Configure

Legal

Privacy policy

This is an English courtesy translation provided for convenience. In the event of any discrepancy, the German version is legally binding.

Last updated: 10 September 2026

This privacy policy explains which personal data we process when you visit the website www.pemediacorp.com, use our forms or engage our services, on which legal basis this takes place, how long we keep the data and which rights you have.

1. Controller

Plößl & Ehrl Vertriebs UG (haftungsbeschränkt), a German company with limited liability
Brand: Pemediacorp
Boschstr. 4
82178 Puchheim
Germany

Managing directors: Luis Maximilian Plößl, Lorenz Ehrl
Telephone: +49 155 10429643
Email: kontakt@pemediacorp.com
Commercial register: HRB 303556, Amtsgericht München (Munich district court)

Controller within the meaning of Art. 4 (7) GDPR. We are not obliged to appoint a data protection officer (Art. 37 GDPR, § 38 of the German Federal Data Protection Act, BDSG). Please direct questions about data protection to the email address above.

2. Hosting, delivery and email

a) Server

This website runs on a server operated by us. The server is provided by ZAP-Hosting GmbH, Bahnhofstraße 6, 54338 Schweich, Germany (processing on our behalf, Art. 28 GDPR). The data listed in section 3 a) (such as IP address, device information, access times) is processed on servers within the European Union. The database holding form submissions and the consent log is also located on this server.

b) Cloudflare (DNS and delivery)

To secure and speed up delivery we use the DNS service and the content delivery network of Cloudflare, Inc., 101 Townsend Street, San Francisco, CA 94107, USA. Requests to our website pass through Cloudflare's servers; the data processed is in particular your IP address and technical connection data. A transfer to the USA is possible; Cloudflare is certified under the EU-US Data Privacy Framework (adequacy decision of the European Commission, Art. 45 GDPR). A data processing agreement is in place with Cloudflare.

c) Email mailboxes

Our mailboxes kontakt@pemediacorp.com and support@pemediacorp.com are operated with Google Workspace, a service of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (processing on our behalf, Art. 28 GDPR). A transfer to Google LLC in the USA is possible; Google LLC is certified under the EU-US Data Privacy Framework. Notifications about form submissions are sent by our own server over an encrypted SMTP connection into these mailboxes. If you write to us by email, your message is stored in the same mailbox system.

d) Hosting of the 360° tours

The walk-through 360° tours on our pages (in particular under /virtueller-360-rundgang) are stored on web space booked by us with Mittwald CM Service GmbH & Co. KG, Königsberger Straße 4-6, 32339 Espelkamp, Germany (processing on our behalf, Art. 28 GDPR). The tours are loaded as embedded content (iframe) from the addresses p-pb4hik.project.space and p-ev80wd.project.space. In the process, the provider, acting as our processor, receives your IP address and technical connection data (browser, time, file retrieved); the processing takes place in Germany. The provider sets no cookies and uses no analytics tools for the display.

Legal basis for a) to d): Art. 6 (1) (f) GDPR (legitimate interest in a secure, fast and functioning website and in reachable communication).

3. Collection and processing of personal data

a) When you visit the website (server log files)

When you access our website, your browser automatically transmits information to the server, which is stored there temporarily in log files:

  • IP address
  • date and time of access
  • name and URL of the file retrieved
  • website from which the access originates (referrer URL)
  • browser used, operating system and name of the access provider

This data is not merged with other data sources and serves exclusively the operation, security and error analysis of the website.

Legal basis: Art. 6 (1) (f) GDPR.
Retention: log files are deleted after 14 days.

b) Contact and support form

Through the contact form (project enquiries) and the support form (matters concerning ongoing projects) we process the following details:

  • first name and last name (required)
  • email address (required)
  • subject (required)
  • message
  • optional: company name and telephone number
  • time of submission and language of the page (German or English)

Without the required details we cannot handle your enquiry; all further details are voluntary. Every submission is stored in a database on our own server (section 2 a) and delivered by email to kontakt@pemediacorp.com (contact form) or support@pemediacorp.com (support form). To protect against automated submissions we use Cloudflare Turnstile (section 5); in addition we limit the number of submissions per sender (section 10).

