Privacy policy

1. Controller

Sebastian Blens, Blens Business Solutions, c/o Praxis Dr. Torsten Blens, Blumachergasse 5d, 50259 Pulheim, Germany, phone +49 177 4975258, email kontakt@blens-bs.de.

2. Hosting and server logs

This website is hosted by STRATO GmbH, Otto-Ostrowski-Straße 7, 10249 Berlin, on servers in Germany. Each time a page is requested, the server automatically records the page, date and time, amount of data transferred, browser and operating system, referring page and your IP address. These logs are used to run the website securely and reliably. STRATO keeps the full IP address for no more than seven days to detect and defend against attacks; in the log files available to us, it is anonymised.

The legal basis is Art. 6(1)(f) GDPR; our legitimate interest is the secure operation of the website. STRATO processes this data as our processor under Art. 28 GDPR.

3. Contact form and email

When you contact us through the form or by email, we process your name, email address, your business name if you provide it, and your message. The web server passes the form details directly to STRATO’s mail server, which delivers them to our mailbox; it does not store them in a database or in log files.

We use this information to answer your enquiry and, where relevant, to prepare a quotation. The legal basis is Art. 6(1)(b) GDPR where your enquiry relates to a contract, and otherwise Art. 6(1)(f) GDPR (our legitimate interest in responding to enquiries).

We keep your enquiry while we are in contact. If there has been no contact for twelve months, we delete or anonymise it unless we are legally required to keep it.

4. Protecting the contact form from misuse

The form accepts no more than five messages per sender per hour. To enforce this, the server creates a checksum (SHA-256) from your IP address and a secret random value and stores it with a timestamp for one hour, after which the entry is deleted. Your IP address itself is not stored for this purpose. The checksum is pseudonymous rather than anonymous and therefore still personal data; we use it for no other purpose.

The form also contains an invisible field that only automated programs fill in. Such submissions are discarded.

The legal basis is Art. 6(1)(f) GDPR; our legitimate interest is preventing misuse.

5. Storage in your browser

When you submit the contact form, your input is briefly kept in your browser’s sessionStorage so that it is not lost if an error message appears. The entry is deleted once the message has been sent and never leaves your browser.

The ‘Hüpfhafen’ demo stores your basket, bookings, gift vouchers and newsletter sign-up only in your browser’s localStorage. None of this is sent to a server. ‘Reset demo’ deletes it at any time.

Storing this information in your browser does not require consent under § 25(2) no. 2 TDDDG (German Telecommunications Digital Services Data Protection Act) and, for UK visitors, regulation 6(4) PECR, because it is strictly necessary for a feature you have expressly chosen to use. Where personal data is processed, the legal basis is Art. 6(1)(f) GDPR; our legitimate interest is that the contact form and demo work reliably.

6. No cookies, no tracking

This website sets no cookies and uses no analytics or tracking services. Fonts and all other files are served from our own server, not by third parties such as Google. That is why there is no cookie banner.

7. Contacting businesses

We contact leisure and experience businesses to introduce our services. For this we process information about businesses and their owners or contact persons. This section provides the information required by Art. 14 GDPR and Art. 14 UK GDPR.

Data processed: business name, name of the owner or contact person, business contact details (email address, phone number, postal address, website), legal form and register details, publicly visible information about services, booking methods, gift vouchers and reviews, and our correspondence with you.

Sources: publicly available business websites and legal notices, online business directories and map services, review platforms, press coverage, and public registers such as Companies House and the German commercial register.

Purpose and legal basis: developing business relationships and marketing our services, under Art. 6(1)(f) GDPR and, for businesses in the United Kingdom, Art. 6(1)(f) UK GDPR. Our legitimate interest is to make a specific offer to businesses for which our services are relevant. In the UK we email only limited companies and other corporate subscribers within the meaning of the Privacy and Electronic Communications Regulations (PECR), not sole traders.

Selection: we assess whether a business is a good fit based on publicly available information, such as the services it offers and how customers book, and we use automated tools to help with this. Every message is reviewed and approved by us personally before it is sent. No decision based solely on automated processing within the meaning of Art. 22 GDPR is made.

Recipients: STRATO GmbH, Berlin, as our processor for email mailboxes. We store the data itself in our own system on a server in Germany.

Retention: if there has been no activity for twelve months, the personal data is anonymised automatically. The period runs from the most recent event: adding the business, the last contact, the last email received, an agreed appointment or a scheduled follow-up. Clients and businesses with which a quotation, contract or invoice exists are excluded; statutory retention periods apply to them. We also keep data for as long as it is needed to establish, exercise or defend legal claims.

Suppression record: if you object or ask us to delete your data, this applies to your entire business. We then keep only a suppression record so that we do not contact you again. It contains your email addresses (normalised to lower case), your website domain and an identifier formed from the business name and location, each stored only as a checksum (hash). The legal basis is Art. 6(1)(f) GDPR; our legitimate interest is to respect your objection permanently.

Right to object: you can object to the use of your data for marketing at any time, without giving reasons (Art. 21(2) GDPR and UK GDPR). A short reply to our email or a message to sebastian@blens-bs.de is enough, and we will not contact you again.

8. Clients and projects

If you commission us, we process the data needed for the quotation, contract, project and invoicing (Art. 6(1)(b) GDPR) and keep invoices and business records for the period required by German tax law (Art. 6(1)(c) GDPR).

Where we process your customers’ data on your behalf, for example as part of website administration, we conclude a data processing agreement with you under Art. 28 GDPR.

9. Your rights

You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and to object (Art. 21). To exercise these rights, contact us at the address above.

You may also lodge a complaint with a data protection authority. Our lead authority is the Data Protection Commissioner of North Rhine-Westphalia (Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen), Kavalleriestraße 2–4, 40213 Düsseldorf, Germany. In the UK you can complain to the Information Commissioner’s Office (ico.org.uk).

You are not obliged to provide us with any data. Without it, however, we cannot respond to your enquiry.

10. Effective date

Last updated: November 2026. We will update this policy whenever our data processing changes.