Privacy Policy

The controller responsible for the processing of personal data is:

TSH Consulting GmbH
Zeppelinstraße 71–73
81669 München
Germany

Represented by the managing director Sascha Horvath

Email: service@florimora.com
Phone: 0800 63 77 322
Website: www.florimora.com

FLORIMORA is a brand of TSH Consulting GmbH.

If you have questions about data protection or wish to exercise your rights, please contact:

Sascha Horvath
TSH Consulting GmbH
Zeppelinstraße 71–73
81669 München
Germany

Email: service@florimora.com, subject: Data protection

Mr. Horvath is the contact person for data protection inquiries. No data protection officer within the meaning of Art. 37 GDPR has been appointed. TSH Consulting GmbH remains the controller under data protection law.

Our website currently provides information about the upcoming launch of FLORIMORA. No orders can be placed and no payments can be made via the coming-soon page. A customer account, registration, newsletter and ordering process are not publicly available.

The online shop is in preparation and is publicly locked. An internal preview can only be accessed after entering an access password; no user account is created, and no names or email addresses are processed.

If additional functions are introduced later, we will explain the associated data processing in this privacy policy.

When you access our website, technical connection information is processed, in particular your IP address, the date and time of access, the address requested, information on browser and operating system, and the delivery status code. This is necessary so the requested content can be transmitted to your browser.

This processing serves to provide our website. The legal basis is Art. 6 (1)(f) GDPR. Our legitimate interest lies in providing our website reliably and securely.

Processing the corresponding connection data is technically necessary to deliver the content. Without this processing the website cannot be delivered.

We ourselves do not keep permanent access logs and do not maintain server log files containing IP addresses. Brief logging by the hosting infrastructure used, for operational and security purposes, takes place within the scope of the service providers named under section 5.

Our website is not operated on our own servers. We use the following service providers for provision and delivery:

Lovable (hosting and publishing)

The website is created and published via the Lovable development and hosting platform. In doing so, the technical connection data of the request (see section 4), including the IP address, is processed. The purpose is the technical provision, troubleshooting and security of the website. The legal basis is Art. 6 (1)(f) GDPR; our legitimate interest is secure and stable operation. Processing takes place as data processing on our behalf; connection data is stored only briefly for operational and security purposes.

Cloudflare (content delivery network)

Delivery takes place via the network of Cloudflare, Inc., 101 Townsend Street, San Francisco, CA 94107, USA (represented in Europe by Cloudflare Germany GmbH, Rosental 7, 80331 München). Cloudflare processes the technical connection data of your request — including the IP address — in order to deliver content from a nearby location and to fend off attacks. The legal basis is Art. 6 (1)(f) GDPR (secure, high-performance delivery). Regarding transfer to the USA, see section 10.

Cloudflare's privacy notice

No own backend, database or customer-account system is active on this website. No visitor data is stored in a database.

Two steps must legally be distinguished: the storage of information on your device or access to such information (§ 25 TDDDG) and the subsequent processing of personal data (GDPR).

This website stores exclusively information that is strictly necessary for the service you requested (§ 25 (2) no. 2 TDDDG). No consent is required for this. No analytics, marketing or embedding services are integrated to which you could consent or which you could decline. No tag manager, advertising pixels or external media are used.

On your first visit you therefore receive a factual privacy notice with an “Understood” button and a reference to this page — not a consent banner for services that do not exist. Your acknowledgement is documented in a data-minimal way: time, selection per purpose and the version of the information shown (currently version 1). The record contains no IP address and no fingerprinting and is valid for 180 days; after that, as well as if purposes change materially or new services are added, we will ask again.

Once optional technologies are added in the future, they will not be technically loaded before you give consent. You will then be offered, with equal prominence on the first level, “Reject all”, “Adjust selection” and “Accept all”; optional purposes will be switched off by default, and a refusal is stored just like a consent. You can change or withdraw your decision at any time via the cookie settings in the footer. Upon withdrawal we remove the values under our control from your browser.

The language of the site is determined in this order: an explicitly requested language address (e.g. /de), a language you have previously chosen manually, the approximately detected access country, a supported browser language, and otherwise English.

The access country is not determined via an external geo-IP service. Only the country code that the hosting infrastructure used (Cloudflare) attaches to the request is used. For this attribution, Cloudflare as network operator technically and unavoidably processes your IP address (see section 5); only a two-letter country code is transmitted to us. We use it exclusively for language selection for the current request. We do not store it, we do not log locations, we do not perform location analysis and we do not store IP addresses. Your device location (GPS) is not queried.

The legal basis for the language assignment is Art. 6 (1)(f) GDPR; our legitimate interest is the comprehensible presentation of our content. If you select a language manually, we store this selection in a cookie (see section 6); this is necessary to implement the setting you requested.

Language, delivery country and currency are handled separately. The displayed language does not imply anything about delivery availability.

For the display of this website we use the Cormorant Garamond and Manrope typefaces, which are loaded from Google Fonts (fonts.googleapis.com, fonts.gstatic.com) when the page is built. The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland.