Legal basis: Art. 6 (1) (b) GDPR (initiation or performance of a contract), for general enquiries Art. 6 (1) (f) GDPR (legitimate interest in answering your enquiry).
Retention: enquiries that do not lead to a contract are deleted twelve months after the last communication. If a contract is concluded, we keep the related correspondence within the commercial and tax law retention periods (six or ten years, § 257 of the German Commercial Code (HGB), § 147 of the German Fiscal Code (AO)).

c) Website configurator (quote request)

Through our website configurator you can put together a package and send a non-binding quote request. In doing so we process:

  • name
  • email address
  • telephone number
  • the packages and additional services selected as well as the resulting non-binding price indication

Purpose: preparation of a quote and contacting you to handle your enquiry. No contract is concluded through the configurator.

Encryption: your entries are encrypted in your browser with the public key of our server (in addition to TLS transport encryption) and are decrypted only on our server.

Storage: the request is stored on our own server (section 2 a). After submitting, you automatically receive a confirmation email at the address you provided; it is sent through our own systems.

Spam protection: when the request is submitted we use Cloudflare Turnstile. The associated script is loaded only when you open the enquiry dialog (details in section 5).

Legal basis: Art. 6 (1) (b) GDPR (pre-contractual measures), additionally Art. 6 (1) (f) GDPR (legitimate interest in efficient handling).
Retention: as under b).

d) Contact by email or telephone

If you contact us by email or telephone, we process the data transmitted in the process (name, contact details, content of the enquiry) in order to handle your request.

Legal basis: Art. 6 (1) (b) GDPR, otherwise Art. 6 (1) (f) GDPR.
Retention: as under b).

e) Quotes, contracts and invoices

If you place an order with us, we process the data required for performing the contract (name, company, address, contact details, contract, project and invoice data).

Legal basis: Art. 6 (1) (b) GDPR; for the retention of business records Art. 6 (1) (c) GDPR in conjunction with § 257 HGB and § 147 AO.
Retention: six or ten years from the end of the calendar year in which the contract was completed.

4. Cookies and consent

We use exactly two cookies of our own and no local storage:

  • pemc_consent_v1 (category Necessary): stores your decision in the cookie banner, the version of the banner and a random, pseudonymous identifier for the consent log. Lifetime: 12 months.
  • pemc_session_id (category Statistics, only with your consent): a random identifier used to group several visits from the same browser in the reach measurement. Lifetime: 30 days.
  • Google cookies (category External content, only with your consent): set by google.com as soon as you load the location map or a 360° tour (for example NID). Lifetime: up to six months. We have no access to these cookies; you can delete them in your browser (section 5, location map and 360° tours).

The cookie banner appears on your first visit and again whenever the categories change. "Necessary only" and "Accept all" are designed as equal options; closing the banner does not count as consent. You can change or withdraw your choice at any time via the "Cookie settings" link in the footer of every page; the withdrawal takes effect for the future, and the statistics cookie is deleted in the process, and neither the location map nor the 360° tours are loaded any more.

Consent log: to be able to demonstrate your cookie choice (Art. 7 (1) GDPR) we store the time, the categories selected, the version of the banner, the pseudonymous identifier from the consent cookie, a truncated checksum of your IP address that is re-encrypted daily, and a shortened browser identifier. We delete these records three years after your last change (standard limitation period, § 195 of the German Civil Code, BGB).

Legal bases: for the necessary cookie § 25 (2) no. 2 of the German Telecommunications Digital Services Data Protection Act (TDDDG) and Art. 6 (1) (f) GDPR; for the consent log Art. 6 (1) (c) GDPR in conjunction with Art. 7 (1) GDPR; for the statistics cookie § 25 (1) TDDDG and Art. 6 (1) (a) GDPR.

