising in your Google account, Google may link this data to your account (Google Signals) and use it for audiences in Google advertising. Event data is deleted after the configured retention period of no more than 14 months.
3.8.3 Google Ads conversion tracking
If you consent to “Marketing” in the cookie banner, we use Google Ads conversion tracking. If you reach our website via one of our ads on Google, this tells us whether, for example, an enquiry was then sent via our contact form. We cannot identify you personally. Google sets cookies for this (e.g. “_gcl_au”, storage period 90 days). With your consent, we also use remarketing: Google remembers that you have visited our website so that we can show you our ads later in Google advertising.
The legal basis for Google Analytics and Google Ads is your consent pursuant to Art. 6(1)(a) GDPR and § 25(1) TDDDG. You can withdraw it at any time via “Manage consent” at the edge of the screen. Google may also process data in the USA. The transfer is based on the European Commission’s adequacy decision on the EU‑U.S. Data Privacy Framework, under which Google LLC is certified. More information: https://policies.google.com/privacy.
4. Other important information
Finally, we would like to inform you fully and in detail about your rights and explain how you will be informed of changes to the data protection requirements.
4.1 Your rights in detail
4.1.1 Right of access under Art. 15 GDPR
You can request information as to whether personal data concerning you is being processed. If this is the case, you can request further information about the nature of the processing. A detailed list can be found in Art. 15(1)(a) to (h) GDPR.
4.1.2 Right to rectification under Art. 16 GDPR
This right covers the correction of inaccurate data and the completion of incomplete personal data.
4.1.3 Right to erasure under Art. 17 GDPR
This so-called “right to be forgotten” gives you the right, under certain conditions, to request that the controller erase your personal data. This is generally the case if the purpose of the data processing no longer applies, if consent has been withdrawn or if the original processing took place without a legal basis. A detailed list of reasons can be found in Art. 17(1)(a) to (f) GDPR. This “right to be forgotten” also corresponds to the controller’s obligation under Art. 17(2) GDPR to take reasonable steps to bring about a general erasure of the data.
4.2 Right to restriction of processing under Art. 18 GDPR
This right is subject to the conditions set out in Art. 18(1)(a) to (d).
4.2.1 Right to data portability under Art. 20 GDPR
This governs the fundamental right to receive your own data in a common format and to have it transmitted to another controller. However, this only applies to data processed on the basis of consent or a contract pursuant to Art. 20(1)(a) and (b), and insofar as this is technically feasible.
4.2.2 Right to object under Art. 21 GDPR
You can generally object to the processing of your personal data. This applies in particular if your interest in objecting outweighs the controller’s legitimate interest in the processing. You can object to processing for direct marketing purposes at any time without giving reasons.
4.2.3 Right regarding “individual decisions” under Art. 22 GDPR
You generally have the right not to be subject to a decision based solely on automated processing (including profiling) which produces legal effects concerning you or similarly significantly affects you. However, this right is also subject to restrictions and additions in Art. 22(2) and (4) GDPR.
4.2.4 Further rights
The GDPR includes comprehensive rights to have third parties informed whether or how you have exercised rights under Art. 16, 17, 18 GDPR – but only insofar as this is possible or feasible with reasonable effort.
At this point we would like to remind you once again of your right to withdraw consent you have given, pursuant to Art. 7(3) GDPR. However, this does not affect the lawfulness of the processing carried out up to that point.
We would also like to point out your rights under §§ 32 et seq. BDSG, which, however, are largely identical in content to the rights just described.
4.2.5 Right to lodge a complaint under Art. 77 GDPR
You also have the right to lodge a complaint with a data protection supervisory authority if you consider that the processing of your personal data infringes the GDPR. The authority responsible for us is the State Commissioner for Data Protection and Freedom of Information of North Rhine-Westphalia (LDI NRW), Kavalleriestraße 2–4, 40213 Düsseldorf, Germany.
5. What if the GDPR is abolished tomorrow or other changes occur?
This privacy policy is current as of 29 October 2026. As soon as we change this privacy policy, we will inform you on our website.
