Privacy policy

1. Controller

Sandra Lochmann, Bahnhofstraße 28, 82065 Baierbrunn, Deutschland

E-Mail: info@sandralochmann.com · Telefon: +49 176 85697666

No data protection officer has been appointed.

2. Purposes and legal bases

Providing the site, server logs and abuse prevention: legitimate interest in secure operation, Art. 6(1)(f) GDPR.

Account, sign-in, premium subscription and payment: performance of the contract, Art. 6(1)(b) GDPR.

Check profile, saved occupations, notes and next steps: performance of the contract or consent, Art. 6(1)(b) and (a) GDPR. Without an account these entries are tied to a random session identifier.

Email alerts: consent, Art. 6(1)(a) GDPR, revocable at any time with future effect.

Invoices and tax records: legal obligation, Art. 6(1)(c) GDPR.

3. Hosting and server logs

Each request processes IP address, time, requested address, status code, data volume, referrer and browser identifier. These logs serve secure operation and are deleted after 30 days at the latest.

4. Recipients and processors

Hosting and delivery: Lovable (application platform) and Cloudflare, Inc., 101 Townsend St, San Francisco, CA 94107, USA, as content delivery network and server environment.

Database, authentication and storage: Supabase, Inc., 970 Toa Payoh North, Singapore, with data held in the European Union.

Payments: Paddle.com Market Ltd, Judd House, 18–29 Mora Street, London EC1V 8BT, United Kingdom, as merchant of record. Paddle processes payment and invoice data under its own responsibility.

No email delivery service is currently in use; alerts will only be sent once such a provider is set up, and it will be named here.

No analytics, advertising pixels, social media widgets, map services or video embeds are used. Fonts are served locally from this server; there is no connection to Google Fonts.

Data sources such as the Federal Employment Agency or Adzuna supply anonymous market data only; no personal data are transmitted to them.

Data processing agreements under Art. 28 GDPR must be concluded with every processor; for Supabase and Cloudflare this is done through the providers' data processing terms. Conclusion must be verified and documented before regular operation.

5. Cookies and storage access (§ 25 TDDDG)

Only strictly necessary storage is used: the selected language, a random session identifier for guests, the sign-in state and the progress in the check. These are exempt from consent under § 25(2) no. 2 TDDDG.

No consent banner is required because no service requiring consent is loaded. The Paddle payment overlay is loaded only after a click on the purchase button.

6. Storage periods

Account data, profile and saved list are stored until the account is deleted, server logs for up to 30 days, alert events for up to twelve months. Invoices are retained for up to ten years under commercial and tax law.

7. Transfers to third countries

Where data reach the USA or other third countries, this is based on the European Commission's standard contractual clauses under Art. 46(2)(c) GDPR together with technical safeguards (Art. 44 et seq. GDPR). For the USA the adequacy decision on the EU-US Data Privacy Framework may also apply.

8. Your rights

You have the right of access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction (Art. 18), data portability (Art. 20) and objection to processing based on legitimate interests (Art. 21 GDPR).

Consent can be withdrawn at any time with future effect by writing to info@sandralochmann.com.

Right to lodge a complaint with the supervisory authority: Bayerisches Landesamt für Datenschutzaufsicht, Promenade 27, 91522 Ansbach, Deutschland.

9. Contact by email and form

If you write by email or through a form, your details are processed to handle the enquiry (Art. 6(1)(b) or (f) GDPR) and deleted once the enquiry is closed and no retention duty applies.

10. Use of artificial intelligence

Vianora does not use an AI system. All analyses, the traffic light and the bridge analysis rely on fixed calculation rules disclosed in the methodology and on official indicators.

There is no automated individual decision with legal or similarly significant effect within the meaning of Art. 22 GDPR. Results are indications and do not constitute legal, medical or financial advice.

11. Orders and payment

Paid services are sold and invoiced by Paddle.com Market Ltd, Judd House, 18–29 Mora Street, London EC1V 8BT, United Kingdom. Paddle is the Merchant of Record and an independent controller within the meaning of Art. 4 (7) GDPR for the payment.

Name, email address, billing address, VAT identification number, order reference and payment status are processed. The legal bases are Art. 6 (1) (b) GDPR for performance of the contract and Art. 6 (1) (c) GDPR for tax retention.

Vianora neither collects nor stores payment card data. Invoice data is retained for ten years (section 147 AO). An adequacy decision of the European Commission applies to the United Kingdom.

12. Record of processing activities

A record under Art. 30 GDPR is maintained for the processing described above. It is not published but submitted to the supervisory authority on request.