5. Services and content used

Cloudflare Turnstile (spam protection for the forms)

We protect the contact form, the support form and the quote request in the website configurator with "Cloudflare Turnstile", a service of Cloudflare, Inc., 101 Townsend Street, San Francisco, CA 94107, USA. The Cloudflare script is not loaded when the page opens, but only once you start working with the form (first click or first input in the form, or opening the enquiry dialog in the configurator). If you only read the page, no connection to Cloudflare is established. Turnstile evaluates technical information such as your IP address, browser and device information and interaction data in order to distinguish human users from automated programs, and sets no cookies on our domain. The result of the check (a single-use token) is transmitted with the form when you submit it and is verified against Cloudflare by our server (contact and support) or by our backend api.pemediacorp.com (configurator).

The legal basis is Art. 6 (1) (f) GDPR (legitimate interest in protecting the forms against automated misuse); access to information on your device is strictly necessary for the service you request, namely submitting the form (§ 25 (2) no. 2 TDDDG). A transfer to the USA is possible; Cloudflare is certified under the EU-US Data Privacy Framework (Art. 45 GDPR). If you prefer not to use the service, you can send your enquiry to us by email or telephone at any time.

Further information: the Cloudflare privacy policy at cloudflare.com.

Reach measurement with Umami (self-hosted)

For reach measurement we use the open source analytics software Umami, which runs entirely on our own server (analytics.pemediacorp.com). No data is transmitted to third parties. Umami stores no complete IP addresses; visits are counted by means of a hash value that changes daily, formed from the IP address, the browser identifier and a random value renewed every day, and that can no longer be attributed once the day has ended. The data collected covers pages viewed, referrer, browser type, device type, screen size, language and country. Measurement only takes place if you have consented to the "Statistics" category in the cookie banner; in that case we set the cookie pemc_session_id (section 4). If your browser sends the "Do Not Track" signal, no measurement takes place even with consent.

Legal basis: Art. 6 (1) (a) GDPR (consent), § 25 (1) TDDDG. You can withdraw your consent at any time via "Cookie settings".
Retention: statistics data is deleted after 14 months.

Location map (Google Maps, only with your consent)

We show our location with an embedded map from Google Maps, a service of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. When the page opens you first see only a preview image that we generated once from OpenStreetMap map data and deliver from our own server (map data © OpenStreetMap contributors, ODbL); no connection to Google or to OpenStreetMap is established at that point. Only when you click "Load map & consent" or select the category "External content" in the cookie banner does your browser load the map from Google. Google then receives your IP address as well as browser and device data and may set cookies on the domain google.com (for example NID, lifetime up to six months). A transfer to the USA is possible; Google LLC is certified under the EU-US Data Privacy Framework (Art. 45 GDPR). Google is an independent controller for this processing.

The legal basis is your consent (Art. 6 (1) (a) GDPR, § 25 (1) TDDDG). It applies to all pages with a location map and can be withdrawn at any time with effect for the future via the "Cookie settings" link in the footer; the map is then no longer loaded. The links "Open in Google Maps" and "Get directions" do not trigger anything by themselves; only when you click do you leave our website. Further information: policies.google.com/privacy.

360° tours (only with your consent)

The walk-through 360° tours are hosted on our own web space (section 2 d). However, an info point in the office tour embeds a video from YouTube, a service of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, using the domain youtube-nocookie.com (privacy-enhanced mode). For that reason we do not load either of the two tours automatically: you first see a still image delivered from our own server, and no connection to Google is established.

Only when you click "Load tour & consent" or select the category "External content" in the cookie banner is the tour loaded together with the video. Google then receives your IP address as well as browser and device data and may set cookies; the video buffers as soon as the tour opens, without you playing it. A transfer to the USA is possible; Google LLC is certified under the EU-US Data Privacy Framework (Art. 45 GDPR). Google is an independent controller for this processing.

