Privacy Policy

This privacy policy tells you which personal data is processed when you use this website, on what legal basis, and what rights you have under the General Data Protection Regulation (GDPR). Only the functions actually in use on this website are described.

This is a translation of the German original. In the event of any discrepancy between the German and the English version, the German version shall prevail.

A. Controller

The controller for the processing of your personal data within the meaning of Art. 4(7) GDPR is:
Walter Briem
Einzelunternehmen
Striesener Str. 41, 01307 Dresden, Deutschland

Email: info@briem.tech
Telephone: +4915259465402

No data protection officer has been appointed, as the conditions of Art. 37 GDPR and § 38 BDSG are not met. For any data protection question you can reach us using the contact details above.

B. Processing activities in detail

Below we describe each processing activity separately by purpose, categories of data concerned, legal basis and categories of recipients. The data categories used are explained in section G.

Server log files

When you access this website, access data transmitted by your browser is recorded automatically. This processing is technically necessary to deliver the page and at the same time serves to detect and defend against attacks.

Data categories: HTTP data (see section G).

Legal basis: Art. 6(1)(f) GDPR. The legitimate interest is the technical delivery of the website and the safeguarding of IT security, including defence against abusive access.

Categories of recipients: providers of hosting and data centre services.

On storage periods see section D.

Contact form and email contact

If you write to us using the contact form or by email, we process your details in order to answer your enquiry and to conduct the correspondence arising from it.

Data categories: contact data and the content of your message; incidentally HTTP data (see section G).

Legal basis: Art. 6(1)(b) GDPR where your enquiry is directed at concluding or performing a contract; otherwise Art. 6(1)(f) GDPR, the legitimate interest being the answering of enquiries addressed to our business.

Categories of recipients: providers of hosting and email infrastructure.

On storage periods see section D.

AI chat assistant

An AI-assisted chat assistant is available on this website. You are informed that you are interacting with an AI system at the start of every conversation in the chat window (Art. 50(1) AI Act).

When you use the chat, the content of your messages and the conversation so far are transmitted to our AI service provider in order to generate a reply. Before transmission, personal details — e-mail addresses, telephone numbers, bank details, messenger identifiers, postal addresses and names known to the platform — are replaced by placeholders (pseudonymisation, Art. 4(5) GDPR); the mapping stays on servers in the EU and is only restored in the reply returned to us. Names and details not known to the platform that you mention freely in your text are not recognised in this process. To answer, the assistant may additionally draw on reference material we have stored; the search over that material takes place on our own servers. Conversations may be summarised automatically in order to hand your request to a responsible person.

Storage on your device: the chat window stores three entries in your browser's localStorage:

chat_session_data — session identifier, visitor identifier, device type, language, domain and timestamp of the current session;
bcai_visitor_id — a durable visitor identifier by which your chat is associated with the same channel. It persists beyond the individual session; it is valid for 12 months from your last use of the chat and is extended by each further use. After that, a new identifier is assigned;
fallback_visitor_id — an older visitor identifier still read and written for compatibility; the same validity period applies to it.

These entries remain on your device and — apart from the renewal of the visitor identifier described above once its validity has expired — are not deleted automatically; you can remove them at any time through your browser settings, and removing them simply resets the association. Conversation history is not stored on your device.

The legal basis for storing and reading them is § 25(2) no. 2 TDDDG, in so far as the entries are strictly necessary for the chat service you have expressly requested.

Customer portal and requests. Through the chat window you can sign in with a one-time code sent to you by e-mail, submit requests and follow their status. To handle your request, the content of your messages — pseudonymised as described above — may be transmitted to our AI service provider, which prepares a summary and a draft reply for the responsible member of staff. Every reply to you is reviewed and sent by a human; no decision based solely on automated processing takes place.

Data categories: chat content, conversation history, session identifier; in the customer portal additionally contact details (e-mail address, optionally name, telephone, address), request content and login data; incidentally HTTP data (see section G).

Legal basis: Art. 6(1)(b) GDPR in so far as the chat serves the initiation or performance of a contract; otherwise Art. 6(1)(f) GDPR, the legitimate interest being the immediate and resource-efficient answering of visitor enquiries.

