1. Data protection at a glance
General information
The following notes give you a simple overview of what happens to your personal data when you visit this website. They form the core of our privacy policy.
Personal data is any data with which you can be personally identified. For detailed information on the subject of data protection, please see our privacy policy set out below this text.
Data collection on our website
Who is responsible for data collection on this website?
Data processing on this website is carried out by the website operator. You can find the operator's contact details in the legal notice of this website.
How do we collect your data?
On the one hand, your data is collected when you give it to us. This can be, for example, data that you enter in a contact form.
Other data is collected automatically by our IT systems when you visit the website. This is mainly technical data (for example internet browser, operating system or time of the page view).
This data is collected automatically as soon as you enter our website.
What do we use your data for?
Some of the data is collected to ensure that the website is provided without errors. Other data may be used to analyse your user behaviour.
What rights do you have regarding your data?
You have the right at any time to receive information free of charge about the origin, recipients and purpose of your stored personal data. You also have the right to request the correction, blocking or deletion of this data.
For this and for further questions on data protection, you can contact us at any time at the address given in the legal notice. You also have the right to lodge a complaint with the competent supervisory authority.
2. General information and mandatory disclosures
Data protection
We take the protection of your personal data very seriously. We treat your personal data confidentially and in accordance with the statutory data protection regulations and this privacy policy.
When you use this website, various personal data is collected. Personal data is data with which you can be personally identified.
This privacy policy explains which data we collect and what we use it for. It also explains how and for what purpose this is done.
Note on the controller
The controller responsible for data processing on this website is: Benjamin Lohrer, corrected.eu, email: kontakt@korrektur.de
The controller is the natural or legal person who, alone or jointly with others, decides on the purposes and means of the processing of personal data (for example names, email addresses or similar).
Revocation of your consent to data processing
Many data processing operations are only possible with your express consent. You can revoke consent you have already given at any time. An informal email to us is sufficient. The lawfulness of the data processing carried out up to the revocation remains unaffected by the revocation.
Right to lodge a complaint with the competent supervisory authority
In the event of data protection violations, the data subject has the right to lodge a complaint with the competent supervisory authority. The competent supervisory authority for data protection matters is the state data protection commissioner of the German federal state in which our company is based.
Right to data portability
You have the right to have data that we process automatically on the basis of your consent or in fulfilment of a contract handed over to you or to a third party in a commonly used, machine-readable format.
If you request the direct transfer of the data to another controller, this will only be done to the extent that it is technically feasible.
SSL and TLS encryption
For security reasons and to protect the transmission of confidential content, this site uses SSL or TLS encryption.
You can recognise an encrypted connection by the fact that the address bar of the browser changes from http:// to https:// and by the padlock symbol in your browser bar.
Information, blocking, deletion
Within the framework of the applicable statutory provisions, you have the right at any time to receive information free of charge about your stored personal data, its origin and recipients and the purpose of the data processing and, where applicable, a right to correction, blocking or deletion of this data.
For this and for further questions on the subject of personal data, you can contact us at any time at the address given in the legal notice.
3. Data collection on our website
Cookies
The website partly uses so-called cookies. Cookies do not harm your computer and do not contain viruses. Cookies serve to make our offer more user-friendly, more effective and more secure. Cookies are small text files that are placed on your computer and stored by your browser.
Most of the cookies we use are so-called session cookies. They are deleted automatically when your visit ends. Other cookies remain stored on your device until you delete them. These cookies enable us to recognise your browser on your next visit.
You can set your browser so that you are informed about the setting of cookies and only allow cookies in individual cases, exclude the acceptance of cookies for certain cases or in general, and activate the automatic deletion of cookies when the browser is closed.
If cookies are deactivated, the functionality of this website may be limited.
Partner referral attribution
If you visit corrected.eu through an expressly marked partner link with the parameter ref, we store a signed partner identifier in a technically protected cookie for a maximum of 30 days. If you follow another valid partner link, the previous identifier is replaced. A partner voucher code entered when you place an order always takes priority when commission is attributed.