The legal basis is your consent (Art. 6 (1) (a) GDPR, § 25 (1) TDDDG). It is the same category "External content" as for the location map: once you allow it, you see both without a further prompt. You can withdraw it at any time with effect for the future via the "Cookie settings" link in the footer; the tours are then no longer loaded. Further information: policies.google.com/privacy.

Fonts

For a consistent display of texts we use the typefaces Bricolage Grotesque, Instrument Sans and JetBrains Mono, which are stored on our own server and delivered from there. Your browser does not connect to Google servers (such as Google Fonts) or to other font services.

Legal basis: Art. 6 (1) (f) GDPR (legitimate interest in a consistent presentation).

Reviews on Google (Google Places)

On our website we display the public reviews of our Google business profile. The reviews are retrieved from Google exclusively by our server via the Places interface and cached there for a short time; the reviewers' profile pictures are also delivered through our server. When you open the page, your browser establishes no connection to Google, and your IP address is not transmitted to Google.

The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (for the underlying Places interface: Google LLC, USA). In the course of the server-side retrieval, a transfer of the server's request data to the USA is possible; Google LLC is certified under the EU-US Data Privacy Framework.

The data processed is the reviewer data contained in the reviews: display name, profile picture, review text, star rating, time and the link to the author's Google profile. The reviewers themselves published this data publicly on Google in order to review our company. We do not inform reviewers individually, because we do not hold their contact details and doing so would involve a disproportionate effort (Art. 14 (5) (b) GDPR); this privacy policy replaces the individual notice. If you have written a review and do not want it to appear on our website, an email to kontakt@pemediacorp.com is sufficient; we will then hide the review.

Legal basis: Art. 6 (1) (f) GDPR (legitimate interest in displaying public customer reviews). Information on the origin and checking of the reviews can be found in our terms of use.

Links to social networks

Our website only contains references (links) to our profiles on TikTok, Instagram, Facebook and YouTube. We embed no plug-ins, buttons or feeds of these providers; the only exception is the YouTube video inside the 360° tours, which is loaded only after your consent (see above). When you open our pages, no data is transmitted to these providers; only when you click a link do you leave our website, and the privacy notices of the respective provider apply.

WhatsApp (contact at your request)

On the page "Enquiry via WhatsApp" you put together a message text. As long as you stay on that page this happens entirely in your browser: no connection to WhatsApp or Meta is established, and we learn nothing about your selection.

Only when you click the WhatsApp button does WhatsApp open with the prepared text; you are the one who sends the message. From that moment the terms and the privacy notices of WhatsApp Ireland Limited apply, the Meta group company responsible for the European Economic Area. WhatsApp processes your phone number and the connection data of the communication, among other things; message content is encrypted between the devices. A transfer to the USA is possible in this context. WhatsApp is an independent controller for this processing and we have no influence over it. Further information: www.whatsapp.com/legal/privacy-policy-eea.

At our end your message arrives on the business number +49 155 10429643. We process the number and the content in order to answer your enquiry. The legal basis is Art. 6 (1) (b) GDPR where a contract is being initiated, otherwise Art. 6 (1) (f) GDPR (legitimate interest in answering enquiries). If you would rather not use WhatsApp, you can reach us via the contact form, by email or by phone.

P&E Community on Discord

Our community is operated on the Discord platform, a service of Discord Inc., 444 De Haro Street, Suite 200, San Francisco, CA 94107, USA. On our website we merely link to the invitation to the server; only when you click the link do you leave our website. On joining, Discord's privacy notices apply; Discord Inc. is certified under the EU-US Data Privacy Framework.

Within the server, our bot "P&E Assistant" processes your Discord username, your Discord user ID, the industry you selected, your roles and your messages in the community channels. If you take out a paid membership, we receive from PayPal (Europe) S.à r.l. et Cie, S.C.A., 22-24 Boulevard Royal, L-2449 Luxembourg, the confirmation of payment with name, email address, amount and time; we do not receive payment data such as account details. Purposes: providing the community, managing memberships, billing.

Legal basis: Art. 6 (1) (b) GDPR (membership contract), for the retention of billing data Art. 6 (1) (c) GDPR in conjunction with § 147 AO.
Retention: membership data until you leave the server; billing data for ten years.