Categories of recipients: providers of AI language models and of hosting infrastructure. On transfers to third countries see section C; on storage periods see section D.

No automated decision-making within the meaning of Art. 22 GDPR takes place. Please do not enter special categories of personal data (Art. 9 GDPR) into the chat unless this is necessary for your request.

Reach measurement

We evaluate the use of this website statistically in order to understand which content is in demand and to improve the site technically and editorially. The evaluation is carried out exclusively by our own means on our own infrastructure; no third-party analytics services are embedded and no analytics data is transmitted to third parties.

Data categories: usage data and HTTP data (see section G).

Legal basis: your consent under Art. 6(1)(a) GDPR and — for storing and reading information on your device — § 25(1) TDDDG. You may withdraw your consent at any time with effect for the future (see section E).

Categories of recipients: no disclosure to third parties; the data remains with us and the provider of our hosting infrastructure.

On storage periods see section D.

AI-assisted content

Text, page structures and images on this website may have been created using generative AI systems. We are the provider of those systems within the meaning of Art. 3(3) of Regulation (EU) 2024/1689 (the "AI Act"). A machine-readable provenance marking of AI-generated content under Art. 50(2) AI Act (e.g. following the C2PA standard) is being implemented and will be provided no later than the applicable statutory date of application; until then, content is labelled visibly. As the deployer within the meaning of Art. 3(4) AI Act, we label AI-generated or AI-manipulated image content where Art. 50(4) AI Act requires us to.

Data categories: no visitor data is processed when content is created; the inputs are editorial instructions only.

Legal basis: Art. 6(1)(f) GDPR, in so far as personal data is involved at all. The legitimate interest is the economical creation and maintenance of our own website content.

Categories of recipients: providers of AI services for text and image generation. On transfers to third countries see section C.

Handling of data-subject requests

If you exercise one of your rights under section F, we process the data required to verify your identity, to deal with your request and to demonstrate that we have met our obligations.

Data categories: contact data and the content of your request; where necessary for identity verification, further data you provide.

Legal basis: Art. 6(1)(c) GDPR in conjunction with Art. 12(3) and (6) GDPR (legal obligation to respond and to demonstrate compliance).

Categories of recipients: no disclosure to third parties; internally only the persons handling the request, plus the providers of the communication infrastructure used.

On storage periods see section D.

C. Transfers to third countries

Our own infrastructure is operated within the European Union. Hosting and server operation are provided by Hetzner Online GmbH, server location Deutschland (EU), under a data processing agreement pursuant to Art. 28 GDPR.

In so far as individual functions described in section B involve service providers outside the European Economic Area — this concerns in particular providers of AI language models and communication services — the transfer takes place on the basis of the Standard Contractual Clauses adopted by the European Commission pursuant to Art. 46(2)(c) GDPR, supplemented by an assessment of the legal situation in the recipient country and by additional technical and organisational measures, in particular the pseudonymisation of personal details before transmission (see section B). Where a transfer is based on an adequacy decision of the European Commission under Art. 45 GDPR, that decision takes precedence.

For the provider of AI language models we use, model execution and storage are fixed to infrastructure in the USA; the provider reserves the right to process data for internal purposes (safety review, support, incident handling) in further countries in which it or its affiliates operate. Inputs and outputs transmitted there are deleted within 30 days as a rule; longer periods apply to content the provider's safety systems classify as a breach of its usage policy. The providers engaged and their locations are listed in the Sub-processors overview.

A third-country element exists only for those processing activities expressly identified as such in section B. You may request a copy of the appropriate safeguards using the contact details in section A.

D. Storage periods

We store personal data only for as long as is necessary for the respective purpose or as statutory retention periods require. The data is then deleted or anonymised.