The attribution serves only to count partner visits in aggregate and to assign a later paid order to the correct cooperation partner for commission settlement. In the referral aggregate we do not store an IP address, a user agent or an individual visitor identifier. Only the partner identifier, the target page, a monthly counter and separate counters for human visits and detected automated visits are recorded. If a ref value that has been passed cannot be assigned to a partner, we do not set a cookie; the value itself is only counted as a limited monthly total so that we can detect partner links that have been set up incorrectly.
If a partner has also agreed a menu link with us, then when you visit via that partner's link we store a second, separate cookie with a lifetime of no more than 30 days. It contains only the name of this partner, so neither an identifier of your device nor a timestamp, and it serves solely to direct exactly one menu item in the Partner offers section to the offer of this partner. It is not used for commission attribution. If you later visit the site through another partner's link, it is replaced or deleted.
In the case of the cooperation with e-fellows, a further paid order can also be attributed within 30 days if it is placed in a different browser or without the referral cookie. For this purpose, we form a cryptographically protected HMAC check value from the normalised email address that you give when ordering anyway. The email address itself is not stored in this attribution file. The time window begins with the last payment expressly attributed by an e-fellows code or e-fellows partner link. A repeat order recognised only through the HMAC check value does not extend the time window. A new, express, different partner code or partner link ends the previous e-fellows attribution for this check value.
The processing is carried out for the proper performance and settlement of partner cooperations and on the basis of our legitimate interest in a traceable commission settlement that is protected against manipulation, pursuant to Art. 6 (1) (b) and (f) GDPR. The cookie is not used for personalised advertising and becomes invalid after 30 days. The HMAC check value is also no longer used for attribution after 30 days have passed and is removed at the next reconciliation.
Cloudflare (delivery, protection against attacks, security check)
Our website is delivered through the network of Cloudflare, Inc., 101 Townsend Street, San Francisco, CA 94107, USA. Every page view runs through Cloudflare servers, which process technical data such as your IP address, the page requested, date, time and browser details in order to deliver the page quickly and to ward off attacks. Before you use the AI text tools, the security check Cloudflare Turnstile may also run. It evaluates technical characteristics of your browser in order to detect automated requests.
The legal basis is our legitimate interest in a secure and stable website (Art. 6 (1) (f) GDPR). The processing may also take place in the USA; for the transfer, what is said under "AI text tools" applies.
Server log files
The provider of the pages automatically collects and stores information in so-called server log files, which your browser transmits to us automatically. These are:
- Browser type and version
- Operating system used
- Referrer URL
- Host name of the accessing computer
- Time of the server request
- IP address of the visitor
- Amount of data transferred
- Content type of the request
- Processing time of the request
This data is not merged with other data sources.
The server log files serve operational security, troubleshooting and the defence against attacks. They are deleted automatically after 30 days.
The basis for the data processing is Art. 6 (1) (b) GDPR, which permits the processing of data for the performance of a contract or pre-contractual measures.
Contact form
If you send us enquiries via the contact form, your details from the enquiry form, including the contact details you give there, are stored by us for the purpose of processing the enquiry and in case of follow-up questions.
We do not pass this data on without your consent.
The data entered in the contact form is therefore processed exclusively on the basis of your consent (Art. 6 (1) (a) GDPR). You can revoke this consent at any time.
An informal email to us is sufficient. The lawfulness of the data processing operations carried out up to the revocation remains unaffected by the revocation.
The data you enter in the contact form remains with us until you ask us to delete it, revoke your consent to storage or the purpose for the data storage no longer applies (for example after your enquiry has been dealt with).
Mandatory statutory provisions, in particular retention periods, remain unaffected.
