Legal
We process as little data as possible. This policy tells you what data that is, what we use it for and what rights you have.
This is a translation for your convenience. The legally binding version is the German privacy policy.
| Controller | Naturopathic practice Michael Stolpmann Linienstraße 152, 10115 Berlin, Germany |
|---|---|
| Phone | 030 97 89 44 44 |
| kontakt@praxisstolpmann.de |
This website is operated by IONOS SE, Elgendorfer Straße 57, 56410 Montabaur, Germany, on servers in Germany. IONOS processes the data solely on our behalf and is bound by contract under Article 28 GDPR.
Each time a page is called up, data your browser transmits is recorded automatically: IP address, date and time, the address requested, the amount of data transferred, browser type and version, operating system and the page visited before.
We need this data to deliver the website, to keep it stable and to fend off attacks. The legal basis is our legitimate interest in secure operation (Article 6(1)(f) GDPR). We do not evaluate the logs permanently and do not combine them with other data; our hosting provider deletes them automatically as soon as they are no longer needed for secure operation.
The connection to this website is encrypted using TLS. You can recognise this by the padlock symbol in your browser’s address bar.
We store your cookie choice in a technically necessary cookie. Statify and ALTCHA do not set tracking cookies. Logging into the WordPress backend and login protection may use additional technically necessary session or security cookies (section 25(2) TDDDG).
We additionally store the same entry in the local storage of your browser, so that your choice is kept even if the cookie is lost. It does not leave your device and is not transmitted to us. The legal basis is section 25(2) TDDDG; this storage is technically necessary in order to respect your decision.
| Name | stolpmann_consent |
|---|---|
| Purpose | Stores which categories you have allowed |
| Lifetime | 180 days |
| Legal basis | Section 25(2) TDDDG (technically necessary), Article 6(1)(f) GDPR |
Using “Cookie settings” in the footer of every page you can adjust or withdraw your choice at any time. A withdrawal takes effect from that moment; processing carried out beforehand remains unaffected.
We do not use advertising trackers or embedded social media buttons. The font files used on this website are loaded from our own web server. The directions map is an external OpenStreetMap service; its map tiles are retrieved from that service’s servers after you consent. Details are provided in the following section.
We use Statify to understand which pages of our website are viewed. Statistics are stored in our own WordPress database on our IONOS webspace. They contain the date of the view, the requested page and, where the browser supplies it, the referring website. Statify does not store IP addresses, set cookies, use fingerprinting or create visitor profiles. It counts page views without identifying individual people. Logged-in users are excluded.
Statify is configured to retain data for 90 days; older view records are removed by automatic cleanup. No statistics are sent to an external analytics service. We use them to improve our information service. To the extent that personal connection data is processed during technical transmission, the legal basis is our legitimate interest in this data-minimising evaluation (Article 6(1)(f) GDPR). General server log files are described under “When you visit this website”.
We run NinjaFirewall on our own webspace to protect the website against attacks. The firewall checks incoming requests and may block suspicious requests. This may involve processing the IP address, time, requested URL, technical request data, suspicious parts of a request and the reason a security rule was triggered. Login and administration events may also be logged together with the username and type of event. This protection is not used for visitor analytics.
Masking of public IP addresses in the firewall log is enabled. Technically exempt operations, particularly the separate login protection, may require unmasked IP addresses. Automatic deletion of firewall log entries after 30 days is configured. Evidence needed to investigate a specific security incident may be retained for longer. The legal basis is our legitimate interest in secure website operation (Article 6(1)(f) GDPR). Incoming requests are inspected on our server; automatic security-rule updates require outbound connections to the vendor’s update service.
On the home page and under “Parking & directions”, we embed the external OpenStreetMap map service. The displayed map tiles are loaded from the map service’s servers and are not provided by our web server. Until you consent, the map remains blocked and no connection to the map servers is established.
When you choose “Load map” or allow the “External services” category in Cookie settings, your browser loads map tiles from OpenStreetMap. This transmits, in particular, your IP address, the requested map areas and technical connection data to the map service. The provider is the OpenStreetMap Foundation, St John’s Innovation Centre, Cowley Road, Cambridge CB4 0WS, United Kingdom. Map tiles are delivered through a worldwide network of cache servers; processing is therefore not restricted to our IONOS server or exclusively to the United Kingdom. The legal basis is your consent (Article 6(1)(a) GDPR, section 25(1) TDDDG). You can withdraw it at any time via “Cookie settings”.
Through the forms on this website you can send us your name, your telephone number, your email address, a preferred time and a message. Only your name and one way of reaching you are required.
Your details are stored in the database of this website and additionally sent by email to the practice so that we can get back to you. The legal basis is the initiation or performance of a treatment contract (Article 6(1)(b) GDPR) or our legitimate interest in answering your enquiry (point (f)). We delete the enquiry once it has been dealt with and no statutory retention periods apply.
