II. General Information on Data Processing

Commissioned processing pursuant to Article 28 GDPR
The technical operation of our website is carried out as commissioned processing pursuant to Article 28 GDPR by the service provider STRATO AG. STRATO AG processes the data exclusively in accordance with our instructions and is contractually obliged to comply with data protection requirements.

Data processing in the context of public duties
DeKiTa Municipal Enterprise, Dessau-Roßlau Day-Care Centers, is a public body within the meaning of Section 2, paragraph 1 of the Data Protection Act of Saxony-Anhalt.

Where necessary, personal data is processed for the performance of the public duties assigned to us under municipal law and relevant specialist legislation. The legal basis for this is Article 6, paragraph 1, point e GDPR in conjunction with Section 3 of the Data Protection Act of Saxony-Anhalt.

These duties include, in particular, the administration, organisation, and provision of day-care and care services, as well as public information about these services.

Scope of the processing of personal data
As a rule, we process the personal data of our users only to the extent necessary to provide a functional website and our content and services.

The processing of users’ personal data generally takes place only with the user’s consent. An exception applies in cases where it is not possible to obtain prior consent for factual reasons and where the processing of the data is permitted by law.

Legal basis for the processing of personal data

Where we obtain the consent of the data subject for the processing of personal data, Article 6, paragraph 1, point a of the EU General Data Protection Regulation serves as the legal basis.
Where the processing of personal data is necessary for the performance of a contract to which the data subject is a party, Article 6, paragraph 1, point b GDPR serves as the legal basis. This also applies to processing operations that are necessary for carrying out pre-contractual measures.

Where the processing of personal data is necessary to comply with a legal obligation to which our organisation is subject, Article 6, paragraph 1, point c GDPR serves as the legal basis.

Where the vital interests of the data subject or another natural person require the processing of personal data, Article 6, paragraph 1, point d GDPR serves as the legal basis.

Where processing is necessary to safeguard a legitimate interest of our organisation or of a third party, and where the interests, fundamental rights, and freedoms of the data subject do not override that interest, Article 6, paragraph 1, point f GDPR serves as the legal basis for processing.

Deletion of data and storage duration
The personal data of the data subject is deleted or blocked as soon as the purpose of storage no longer applies.
Data may be stored beyond this period if this is provided for by European or national legislation in EU regulations, laws, or other provisions to which the controller is subject.

The data is also blocked or deleted when a storage period prescribed by the relevant provisions expires, unless further storage of the data is necessary for the conclusion or fulfilment of a contract.

III. Provision of the Website and Creation of Log Files

Description and scope of data processing
Each time our website is accessed, our system automatically collects data and information from the computer system of the accessing device.

The following data is collected:

In the log files, only the entries relating to the client host are anonymised or, if this cannot be determined, the client’s IP address is anonymised. The data is stored in the log files of our system.

The anonymised IP address remains valid for a maximum of 24 hours. The user’s IP address or other data that would allow the data to be assigned to a specific user is not affected. This data is not stored together with other personal data of the user.

Legal basis for data processing
The legal basis for the temporary storage of data is Article 6, paragraph 1, point f GDPR.

Purpose of data processing
The temporary storage of the IP address by the system is necessary in order to deliver the website to the user’s device. For this purpose, the user’s IP address must be stored for the duration of the session.
Our legitimate interest in data processing pursuant to Article 6, paragraph 1, point f GDPR also lies in these purposes.

Duration of storage
The data is deleted as soon as it is no longer required for the purpose for which it was collected. In the case of data collected for the provision of the website, this is when the respective session has ended.

Notes on the server location
The data centers of the service provider STRATO AG, commissioned by DeKiTa Municipal Enterprise, are located in Berlin and Karlsruhe.

Data processing takes place only in these data centers and therefore exclusively in Germany. STRATO AG is therefore fully subject to the data protection provisions applicable in Germany.

