Privacy Policy
Privacy Policy
Last updated: 5 September 2026
This privacy policy explains how personal data is processed when you visit this website or contact us. In its current technical configuration, the public website is deliberately data-minimising and does not use analytics or marketing trackers.
1. Controller
Plenum Communications GmbH
Prühßstraße 50
12105 Berlin
Germany
Phone: +49 30 220 118 25
Email: info@plenum-berlin.de
2. Website access and server logs
When a website is accessed, technically necessary connection data is transmitted to the web server. Depending on the production hosting configuration, this may include the IP address, date and time of access, requested URL or file, referrer URL, browser/user-agent information, HTTP status code and amount of data transferred.
Where necessary for secure and stable operation, troubleshooting and the prevention of misuse, processing is based on Article 6(1)(f) GDPR. Our legitimate interest is the secure, functional and technically reliable provision of the website.
Server log data is retained only for as long as necessary for operation, troubleshooting and the prevention of attacks. Longer retention takes place only where a specific security incident must be investigated or a statutory retention obligation applies.
3. Hosting and technical service providers
Hosting, infrastructure, email and IT service providers may be used for the technical operation of the website. They receive personal data only to the extent required to provide the relevant service. Where a service provider processes personal data on our behalf, an appropriate data processing agreement under Article 28 GDPR is used where legally required.
Personal data is transferred to countries outside the European Union or European Economic Area only where the requirements of Articles 44 et seq. GDPR are met. The production host and relevant subprocessors are reviewed as part of the go-live process.
4. Contact by form or email
If you contact us via the contact form or by email, we process the information you provide in order to handle and respond to your enquiry. The current contact form processes the fields name, company, email address, project type and project description.
Under the current website code, the form does not store the enquiry as a lead or contact record in WordPress. After successful validation, the enquiry is forwarded by email to the configured recipient. Further processing therefore takes place in the email system and, if an enquiry develops into a project or contract, in the business processes required for that purpose.
The legal basis is Article 6(1)(b) GDPR where your enquiry concerns steps prior to entering into or performing a contract. Other business or general enquiries are processed on the basis of Article 6(1)(f) GDPR; our legitimate interest is to respond to incoming communications and maintain business contacts.
Enquiries are deleted when they are no longer required for these purposes and no statutory retention requirement or legitimate reason for further retention applies. Contractual and business-relevant correspondence may be retained for longer where statutory retention requirements apply.
Please note that ordinary email communication is not technically end-to-end encrypted. For particularly confidential information, you may initially provide only the necessary project details and agree an appropriate transfer method with us.
5. Protection of the contact form against misuse
The contact form uses technical protection mechanisms including a WordPress security token (nonce), a hidden honeypot field, a minimum completion time and short-term rate limiting. For rate limiting, a cryptographically derived identifier is generated from the IP address and user agent. The current application code does not store the raw IP address as a contact record for this purpose; the derived identifier and a counter are stored as a WordPress transient for a maximum of 15 minutes. The sole purpose is to prevent automated or abusive use of the form. The legal basis is Article 6(1)(f) GDPR.
6. Interactive tools
The market, audience and navigator tools provided by the website are currently designed so that selections are processed in the browser and are not stored in WordPress as a personal user profile. They are not used for profiling or solely automated decisions with legal or similarly significant effects.
7. Cookies, browser storage and tracking
According to the currently reviewed technical configuration, the public website does not use analytics, marketing or social-media tracking cookies and does not use optional browser storage for advertising or profiling. Google Analytics, Meta Pixel and comparable tracking services are not currently loaded.
Information that is strictly necessary to provide a function expressly requested by the user may be used without consent where permitted by law. WordPress administration or login cookies mainly concern authenticated backend users and do not constitute public marketing tracking.
As long as no optional consent-requiring technology is used, the website does not display a purely precautionary cookie consent banner. If analytics, marketing trackers, external media or other consent-requiring technologies are introduced later, they must be reviewed, blocked until consent where required, and this privacy policy and the privacy/cookie settings must be updated.
8. External content, fonts and links
In the currently reviewed theme, visible website fonts are provided locally or through system fonts. The standard public frontend does not automatically load Google Fonts, external maps, social-media feeds or video embeds. Ordinary external links transfer connection data to the external provider only after you follow the link.
The CMS can technically host immersive content such as videos, 360° views, iframes or Unity/WebGL experiences. External sources must not be made public until the relevant provider and resulting data transfer have been reviewed and, where required, an effective consent mechanism has been implemented.
9. Recipients
Personal data may be disclosed, where necessary, to authorised internal personnel and to hosting, email and IT service providers. Other disclosure takes place only where a legal basis exists, you have given consent or we are legally required to do so. We do not sell personal data to advertisers.
10. Data security
We use appropriate technical and organisational measures to protect personal data against loss, misuse, unauthorised access and unauthorised alteration. The production website should be provided exclusively over encrypted HTTPS. Absolute security of data transmission over the internet cannot, however, be guaranteed.
11. Your rights
Subject to the statutory requirements, you have in particular the right of access, rectification, erasure, restriction of processing, data portability and the right to object to processing based on Article 6(1)(e) or (f) GDPR. Where processing is based on consent, you may withdraw that consent at any time with effect for the future.
To exercise your rights, contact info@plenum-berlin.de.
12. Right to lodge a complaint
You have the right to lodge a complaint with a data protection supervisory authority. For a company established in Berlin, the relevant authority is in particular:
Berliner Beauftragte für Datenschutz und Informationsfreiheit
Alt-Moabit 59–61
10555 Berlin
Germany
Phone: +49 30 13889-0
Email: mailbox@datenschutz-berlin.de
13. Requirement to provide data / automated decisions
You are generally not required to provide personal data through the website. However, we need the fields marked as required in the contact form in order to process an enquiry. No solely automated decision-making, including profiling, within the meaning of Article 22 GDPR takes place in the current website setup.
14. Changes to this privacy policy
We update this privacy policy when the website, the service providers used or the legal framework changes. The version published on this website is the applicable version.