Form notifications are sent using encrypted SMTP through the IONOS mailbox website@praxisstolpmann.de. IONOS SE, Elgendorfer Straße 57, 56410 Montabaur, Germany, processes the necessary data on our behalf under Article 28 GDPR. The enquiry is also stored in this website’s WordPress database. When you submit the contact or callback form, your browser sends the entries directly to our web server over an encrypted connection. The confirmation or an error message appears within the form without reloading the page. This does not involve an additional external service; the processing and storage described here also apply to this submission method. We also store the technical sending status, sending time, form type and destination address with each enquiry. These details help us identify failed notifications and are deleted together with the enquiry. The sending log does not store an additional copy of message contents or passwords. Acceptance by the SMTP server does not confirm final delivery.
We use the self-hosted open-source software ALTCHA to protect our forms against automated enquiries and abuse. When you reach the contact section, our server provides a short-lived verification challenge. Your browser automatically performs a small computation. Our server checks the result before accepting a form submission. This involves processing technical verification values and the IP address needed for the connection.
The software needed for this protection is loaded from our own web server. It does not set additional cookies or store data in persistent browser storage. No requests are sent to ALTCHA or other CAPTCHA providers. The check is not used for advertising or to track your behaviour. The “Protected by ALTCHA” link opens the external website altcha.org only when you click it. Merely displaying the notice or performing the verification does not send data to that website. If you follow the link, the external website processes connection data under its own privacy policy.
To limit repeated attempts, our server stores short-lived identifiers derived from the IP address using a secret key. These identifiers are not stored in your browser or linked to the contents of your form. Verification proofs are valid for ten minutes and can be used only once. Identifiers used for rate limiting are valid for no more than one hour; expired identifiers are cleared automatically.
We keep a separate security log to detect and investigate technical anomalies. It records the time, the form concerned, the technical rejection reason, and a truncated IP address range (/24 for IPv4, /48 for IPv6). These events do not necessarily indicate intentional abuse. Names, telephone numbers, email addresses and message contents are not included in this security log. Retention is limited to seven days and a maximum of 2,000 entries. Automatic cleanup runs through hourly WordPress schedules triggered by website visits, as well as when the log is written or displayed. Processing and storage take place on our web server hosted by IONOS.
The legal basis for the form protection and security log is Article 6(1)(f) GDPR. Our legitimate interest is to prevent automated bulk submissions and attacks and to keep the practice reachable. Successful technical verification is required to submit the form. You are not obliged to use the form; if verification does not work, you can contact us by telephone or email.
A short note referring to this policy appears directly below every form.
Please do not describe complaints or previous illnesses through the form or by unencrypted email, but in person or on the medical history form that you bring with you to your appointment. Health data is specially protected (Article 9 GDPR) and unencrypted email is not secure enough for it.
We provide the medical history form as a PDF for download. The file is loaded from our own server; no data is transmitted to third parties, and what you write stays on your device — your entries in the PDF are not transmitted to us. Downloading the file produces the technical data described under “When you visit this website”. Please bring the completed form to your appointment on paper. Do not send it by unencrypted email.
The connection search on this website calculates nothing itself. Only when you select “Search connection” does the BVG journey planner open in a new window, and your starting point and desired time are passed on to BVG. As long as you select nothing, your entries do not leave this website.
The “Plan route” button leads to the route planner of OpenStreetMap. As long as you do not click it, nothing is transmitted. If you follow the link, the page of the OpenStreetMap Foundation opens in a new window; your IP address and technical details are transmitted there and their privacy policy applies. The practice is preset as the destination; you enter your starting point only there — it does not reach us.
We occasionally link to third-party websites. As soon as you follow such a link, the privacy policy of the respective provider applies; we have no influence on their content.
This policy concerns only the use of this website. How we process your data in the course of treatment — history, findings, laboratory results and billing — is explained to you at the practice; that processing is based on Article 9(2)(h) GDPR in conjunction with professional duties of confidentiality.
You have the following rights towards us at any time and can exercise them informally — a phone call or an email is enough.
You have the right to object at any time to the processing of your data where we base it on a legitimate interest (Article 21(1) GDPR). On this website that concerns the log files, form protection, the firewall and its security logs, technical processing for page statistics, and the answering of your enquiry. An objection is informal — a phone call or an email is enough. We will then no longer process the data unless we can demonstrate compelling legitimate grounds.
Independently of this, you can lodge a complaint with a data protection supervisory authority. The authority responsible for us is the Berliner Beauftragte für Datenschutz und Informationsfreiheit, Alt-Moabit 59–61, 10555 Berlin.
We adapt this policy when the website or the legal situation changes. The version published here applies in each case.
Last updated: 23 October 2026
Privacy settings
Choose which services this website may use. Your choice is stored in a cookie for 180 days and can be changed at any time using “Cookie settings” in the footer.
Technically necessary, for example to remember your cookie choices. No personal data is sent to third parties.
Loads the directions map using map tiles from OpenStreetMap. Your IP address is sent to the OpenStreetMap Foundation.
