Information pursuant to Article 13 GDPR

Privacy information

Last updated: 15 September 2026

1. Controller

2. Purpose of this appointment website

This website is used exclusively to display available conversation times, receive appointment requests, approve them personally and manage them afterwards. There is no advertising, audience measurement, profiling or automated decision-making. AI processing is not enabled.

3. Accessing the website and hosting

When you access the website, technically necessary connection data is processed. This may include your IP address, the date and time of access, the requested address, the amount of data transferred, browser and operating-system information, and the previously visited page. This processing is necessary to provide the website securely and reliably and to prevent misuse. The legal basis is Article 6(1)(f) GDPR; the legitimate interest is the secure and reliable operation of this website.

Hosting, database and email services are provided by:

Further information: ALL-INKL.COM privacy information.

4. Appointment requests

When you request an appointment, we process the following information:

• your name and email address,
• optionally, your phone number,
• the booking access selected (general or area leader), type of conversation, requested time, time zone and chosen meeting location or video service,
• optionally, a short note,
• the request status, technical identifiers and the time at which you accepted the privacy terms.

The required information is needed to review your request, coordinate the appointment and communicate with you. The legal basis is Article 6(1)(b) GDPR for steps taken prior to entering into a contract or for organising the requested conversation. Voluntary information is processed on the basis of your consent under Article 6(1)(a) GDPR. You may withdraw your consent at any time with effect for the future.

Please do not submit confidential, health-related, pastoral or otherwise particularly sensitive details through the form. Such matters should only be discussed during the personal conversation.

5. Email communication

To process your request, the system sends notifications via termine@allgaiers.com. Sender and recipient addresses, subject, message content and delivery status are processed for this purpose. Messages are sent through ALL-INKL.COM servers. Appointment-related queue entries are deleted together with the corresponding request.

6. Google Calendar

To determine available times, the application uses a protected server-side connection to request only busy periods from the authorised Google calendars. Visitors do not connect directly to Google, and no Google content is embedded on the public appointment website.

A private calendar entry is created only after personal confirmation. It contains the name, email address as an invited participant, selected booking access, appointment period, selected meeting location or video service, and an internal booking identifier. If Google Meet is selected, an individual access link is generated. The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Processing in countries outside the EU or EEA cannot be ruled out. The legal basis is Article 6(1)(b) GDPR and, where required, the consent given in the form under Article 6(1)(a) GDPR.

Further information: Google Privacy Policy. Calendar entries are retained in accordance with the settings of the Google calendar used and deleted once they are no longer needed for appointment organisation.

7. Online conversations via Zoom

If you select Zoom, an access link is stored in the appointment request, the private calendar entry and the confirmation email after personal approval. This appointment website does not establish a direct connection to Zoom. Data is transferred to Zoom only when you open the access link. The provider’s privacy terms then apply.

8. Technically necessary session

The application uses only a technically necessary session cookie. It protects forms and the secure administration area, contains no advertising or analytics identifier, and expires when the browser is closed. This storage is necessary to provide the service expressly requested.

9. Secure action links

Approval, alternative-appointment and change functions use randomly generated, time-limited action links. Only cryptographic hashes of these tokens are stored in the database. Approval links remain valid until the requested appointment begins and become invalid after use. The personal link for a confirmed appointment allows a rescheduling request or cancellation up to 24 hours before the appointment starts and then becomes invalid automatically. Google OAuth credentials are stored in encrypted form.

10. Retention and deletion

• Expired or declined requests are deleted after 30 days.
• Confirmed or cancelled requests are deleted 90 days after the appointment.
• Technical logs of administrative actions are deleted after 180 days.
• Open requests expire when the requested appointment begins if they have not been processed by then.

Statutory retention obligations may require longer storage in individual cases. Data may be deleted sooner if it is no longer needed and there are no statutory or contractual grounds for retaining it.

11. Recipients and disclosure

Access is limited to the controller and technically necessary service providers. Recipients may include ALL-INKL.COM for hosting and email services and Google for confirmed calendar entries. Data is not disclosed for advertising purposes.

12. Your rights

Subject to the statutory requirements, you have the right of access, rectification, erasure, restriction of processing, data portability and objection. You may withdraw consent at any time with effect for the future. To exercise these rights, contact termine@allgaiers.com.

You also have the right to lodge a complaint with a data-protection supervisory authority. The competent authority includes the State Commissioner for Data Protection and Freedom of Information of Baden-Württemberg.

13. Security and changes

Data is transmitted securely via HTTPS. The application uses access controls, secure sessions, rate limits, and encrypted or hashed credentials. Despite these measures, transmitting data over the internet can never be entirely risk-free.

This privacy information will be updated if functions, service providers or legal requirements change.