Uploaded documents
Documents that you upload for correction are processed solely for the purpose of providing the service and are deleted automatically no later than 7 days after upload. For booked orders they remain stored for up to 21 days. If you book a check after processing, they remain stored until it is completed, for a maximum of around 60 days. The download link expires at the same time. Data is passed on to third parties only to the extent necessary for the service booked: for plagiarism and AI checks, the document is transmitted to PlagAware as the technical scan provider. For editing and proofreading, it is received by the editor or proofreader assigned to your order. If you book layout, citation or bibliography work, a language model (AI) prepares this work. For this purpose we transmit the document to Anthropic, PBC, 548 Market Street, PMB 90375, San Francisco, CA 94104, USA, as a processor. Anthropic processes it under its Data Processing Addendum. According to its own statements, Anthropic does not use it to train AI models and deletes inputs and outputs after 30 days at most. The processing takes place in the USA. The transfer is based on the standard contractual clauses of the EU Commission (Art. 46 (2) (c) GDPR) in the Data Processing Addendum. The changes appear as tracked changes in the document. The legal basis is Art. 6 (1) (b) GDPR. Data is not passed on for other purposes.
AI text tools
On our website you can have texts checked and edited automatically, for example corrected, rewritten, summarised or formatted. The results are generated by a language model (AI). For this purpose we transmit the text you have entered to one of the following two operators commissioned by us. Which operator processes your text depends on the current load, and the order may change.
Elitewerk GmbH, Friedrichstraße 16, 76646 Bruchsal, Germany.
Cloudflare Workers AI: Cloudflare, Inc., 101 Townsend Street, San Francisco, CA 94107, USA. According to Cloudflare, inputs and results are used only to process the request, are not retained afterwards and are not used to train AI models. Cloudflare may store technical operating data without text content, such as times, size of the request and response time. The processing may take place in the USA. The transfer is based on the standard contractual clauses of the EU Commission (Art. 46 (2) (c) GDPR) in Cloudflare's data processing agreement and on Cloudflare's certification under the EU-US Data Privacy Framework (Art. 45 GDPR), which Cloudflare states it holds.
Please do not enter particularly sensitive data into these tools, such as health data or data of third parties. We do not store your text or the result on our server. For operation, we log only technical details for each request, without text content, namely the time, tool, duration, approximate text length, number of units processed, status code and the operator used, and we delete these after about 30 days. Before use, the security check Cloudflare Turnstile may run. If it does not run, we process a hash of your IP address for about one hour to prevent misuse. If you exceed a request limit, we additionally store the IP address, the address requested and the browser identifier for up to 30 days.
The tools are limited per day (at different levels without login, with a customer account and with a pass). For the daily count, without login we store a hash of your IP address (not the plain IP address) together with the number of today's uses; with a customer account we store the internal account number instead. The counter applies for one calendar day (Europe/Berlin time zone); counter files older than two days are deleted automatically. The legal basis is Art. 6 (1) (f) GDPR (fair distribution of capacity and protection against misuse).
The legal basis is Art. 6 (1) (b) GDPR (provision of the tool you use) and Art. 6 (1) (f) GDPR (interest in a secure and available service).
AI pass
If you buy an AI pass (longer texts and more checks in the AI text tools, one-off payment without automatic renewal), we process your account email address, the tier booked, the term (start and end) and the identifier of the payment receipt from Stripe (PaymentIntent). The payment is handled by Stripe Payments Europe, Ltd., Dublin, Ireland; we do not receive any card data. After payment, we send you an email with an activation link. When you activate, we set the cookie "__Host-kd_pass" in your browser (technically necessary, only for this website, HttpOnly, Secure). It proves that the pass was activated in this browser and expires after 400 days at the latest; whether a pass is valid is decided solely by our database. While you log in for activation, the cookie "__Host-kd_pass_next" remembers the activation link for a maximum of 30 minutes and is then deleted.
The legal basis is Art. 6 (1) (b) GDPR (performance of the purchase contract). We store pass data for the term of the pass. We keep invoices and payment receipts for the period prescribed by law on the basis of commercial and tax retention obligations (including Section 147 of the German Fiscal Code (AO) and Section 257 of the German Commercial Code (HGB)). In the event of a refund, the pass is blocked.