6. Recipients and transfers to third countries

Within our company, only those persons who need your data for processing have access to it. Processors within the meaning of Art. 28 GDPR are the providers named in sections 2 and 5 (ZAP-Hosting GmbH, Cloudflare, Inc., Google Ireland Limited for the mailboxes, Mittwald CM Service GmbH & Co. KG). Further recipients are tax advisers and, where necessary, banks and payment service providers as well as authorities where we are legally obliged.

Transfers to third countries take place only in the cases described (Cloudflare, Google, Discord). They are based on the adequacy decision of the European Commission on the EU-US Data Privacy Framework (Art. 45 GDPR) and, in addition, on the standard contractual clauses of the European Commission (Art. 46 (2) (c) GDPR). If you write to us via WhatsApp, WhatsApp Ireland Limited processes your data as an independent controller; the terms of that processing and of any transfer to the USA follow from their privacy notices, not from this policy.

7. Retention and erasure

Personal data is deleted as soon as the purpose of storage no longer applies, you withdraw a consent or an objection is successful, unless statutory retention obligations prevent this. In summary:

  • server log files: 14 days
  • form enquiries and configurator requests without a contract: twelve months after the last communication
  • contract and invoice records: six or ten years (§ 257 HGB, § 147 AO)
  • consent log: three years after the last change
  • statistics data (Umami): 14 months
  • rate limiting counters: at most 60 minutes, in memory only

8. Your rights

You have the following rights against us:

  • access to the data stored about you (Art. 15 GDPR)
  • rectification of inaccurate data (Art. 16 GDPR)
  • erasure (Art. 17 GDPR)
  • restriction of processing (Art. 18 GDPR)
  • data portability (Art. 20 GDPR)
  • objection to processing (Art. 21 GDPR, see section 9)

You can withdraw a consent you have given at any time with effect for the future (Art. 7 (3) GDPR), for example via the "Cookie settings" link or by email to kontakt@pemediacorp.com; the lawfulness of the processing carried out until the withdrawal remains unaffected.

In addition, under Art. 77 GDPR you have the right to lodge a complaint with a data protection supervisory authority. The authority responsible for us is the Bayerisches Landesamt für Datenschutzaufsicht (BayLDA, the Bavarian Data Protection Authority), Promenade 18, 91522 Ansbach, Germany.

To exercise your rights, an email to kontakt@pemediacorp.com is sufficient.

9. Right to object

Right to object under Art. 21 GDPR: you have the right to object at any time, on grounds relating to your particular situation, to the processing of personal data concerning you which we base on Art. 6 (1) (f) GDPR (legitimate interest). If you object, we will no longer process the data unless we can demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms, or the processing serves the establishment, exercise or defence of legal claims. Where your data is processed for direct marketing purposes, you may object to this processing at any time without giving reasons. Please send your objection to kontakt@pemediacorp.com.

10. Data security

We use technical and organisational measures to protect your data against loss, manipulation and unauthorised access. These include:

  • continuous TLS encryption (HTTPS) of the data transmission
  • the additional encryption of configurator requests in the browser with the public key of our server
  • a strict content security policy that prevents third-party scripts from being loaded
  • access restrictions and regular, encrypted backups on our server

Rate limiting: to protect against abuse we limit the number of form submissions per IP address and email address. For this purpose we keep checksums of these values in memory for up to 60 minutes; they are not stored permanently.

Browser security reports: violations of our content security policy are reported by your browser to our server. Only the rule concerned, the blocked source and the path of the page are logged, no IP address and no input.

Legal basis: Art. 6 (1) (f) GDPR (legitimate interest in the security of our systems), Art. 32 GDPR.

11. No automated decision-making

We take no decisions based solely on automated processing and carry out no profiling.

12. Changes to this privacy policy

We amend this privacy policy when our services, the services we use or the legal situation change. The version published on this page applies; the date can be found at the beginning of the document.