When the fonts are requested, technical connection data — including your IP address as well as browser and device information — is transmitted to Google. No cookies are set in the process. The legal basis is Art. 6 (1)(f) GDPR; our legitimate interest is a consistent, typographically high-quality presentation. Regarding transfer to the USA, see section 10.

Google's privacy notice

This website currently has no contact form. You can reach us by email or by phone.

If you contact us by email or by phone, we process the information you provide in order to handle your request. This may include your name, your contact details and the content of your message.

If your inquiry relates to a contract or to pre-contractual measures, the processing takes place pursuant to Art. 6 (1)(b) GDPR. For other inquiries it takes place pursuant to Art. 6 (1)(f) GDPR. Our legitimate interest lies in the proper handling of your inquiry.

For email communication we use an email service provided by IONOS SE, Elgendorfer Straße 57, 56410 Montabaur, Germany. IONOS processes the content and connection data of your message as a processor on our behalf.

Providing your details is voluntary. However, without sufficient contact information or details about your request, we may not be able to answer your inquiry.

We store the communication for as long as is necessary to handle your inquiry. Longer retention takes place where statutory obligations exist or the data is needed to assert, exercise or defend legal claims.

Recipients of personal data are exclusively:

• our hosting and publishing service provider (Lovable) – technical provision of the website,
• Cloudflare – delivery of content and defense against attacks,
• Google Ireland Limited – delivery of the fonts used,
• IONOS SE – operation of our email service,
• where necessary in an individual case: tax advisors, legal counsel or authorities in the context of statutory obligations.

A transfer to the USA is possible for delivery via Cloudflare and when the fonts are requested. Cloudflare, Inc. and Google LLC are certified under the EU-US Data Privacy Framework; for transfers to certified companies in the USA there is therefore an adequacy decision of the European Commission (Art. 45 GDPR). In addition, these providers use standard contractual clauses pursuant to Art. 46 (2)(c) GDPR. We will inform you of the specific basis and provide a copy of the safeguards upon request to service@florimora.com.

Consent to cookies does not substitute for a basis for a third-country transfer; the transfers mentioned are based on the grounds described above.

For clarification: the following are currently not used on this website — and therefore process no data — web analytics and reach measurement, tag managers, advertising and social-media pixels, external video or map services, chat or support tools, newsletter and mailing systems, payment service providers, shipping service providers, customer accounts, review systems and shop platforms. Likewise, no own database or backend system for visitor data is active.

Should such services be introduced, we will inform you in advance at this location and — where required — obtain your consent.

There is no automated decision-making, including profiling, within the meaning of Art. 22 GDPR. The technical selection of the display language based on country code and browser language is a simple display setting; it has no legal effect and does not significantly affect you.

Our website is multilingual and addresses visitors in Europe. The sole controller is TSH Consulting GmbH, headquartered in Germany; the General Data Protection Regulation (GDPR) applies.

For visitors from Switzerland, the Swiss Federal Act on Data Protection (revFADP) additionally applies; the above information on the controller, purposes, recipients, foreign transfers and rights applies accordingly, and you may contact the Federal Data Protection and Information Commissioner. We have not conducted a review of further national special rules beyond the processing described here; we therefore do not claim verified full compliance with all national additional requirements. A representative pursuant to Art. 27 GDPR is not required, as we are established in the EU.

We take technical and organizational measures appropriate to the risk to protect personal data, in particular against unauthorized access, loss and unlawful alteration. The website is delivered exclusively in encrypted form (HTTPS).

We adapt these measures to the nature of the processing and to technical developments.

Personal data is stored only for as long as is necessary for the respective purpose or as long as statutory retention obligations exist.

If the purpose of processing ceases to apply and no further retention reason exists, the data is erased. If data must continue to be retained, we restrict its further use to the purpose relevant for that retention.

Specific retention periods or the criteria for determining them can be found under the individual processing operations; the retention periods for device storage are listed in section 6.

Subject to the statutory requirements, you have the following rights:

• Access to your personal data pursuant to Art. 15 GDPR.
• Rectification of inaccurate data or completion of incomplete data pursuant to Art. 16 GDPR.
• Erasure of personal data pursuant to Art. 17 GDPR.
• Restriction of processing pursuant to Art. 18 GDPR.
• Data portability pursuant to Art. 20 GDPR.
• Objection to certain processing pursuant to Art. 21 GDPR.

Where processing is based on your consent, you can withdraw it at any time with effect for the future. The lawfulness of processing carried out until the withdrawal remains unaffected.

To exercise your rights, please contact service@florimora.com. In case of reasonable doubts as to your identity, we may request additional information insofar as it is required to confirm your identity.

You may lodge a complaint with a data protection supervisory authority pursuant to Art. 77 GDPR if you believe that the processing of your personal data violates data protection law.

This right exists in particular before a supervisory authority in the Member State of your habitual residence, place of work or the place of the alleged infringement. The authority responsible for us is the Bayerisches Landesamt für Datenschutzaufsicht (Bavarian State Office for Data Protection Supervision), Promenade 27, 91522 Ansbach.

We update this privacy policy whenever our data processing or the applicable legal requirements change. The current version is available on our website.