AI chat on the website
On our website you can use a chat that automatically answers general questions about services, prices and processes. The answers are generated by a language model (AI). For this purpose we transmit the text of your chat messages to the operator of the language model commissioned by us (Elitewerk GmbH) and, in the event of a fault, to Cloudflare, Inc. as a fallback (see the section "AI text tools"). The chat does not ask for contact details; email addresses and telephone numbers that you enter anyway are masked before storage. The chat history is stored in your browser and on our server and is deleted automatically after seven days at the latest; you can delete it earlier at any time using the bin icon. To prevent misuse and to separate our own test conversations from customer conversations, we store a shortened hash of your IP address, for up to seven days in the chat history and for up to three days in the daily count.
If you request a team member in the chat and confirm this, we transmit the history so far to our support team so that they can continue with your question. For this our team uses the messenger Telegram of Telegram Messenger Inc., Commerce House, Wickhams Cay 1, PO Box 3140, Road Town, Tortola, VG1110, British Virgin Islands. The history and further messages of this conversation are then also held by Telegram. According to its own statements, Telegram stores data of accounts from the European Economic Area in data centres in the Netherlands. The legal basis is Art. 6 (1) (b) GDPR (pre-contractual enquiries) and Art. 6 (1) (f) GDPR (interest in fast, secure customer service).
For statistics, we count anonymously how many chats, WhatsApp messages and emails reach us per day, together with rough topic areas. Only numbers are stored: no texts, no addresses, no identifiers, and it is not possible to assign them to a person. The basis is our legitimate interest in planning capacity (Art. 6 (1) (f) GDPR).
WhatsApp assistant
If you write to us on WhatsApp, you first receive an automatic reply from our AI assistant. For this we use the WhatsApp Business Platform of Meta Platforms Ireland Limited, Merrion Road, Dublin 4, Ireland. Meta processes your telephone number, your WhatsApp name and the message content in accordance with the WhatsApp privacy terms. We transmit the text of your messages to the operator of the language model commissioned by us (Elitewerk GmbH) in order to generate the reply. Your telephone number is stored by us only as a hash; the history of the most recent messages serves solely so that the assistant understands the context.
With the button "Connect support" you end the automatic replies; from then on a person from our team replies. Please do not send files via WhatsApp but through our encrypted upload. If you do not want automatic replies, the message "Stop" is enough. The legal basis is Art. 6 (1) (b) GDPR (answering your enquiry) and Art. 6 (1) (f) GDPR (interest in fast customer service).
Scan API for plagiarism and AI checks in business accounts
The scan API is available only to verified business accounts. When it is used, we process the assignment of account and API key, the technical order identifier, file name, the word count determined, credit bookings, status and error data and the uploaded document. Every order includes a plagiarism check and AI detection. API keys are stored only as a cryptographic hash. Access and rate-limit data serve authentication, billing, error analysis and the defence against misuse.
To carry out the plagiarism and AI check, the document is transmitted to PlagAware as the technical scan provider. The processing is carried out to perform the API contract pursuant to Art. 6 (1) (b) GDPR and for the secure, traceable provision of the service on the basis of Art. 6 (1) (f) GDPR. The API user must ensure that they are legally permitted to have the documents transmitted, and the personal data contained in them, processed.
The original file is deleted once processing is complete. Result data, protected report links and PDF results are kept for seven days and then deleted or made inaccessible. When switching to a private account or when the account is deleted, API keys, operational order data and any scan files that still exist are removed immediately. Billing and credit bookings remain stored to the extent that this is necessary for the contract, protection against misuse and statutory retention and limitation periods.
If the API user specifies a webhook URL, we transmit status and result data to this HTTPS destination determined by the user. The API user is responsible for selecting and securing their target system in compliance with data protection law. Webhook requests are cryptographically signed and do not follow redirects.
Newsletter
If you sign up for our newsletter, we collect your first name and your email address. As proof of your consent, we also store your IP address and the time of sign-up and confirmation.
Sign-up takes place using the so-called double opt-in procedure: after you enter your details, you receive an email asking you to confirm your sign-up by clicking a confirmation link. Only then do we add you to the mailing list and send you your personal, single-use discount voucher.
