INSTAGRAM PRIVACY POLICY

Information on Data Protection

1) Information about the Collection of Personal Data and Contact Details of the Controller
1.1 Below we inform you about the handling of your personal data. Personal data are all data with which you can be personally identified.
Please carefully check which personal data you share with us via Instagram. Instagram is part of the Meta corporate group and shares infrastructure, systems, and technology with Meta as well as other Meta companies (https://www.facebook.com/help/111814505650678?ref=dp). We expressly point out that Meta stores the data of users of its services (e.g., personal information, IP address, etc.) and may also use it for business purposes. More information on Meta's data processing on Instagram can be found in Instagram's privacy policy at https://help.instagram.com/help/instagram/519522125107875/
We have no influence on the data collection and further processing by Meta. Furthermore, it is not apparent to us to what extent, at which location, and for how long the data is stored, to what extent Meta complies with existing deletion obligations, which evaluations and linkages are made with the data, and to whom the data is passed on. If you want to avoid Meta processing personal data transmitted by you to us, please contact us by other means. Our full contact details can be found in our imprint on Instagram.
1.2 The controller for data processing within the meaning of the General Data Protection Regulation (GDPR) is Nelly Günther, Nella & Sina, Kiefernstr. 2, 49565 Bramsche, Germany, Tel.: 05461 9967984, E-Mail: kontakt@nellaundsina.de, insofar as we process the data transmitted to us by you via Instagram exclusively ourselves. Insofar as the data transmitted to us by you via Instagram is also or exclusively processed by Meta, in addition to us, Meta Platforms Ireland Ltd., 4 Grand Canal Square, Grand Canal Harbour, Dublin 2 Ireland, is the controller for data processing within the meaning of the GDPR.
The person responsible for the processing of personal data is the natural or legal person who alone or jointly with others decides on the purposes and means of processing personal data.

2) Data Protection Officer
You can contact Meta's data protection officer via the provided online contact form at https://www.facebook.com/help/contact/540977946302970.

3) Data Processing When Contacting Us
3.1 We collect personal data ourselves when you contact us, for example, via contact form or messenger. Which data we collect when contacting us via contact form can be seen from the respective contact form. These data are stored and used exclusively for the purpose of answering your request or for contacting you and the associated technical administration. The legal basis for processing the data is our legitimate interest in responding to your request pursuant to Art. 6 para. 1 lit. f GDPR. If your contact aims at concluding a contract, the additional legal basis for processing is Art. 6 para. 1 lit. b GDPR. Your data will be deleted after final processing of your request, provided there are no statutory retention obligations. We assume final processing when the circumstances indicate that the matter has been conclusively clarified.
3.2 ManyChat
For conversations on social media, we use an automated chat system from the following provider: ManyChat Inc., 8605 Santa Monica Blvd. #64372, West Hollywood, CA 90069, USA
If you contact us via a social medium, your inputs will be transmitted to the provider to process your request immediately and as best as possible based on available information and to answer it automatically.
This processing is carried out pursuant to Art. 6 para. 1 lit. f GDPR based on our legitimate interest in effective support management and efficient handling of communicated concerns. Your data transmitted in this way will be deleted subject to any conflicting statutory retention periods once the matter has been conclusively clarified.
We have concluded a data processing agreement with the provider that ensures the protection of your data and prohibits unauthorized disclosure to third parties.
For data transfers to the USA, the provider has joined the EU-US Data Privacy Framework, which, based on an adequacy decision by the European Commission, ensures compliance with the European data protection level.

4) Rights of the Data Subject
4.1 Applicable data protection law grants you comprehensive rights as a data subject vis-à-vis the controller regarding the processing of your personal data (rights to information and intervention), about which we inform you below:
- Right of access pursuant to Art. 15 GDPR;
- Right to rectification pursuant to Art. 16 GDPR;
- Right to erasure pursuant to Art. 17 GDPR;
- Right to restriction of processing pursuant to Art. 18 GDPR;
- Right to notification pursuant to Art. 19 GDPR;
- Right to data portability pursuant to Art. 20 GDPR;
- Right to withdraw consent pursuant to Art. 7 para. 3 GDPR;
- Right to lodge a complaint pursuant to Art. 77 GDPR.
4.2 RIGHT TO OBJECT
IF WE PROCESS YOUR PERSONAL DATA BASED ON OUR LEGITIMATE INTERESTS AFTER BALANCING INTERESTS, YOU HAVE THE RIGHT TO OBJECT TO THIS PROCESSING AT ANY TIME FOR REASONS ARISING FROM YOUR PARTICULAR SITUATION WITH EFFECT FOR THE FUTURE.
IF YOU EXERCISE YOUR RIGHT TO OBJECT, WE WILL CEASE PROCESSING THE DATA CONCERNED. HOWEVER, FURTHER PROCESSING REMAINS PERMITTED IF WE CAN DEMONSTRATE COMPELLING LEGITIMATE GROUNDS FOR THE PROCESSING THAT OVERRIDE YOUR INTERESTS, RIGHTS, AND FREEDOMS, OR IF THE PROCESSING SERVES THE ASSERTION, EXERCISE, OR DEFENSE OF LEGAL CLAIMS.
IF YOUR PERSONAL DATA IS PROCESSED BY US FOR DIRECT MARKETING PURPOSES, YOU HAVE THE RIGHT TO OBJECT AT ANY TIME TO THE PROCESSING OF PERSONAL DATA CONCERNING YOU FOR SUCH MARKETING PURPOSES. YOU CAN EXERCISE THE OBJECTION AS DESCRIBED ABOVE.
IF YOU EXERCISE YOUR RIGHT TO OBJECT, WE WILL CEASE PROCESSING THE DATA CONCERNED FOR DIRECT MARKETING PURPOSES.

5) Duration of Storage of Personal Data
The duration of storage of personal data is determined by the respective legal basis, the processing purpose, and – if applicable – additionally by the respective statutory retention period (e.g., commercial and tax retention periods).
When processing personal data based on an explicit consent pursuant to Art. 6 para. 1 lit. a GDPR, the affected data will be stored as long as you do not revoke your consent.
If statutory retention periods exist for data processed within the framework of contractual or contract-like obligations based on Art. 6 para. 1 lit. b GDPR, these data will be routinely deleted after the retention periods expire, provided they are no longer required for contract fulfillment or contract initiation and/or we no longer have a legitimate interest in further storage.
When processing personal data based on Art. 6 para. 1 lit. f GDPR, these data will be stored until you exercise your right to object pursuant to Art. 21 para. 1 GDPR, unless we can demonstrate compelling legitimate grounds for the processing that override your interests, rights, and freedoms, or the processing serves the assertion, exercise, or defense of legal claims.
When processing personal data for direct marketing purposes based on Art. 6 para. 1 lit. f GDPR, these data will be stored until you exercise your right to object pursuant to Art. 21 para. 2 GDPR.
Unless otherwise specified in the other information in this declaration regarding specific processing situations, stored personal data will otherwise be deleted when they are no longer necessary for the purposes for which they were collected or otherwise processed.

Copyright Notice: This privacy policy was created by the specialist lawyers of the IT Law Firm and is protected by copyright (https://www.it-recht-kanzlei.de)

Status: 07/28/2026, 09:58:16