IV. Use of Cookies and Comparable Technologies

1. General information
Our website uses cookies and similar technologies, such as scripts, pixels, and local storage, to provide basic functions, analyse usage, and display optional content, such as embedded media. Cookies are small text files that are stored in the user’s internet browser or by the internet browser on the user’s device.

2. Legal bases
For the use of technically necessary cookies, the processing of personal data takes place on the basis of Article 6, paragraph 1, point e GDPR in conjunction with Section 3 of the Data Protection Act of Saxony-Anhalt, namely the performance of public duties, or on the basis of Article 6, paragraph 1, point f GDPR, namely our legitimate interest in providing a functional website.

To manage the cookies and similar technologies used, such as tracking pixels and web beacons, as well as the related consents, we use the consent tool Real Cookie Banner. Details on how Real Cookie Banner works can be found at: https://devowl.io/de/rcb/datenverarbeitung

3. Purposes of processing

4. Storage duration, objection, and removal options
Cookies are stored on the user’s device. Users can delete or block cookies stored in their browser at any time.
Consent that has already been granted can be withdrawn via the cookie banner or the privacy settings.
If cookies are deactivated, some functions of the website may be restricted.

5. Cookie banner / consent management tool
When you first visit our website, an information banner, also known as a consent banner, is displayed. Through this banner, users can give or refuse consent for certain cookie categories.
This decision is stored in a cookie so that the selected preferences can be taken into account during future visits.

Details on the cookies used, their storage duration, and their providers can be viewed at any time in our cookie consent tool.

V. Newsletter

1. Description and scope of data processing
Our website offers, or may in future offer, the option to subscribe to a free newsletter.
When users register for the newsletter, the data entered in the registration form is transmitted to us. This data consists exclusively of the user’s name and the email address provided.

In addition, the following data is collected during registration:

During the registration process, your consent is obtained for the processing of this data, and reference is made to this privacy policy.
If you purchase goods or services on our website and provide your email address during this process, we may subsequently use this email address to send you a newsletter. In such cases, the newsletter will contain only direct advertising for our own similar goods or services.
No data is passed on to third parties in connection with the processing of data for sending newsletters. The data is used exclusively for sending the newsletter.

2. Legal basis for data processing
The newsletter is sent on the basis of the user’s registration on this website.

If newsletters are sent in future as a result of the sale of goods or services, the legal basis for sending the newsletter is Section 7, paragraph 3 of the German Act Against Unfair Competition.

3. Purpose of data processing

The user’s email address is collected in order to deliver the newsletter.
The collection of other personal data during the registration process serves to prevent misuse of the services or of the email address used.

4. Duration of storage

The data is deleted as soon as it is no longer required for the purpose for which it was collected.
The user’s email address is therefore stored for as long as the newsletter subscription remains active.
The other personal data collected during the registration process is generally deleted after a period of seven days.

5. Withdrawal of consent pursuant to Article 7, paragraph 3 GDPR
Users may withdraw their consent to receive the newsletter at any time with effect for the future.
Consent may be withdrawn via the unsubscribe link included in each newsletter or by sending an informal email to: redaktion@dekita-dessau.de.

Once consent has been withdrawn, the personal data of the data subject is deleted immediately, unless statutory retention obligations prevent deletion.

VI. Integration of Social Media Services

1. General information

Our website provides links to our official profiles on social networks, such as Facebook and Instagram.
No data is automatically transmitted to these providers when you simply visit our website. A connection to the respective platform is only established when users actively click on the relevant icon or link.

In this case, the processing of personal data is carried out on the basis of consent pursuant to Article 6, paragraph 1, point a GDPR or, where necessary, for the performance of our public duties pursuant to Article 6, paragraph 1, point e GDPR in conjunction with Section 3 of the Data Protection Act of Saxony-Anhalt.

When using social media services, data may be transferred to third countries, in particular the United States. For the United States, the European Commission has issued an adequacy decision pursuant to Article 45 GDPR, the EU-US Data Privacy Framework. If the respective provider is certified under this framework, the adequacy decision serves as the basis for the data transfer.