This data is processed exclusively on the basis of your consent (Art. 6 (1) (a) GDPR). We use your data solely to send the newsletter and the voucher code and do not pass it on to third parties.
You can revoke your consent and unsubscribe from the newsletter at any time, either via the unsubscribe link at the end of every newsletter email or by an informal message to us. The lawfulness of the data processing carried out up to the revocation remains unaffected. After you unsubscribe, the data collected for the newsletter is deleted, unless statutory retention obligations stand in the way.
When you confirm your newsletter sign-up, we automatically create a free customer account for your email address, unless one already exists (the email address, first name if given, and the times of creation and confirmation are stored; no password is assigned). By clicking the confirmation link in the newsletter, the account's email address is also confirmed, and you are logged in directly without two-factor protection. This account remains in place even after you unsubscribe from the newsletter and can be deleted by you at any time in the customer account.
Customer account
You can create a customer account on corrected.eu. In doing so, we process your email address, a password of your choice (stored exclusively as a cryptographic hash, never in plain text) and, optionally, your name. As a business customer you can additionally store a company name, VAT identification number and a billing address.
The purpose of the processing is to provide and manage your account, in particular to display your orders and invoices and to speed up the ordering process. The legal basis is the performance of pre-contractual and contractual measures (Art. 6 (1) (b) GDPR) and our legitimate interest in a convenient, secure customer area (Art. 6 (1) (f) GDPR). The data is stored on servers in the European Union.
To confirm your email address, and for password resets or login by login link, we send emails with single-use links of limited validity. To secure the account, we store technical details such as a session value and the IP address of the login.
You can log in without a password using an email link. Optionally, you can switch on two-factor login in your account: after the password, we send you a six-digit code by email, which is valid for 10 minutes and can be used only once. The code is stored only as a hash, and the number of entry attempts is limited. If two-factor login is active, an email link alone is not enough.
Private customers can voluntarily activate seasonal discount offers and the newsletter in the customer account. Both settings are initially switched off. Since the account email address has already been confirmed, deliberately switching them on in the logged-in customer account counts as consent and activates the setting immediately. We store the current consent status and the time of activation. The consent is based on Art. 6 (1) (a) GDPR and can be revoked at any time in the customer account. Order confirmations remain activated as part of contract processing.
Optionally, you can log in with your Google account (Google login). In doing so we receive from Google your email address, a pseudonymous user identifier and, if available, your name. Only this login data is transmitted.
You can delete your account yourself at any time in the customer area. Your login and profile data are then deleted. We keep invoices already issued and the associated order data for the period prescribed by law on the basis of commercial and tax retention obligations (including Section 147 AO and Section 257 HGB).
If you arrange a consultation appointment through your account, we process the details required for this (name, email address, telephone number if applicable, preferred date) to organise the appointment; the appointment is entered in a calendar of the provider.
Bonus credit
For the bonus programme, we process the normalised email address of the order, the order and PaymentIntent reference, the amount paid externally, as well as bonus credits, redemptions and corrections. Assignment via the email address also makes it possible to display the credit later in a confirmed customer account in the case of a guest order.
The processing is necessary to carry out the bonus programme and thus the contract (Art. 6 (1) (b) GDPR). The audit-proof booking history and technical reservations also serve our legitimate interest in preventing double use, incorrect bookings and misuse (Art. 6 (1) (f) GDPR).
The bonus ledger is stored as long as a bonus entitlement or a negative offset balance exists and afterwards only for as long as statutory retention or limitation periods require. If an account is deleted, necessary order and bonus bookings are therefore retained. You can ask us to close a remaining bonus credit irrevocably. We then delete personal bonus data unless statutory obligations or outstanding settlement claims stand in the way.
Email marketing to existing customers
If you have ordered a service from us, we also use the email address from that order, without separate consent, to occasionally draw your attention to our own similar services, such as proofreading, editing and plagiarism and AI checks, and to remind you of an open bonus credit. Section 7 (3) of the German Unfair Competition Act (UWG) permits this. The legal basis for the processing is our legitimate interest in direct marketing (Art. 6 (1) (f) GDPR). We do not pass the address on to third parties for this.
