Privacy Policy
Last updated: October 13, 2026.
1. Controller and contact
The controller for personal data processed through PrepHearth is:
Dennis Roy
Immelmann Str. 2
27356 Rotenburg
Germany
Email: user099@gmx.com
You can use the contact form for privacy requests. Please identify the request without sending unnecessary sensitive information.
2. Website delivery, hosting and security
This website uses Namecheap shared hosting, provided by Namecheap, Inc. and its service providers. When a page or file is requested, the hosting infrastructure processes technical information such as the IP address, requested URL, time, browser information, referrer where transmitted and response status. Server and security logs may contain these details.
We use this processing to deliver the website, diagnose failures and protect it against abuse. Where the GDPR applies, the legal basis is Article 6(1)(f), our legitimate interests in reliable, secure website operation. Administrative access is protected by WordPress and security software, which may process login attempts and technical request data for that purpose.
Namecheap’s Data Processing Addendum describes processing for its hosted services and includes provisions for international transfers, including standard contractual clauses where applicable. Processing may involve countries outside the EEA, including the United States. The relevant hosting and provider arrangements determine the actual processing locations; this notice does not claim that all data remains in Germany or the EEA. Further information and the applicable safeguards are available from the controller and in Namecheap’s privacy information.
3. Contact form and email
If you contact us, we process the name, email address, message topic, message and other information you provide to handle the enquiry and respond. Messages are delivered through the website’s email infrastructure to user099@gmx.com. The receiving mailbox uses GMX, provided by 1&1 Mail & Media GmbH. See GMX’s privacy information.
The legal basis for general correspondence is Article 6(1)(f) GDPR, our legitimate interest in responding to enquiries. If a message concerns a contract or steps requested before a contract, Article 6(1)(b) applies to that processing. Supplying the form’s requested contact details and a message is necessary to process a form enquiry; you are not required to contact us.
The custom form does not subscribe you to a mailing list or save message contents in its own database table. Message contents are processed and retained in the delivery and mailbox systems. For abuse prevention, the form uses a security token, an anti-bot field and short-lived salted hashes for rate limiting and duplicate detection. The custom rate and duplicate records expire after ten minutes; they do not store a raw IP address or the message text. Hosting, mail and security systems can maintain their own logs.
4. Cookies and consent settings
CookieAdmin provides the displayed cookie-preference controls and can store the preference in your browser. WordPress can use session or authentication cookies for administrative access. Necessary storage is used to provide requested functions, including remembering privacy choices and maintaining secure sessions. Where applicable, the GDPR basis is Article 6(1)(f); necessary device storage is covered by the relevant exception in § 25(2) TDDDG. Optional device storage requires the applicable consent under § 25(1) TDDDG and, for consent-based personal-data processing, Article 6(1)(a) GDPR.
You can adjust optional choices through the site’s cookie controls and manage or remove cookies and site storage in your browser. Consent can be withdrawn for the future. The controls and browser settings show the applicable stored items; duration depends on the configured function, session or preference expiry. This site currently does not deploy Google Analytics or a visitor-marketing analytics script.
5. Google Search Console
The publisher uses Google Search Console to review the site’s visibility, indexing and performance in Google Search. Search Console reports information supplied by Google about search results and crawling. We do not embed a Search Console visitor-tracking script on this website. Search Console is not used here as Google Analytics or to identify individual website visitors.
6. External product images and links
Some product images are loaded from merchant image infrastructure, including cdn.shopify.com and s3.amazonaws.com. Loading such an image makes a browser request to that provider, transmitting technical request information including the IP address and browser/request metadata. We use product images to display the relevant product information; the GDPR basis for this display is Article 6(1)(f), our legitimate interest in an understandable, informative presentation.
These services may process information outside the EEA. Provider and merchant privacy information explains their respective processing and transfer arrangements. General provider information is available from Shopify and Amazon Web Services. The image host is not necessarily the merchant that sells the product.
Affiliate and other external links lead to third-party websites. When you follow one, the destination may process information under its own notice, including affiliate attribution and cookies. Affiliate parameters may identify the referring website. Read the destination’s privacy information and our affiliate disclosure. We do not receive your full payment or order details through the contact form as part of a retailer transaction.
7. Recipients and retention
Access is limited to the operator and providers involved in hosting, security, email delivery and the particular external service described above, as needed for their functions. Information may also be disclosed where required by law or necessary to establish, exercise or defend legal claims.
Enquiry records are retained for as long as needed to resolve the request and relevant follow-up, and longer where a statutory duty or a legal claim requires retention. Technical logs are retained according to the operational security purpose and applicable hosting/security configuration; data is deleted or anonymized when no longer required. Provider backups can expire on their backup rotation rather than immediately on deletion of a live record. You can ask the controller for information about the retention applicable to your enquiry or a particular record.
8. Your rights
Where the GDPR applies and its conditions are met, you can request access, rectification, erasure, restriction and data portability under Articles 15–20 GDPR. You can withdraw consent for future processing where processing is based on consent.
Where processing is based on Article 6(1)(f), you may object under Article 21 GDPR for reasons relating to your particular situation. Contact the controller using the details above. We may need appropriate information to verify a request, without asking for more personal information than necessary.
You may complain to a data-protection supervisory authority, including the authority where you live, work or consider a violation occurred. The authority for the operator’s location is Der Landesbeauftragte für den Datenschutz Niedersachsen. This does not limit your ability to contact another competent authority.
9. Scope and updates
We do not use the contact form for automated decisions with legal or similarly significant effects. This notice covers the current website configuration described above. It will be revised when the services or processing change.