Server log files: deleted after 30 days at the latest, unless a security-relevant incident requires longer retention for investigation.
Enquiries and correspondence: deleted once the matter is concluded and no retention obligations stand in the way.
Contract, booking and payment data: retained in line with the commercial and tax periods of six and ten years respectively (§ 257 HGB, § 147 AO), counted from the end of the relevant calendar year.
Registration forms under §§ 29, 30 BMG: retained for one year beginning on the day of arrival; destroyed within three months of the end of the retention period (§ 30(4) BMG).
Application documents: deleted six months after the procedure ends, unless you have agreed to longer storage.
Consent-based processing (reach measurement, newsletter, embedded content): until you withdraw your consent; the record of consent is retained beyond that for as long as claims may be asserted.
Chat conversations: the conversation content is deleted 12 months after the last activity in the session; sessions with no customer link are deleted in full, while sessions linked to a customer are reduced to a pseudonymised residual record.
Chat visitor identifier (bcai_visitor_id): valid for 12 months from last use; a new identifier is assigned thereafter.

E. Cookies and consent

We use cookies and comparable technologies. Strictly necessary storage — such as the session identifier, the security token against cross-site request forgery and the record of your cookie decision — takes place without consent pursuant to § 25(2) no. 2 TDDDG, as it is strictly necessary for the service you have requested.

All other storage of, and access to, information on your device — in particular for reach measurement and for embedded third-party content — takes place solely on the basis of your consent under § 25(1) TDDDG and Art. 6(1)(a) GDPR. You give that consent through our consent banner.

Withdrawal: you may withdraw your consent at any time with effect for the future using the "Change cookie settings" link in the footer of this website. The lawfulness of processing carried out before withdrawal remains unaffected.

Which categories are used in a given case depends on the functions described in section B.

F. Your rights

Under the GDPR you have the following rights vis-à-vis the controller named in section A:

Access to the data processed about you (Art. 15 GDPR);
Rectification of inaccurate data and completion of incomplete data (Art. 16 GDPR);
Erasure (Art. 17 GDPR);
Restriction of processing (Art. 18 GDPR);
Data portability (Art. 20 GDPR);
Objection to processing based on Art. 6(1)(f) GDPR on grounds relating to your particular situation (Art. 21(1) GDPR); where processing is for direct marketing, you may object without giving reasons (Art. 21(2) GDPR);
Withdrawal of consent with effect for the future (Art. 7(3) GDPR);
Complaint to a supervisory authority (Art. 77 GDPR), see section H.

An informal message to the contact details in section A is sufficient. How we handle such a request is described in section B under "Handling of data-subject requests".

G. Explanation of the data categories

The data categories referred to in section B have the following meanings:

HTTP data: IP address, date and time of access, page requested, volume of data transferred, status code, referrer and browser and operating system identification (user agent).
Contact data: Name, address, email address, telephone number and the content of your messages to us.
Booking data: Service selected, date and time, number of persons, notes on the booking and the status and history of the booking.
Health data: Information permitting conclusions about your state of health — for example symptoms, diagnoses, pre-existing conditions or the reason for treatment. A special category under Art. 9(1) GDPR.
Registration data: The details to be collected on the registration form under §§ 29 f. of the Federal Registration Act, including the travel document details of foreign guests.
Order data: Services or goods ordered, quantity, price, time of the order, order number and order status.
Payment data: Billing and delivery address, amount, payment method, payment status and the transaction identifier returned by the payment service provider.
Application data: Covering letter, CV, references, evidence of qualifications and your details relating to the application procedure.
Usage data: Pages requested, time spent, sequence of requests, approximate location at region level and device category — in each case in aggregated or pseudonymised form.

H. Competent supervisory authority

Without prejudice to any other administrative or judicial remedy, you have the right to lodge a complaint with a supervisory authority, in particular in the Member State of your residence, place of work or the place of the alleged infringement. The authority competent for us is:

Der Sächsische Datenschutzbeauftragte

I. Security and status of this policy

We take technical and organisational measures pursuant to Art. 32 GDPR to protect your data against loss, alteration and unauthorised access. This website is transmitted exclusively in encrypted form via HTTPS.

We adapt this privacy policy when the legal situation or our processing activities change. The version published on this page is the one that applies.

Last updated: 7 November 2026