You can object to this use at any time without incurring any costs other than the transmission costs at basic rates: via the unsubscribe link in each of these emails or by an informal message to kontakt@korrektur.de. After an objection, you will no longer receive marketing emails. We then store your address only as a blocking note so that the objection is respected permanently. Order confirmations and other emails relating to the processing of your order are not marketing and remain unaffected.
4. Your rights
You have the right at any time to receive information free of charge about your stored personal data, its origin and recipients and the purpose of the data processing, as well as a right to correction or deletion of this data.
For this and for further questions on the subject of personal data, you can contact us at any time.
You have the right to request the restriction of the processing of your personal data. The right to restriction of processing exists in the following cases:
- If you dispute the accuracy of your personal data stored by us, we generally need time to check this.
- If the processing of your personal data was unlawful, you can request restriction of the data processing instead of deletion.
- If we no longer need your personal data but you need it to exercise, defend or assert legal claims, you have the right to request restriction of the processing of your personal data instead of deletion.
5. Google Ads and conversion tracking
This website uses Google Ads, a service of Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Ireland). With Google Ads we draw attention to our offers on external sites and measure the success of individual advertising measures (conversion tracking). For this purpose, Google may set a cookie as soon as you click one of our ads.
The processing is carried out exclusively on the basis of your consent pursuant to Art. 6 (1) (a) GDPR, which you give through our cookie banner and can revoke at any time with effect for the future. Without your consent, no marketing cookies are set.
For how Google processes the data collected in this way and for what purposes, please see the information on data processing by Google: https://business.safety.google/privacy/.
6. Counting pixel from Bloggerei.de
Our blog is listed in the blog directory Bloggerei.de. For this purpose a counting pixel, the so-called Publicon, is embedded on the blog pages. When a blog page is viewed, the IP address of the visitor is transmitted to Bloggerei.de and processed there to determine the number of visitors.
According to its own statements, Bloggerei.de does not use the IP address for any other purpose, does not pass it on to third parties and deletes it after 30 minutes. The Publicon collects no further data and uses no cookies.
7. Audience measurement with Matomo
For the statistical analysis of website use, we use the open-source software Matomo. Matomo runs on our own server in Germany, on a dedicated address of our own. No data is transmitted to third parties and no data is processed outside the European Union. We do not use a processor for audience measurement.
The measurement takes place without cookies. No information is stored on your device or read from it. Your IP address is shortened by two bytes before any storage and is thereby anonymised; we also use only this shortened address for any further analysis. It is therefore not possible for us to assign the data to you personally. The pages viewed, the approximate time and duration of the visit, browser type and screen size and the website from which you came to us are recorded.
The purpose of the processing is to design and continuously improve our offer in line with demand. The legal basis is our legitimate interest in data-minimising audience measurement pursuant to Art. 6 (1) (f) GDPR. Since we set no cookies and do not access information in your device, consent under Section 25 of the German Telecommunications Digital Services Data Protection Act (TDDDG) is not required.
We delete the individual access data automatically after 180 days. The summarised analyses created from it no longer allow any personal reference and are retained by us as statistics.
You can object to the measurement at any time: if your browser sends a Do Not Track request, your visit is neither counted nor stored. You can find this setting in the privacy settings of your browser.
8. Statistical analysis of order data
We analyse details from our orders statistically in order to publish our own studies and statistics. Only order metadata is used, such as the service chosen, the number of pages, the delivery time and the time of the order. The content of uploaded documents is never analysed for this purpose.
The results are published only in summarised form as shares or medians, never as individual cases. We do not report groups with fewer than 10 cases. The published figures have no personal reference.
The legal basis is our legitimate interest in improving our services and in informing the public pursuant to Art. 6 (1) (f) GDPR. The analysis is compatible with the original purpose of order processing (Art. 5 (1) (b) in conjunction with Art. 89 (1) GDPR).
You can object to this analysis at any time under Art. 21 GDPR. An informal message to kontakt@korrektur.de is sufficient. We will then remove your order from all future analyses.