Data Protection

Privacy Policy

1. Controller

Hospitalalarm.comIngo HerteltHelene-Meiser-Weg 2 · 44227 Dortmund · GermanyEmail: info@hospitalalarm.com

2. Principles of Data Processing

Personal data is processed where necessary for the technical operation of the website, handling enquiries, pre-contractual communication or compliance with legal obligations. Data is disclosed only where necessary for these purposes, where a legal obligation applies or where another legal basis exists.

3. Server Log Files

When this website is accessed, the hosting provider stores technically necessary access data, including date and time of access, requested file, amount of data transferred, HTTP status code, browser type and operating system, referrer URL and the IP address of the requesting system. Processing is based on Article 6(1)(f) GDPR (legitimate interest in technical operation, security and error analysis). Data is deleted once the purpose has been fulfilled unless statutory retention obligations apply.

4. Contact Form and Email Contact

If you use the contact form or send an email, the information you provide — in particular name, email address, organisation, topic and message — is processed to handle your enquiry. Where the enquiry concerns the initiation or performance of a contract, processing is based on Article 6(1)(b) GDPR. Other relevant enquiries are processed on the basis of Article 6(1)(f) GDPR; the legitimate interest is handling and responding to the enquiry.

Support requests sent by email are processed for the same purpose. Do not submit passwords, credentials, patient data, medical information or other unnecessary confidential content through the public website or ordinary email.

5. Form Delivery (PHPMailer / Server-Side Mail Transport)

Form submissions are sent server-side using the PHPMailer library. Depending on the production configuration, the server uses its local mail transport or an authenticated SMTP connection. The submitted information is transmitted to the recipient address configured for contact requests. Hosting and email service providers may be involved as technical recipients or processors where necessary for operation and message delivery.

6. Technical Security Functions (Session / CSRF / Honeypot)

A server-side PHP session with a CSRF token is used to protect the forms. The session cookie is technically necessary and does not require consent under Section 25(2)(2) TDDDG. A honeypot field, a minimum form-completion time and IP-based rate limiting are also used to reduce automated misuse. The IP address is not stored in plain text in form logs; a hash is processed for technical checks.

This website uses a technically necessary session cookie for form protection and session management. Display and accessibility preferences selected by users, as well as the decision concerning optional web statistics, are stored locally in the browser.

Optional web statistics are activated only after explicit consent. In particular, time, requested page, referrer, browser and device information, language, time zone, screen and viewport size and the IP address are processed. Server-side, the IP address is used to derive an approximate geographic assignment and an additional hash value. Analysis is performed within the infrastructure operated for Hospitalalarm.com; IP geolocation is carried out using a locally operated geodatabase. Raw statistics data is intended to be deleted after 30 days. The actual deletion routine is operated in the connected statistics infrastructure and must be reviewed again if the technical integration changes. Where optional statistics rely on consent, processing is based on Article 6(1)(a) GDPR; storage of or access to information on the end device is governed by Section 25 TDDDG.

Consent to optional statistics can be changed or withdrawn at any time with effect for the future. The lawfulness of processing carried out before withdrawal remains unaffected. Change Cookie Settings

Fonts, stylesheets and images on the public website are served locally. Map tiles for an internal statistics display are not part of publicly accessed pages.

8. Recipients and Data Processing on Behalf

Technical service providers are used for hosting and email delivery. They receive data only to the extent required for operation, security and message transmission. Optional web statistics are processed within the infrastructure operated for Hospitalalarm.com. Hosting and email service providers must be documented in the internal data-protection records and data processing agreements in accordance with their actual role and the production configuration.

9. Data Subject Rights

Subject to the GDPR, you have rights of access (Article 15), rectification (Article 16), erasure (Article 17), restriction of processing (Article 18), data portability (Article 20) and objection (Article 21). You also have the right to lodge a complaint with a competent data-protection supervisory authority. In North Rhine-Westphalia, this is the State Commissioner for Data Protection and Freedom of Information (LDI NRW).

10. Retention Period

Contact enquiries are generally stored only for as long as necessary for handling, subsequent communication and any applicable statutory evidence or retention obligations. The data is then deleted or processing is restricted. Raw data from optional web statistics is intended to be deleted after 30 days. Actual implementation must be verified in the connected statistics infrastructure.

11. Version and Changes

Version: 21 September 2026. Changes to hosting, forms, cookies, web statistics or external services require a new review and, where necessary, an update of this policy.