Responsibility for the data protection-compliant operation of the platforms lies with the respective provider. Further information on data processing can be found in the privacy policies of the respective providers listed below.

2. Facebook

Our website links to content on the social network Facebook, operated by:

Meta Platforms Ireland Limited, 4 Grand Canal Square, Dublin 2, Irland.

When you visit our Facebook page, also known as a fan page, personal data is processed by Meta and by us as joint controllers pursuant to Article 26 GDPR. This processing includes, in particular, statistical usage data, known as Insights.

Die Datenschutzhinweise von Facebook sind hier zu finden:https://www.facebook.com/about/privacy

Facebook’s privacy notice is available here: https://www.facebook.com/about/privacy

3. Instagram

Our website contains links to content on Instagram, operated by:
Meta Platforms Ireland Limited, 4 Grand Canal Square, Dublin 2, Irland.

When you visit our Instagram page, personal data is also processed by Meta.
Details on data processing by Instagram can be found here: https://privacycenter.instagram.com/policy

4. Note on avoiding automatic data transmission

To protect your privacy, we do not use automatically embedded social media plugins, such as like or share buttons.
Data is only transmitted when you actively click on an external link. In this case, the privacy provisions of the respective provider apply.

VII. Contact Form and Email Contact (Updated version 2025)

1. Description and scope of data processing

Our website provides a contact form that can be used to contact us electronically. If you contact us using this form, the data entered in the form is transmitted to us and stored.

The following personal data may be processed:

In certain cases, further detailed information may also be processed in order to assess or fulfil specific needs-based criteria.

This may include:

During the submission process, your consent is obtained for the processing of this data pursuant to Article 6, paragraph 1, point a GDPR. Alternatively, you may contact us using the email address provided. In this case, the personal data transmitted with the email is stored.

As a rule, data is not passed on to third parties unless this is necessary in order to process your enquiry. This may include, for example, forwarding the enquiry to the responsible municipal specialist departments or to the commissioned IT service provider.

2. Purpose of processing

The personal data is processed exclusively for the purpose of handling your enquiry and, where applicable, contacting you in connection with the fulfilment of our public duties.
The IP address and submission date are recorded in order to prevent misuse of the contact form and to ensure the security of our information technology systems.

The processing of personal data serves exclusively to handle your inquiry and, where applicable, to establish contact in order to fulfill our public tasks. The IP address and the date of transmission are recorded to prevent misuse of the contact form and to ensure the security of our information technology systems.

3. Encryption of transmission
Our website uses SSL/TLS encryption to protect the transmission of personal data.
This means that transmitted content, such as enquiries submitted via the contact form, is protected against unauthorised access by third parties.

4. Recipients of data / commissioned processing
The technical operation of the website and email server is carried out as commissioned processing pursuant to Article 28 GDPR by STRATO AG.
The service provider processes the data exclusively in accordance with the instructions of DeKiTa Municipal Enterprise and is contractually obliged to comply with data protection requirements.

5. Duration of storage
Personal data is deleted as soon as it is no longer required for the purpose for which it was collected.
For enquiries submitted via the contact form or by email, this is the case when the respective communication has been concluded, provided that no statutory retention obligations apply.

6. Objection and withdrawal options
You may withdraw consent that has already been granted at any time with effect for the future pursuant to Article 7, paragraph 3 GDPR.
An informal notification by email to the following address is sufficient: redaktion@dekita-dessau.de

Where processing is carried out on the basis of Article 6, paragraph 1, point e or point f GDPR, you may object to the processing pursuant to Article 21 GDPR if there are reasons arising from your particular situation that oppose the processing.

VIII. Web Analysis and Statistics

1. Purpose of processing

For the statistical evaluation of the use of our online services and to improve user-friendliness, we use a data protection-compliant web analysis procedure on our website.

Data is processed exclusively in anonymised or pseudonymised form. The aim is to continuously optimise the information content, usability, and technical stability of our website. Personal evaluation or profiling does not take place.

The analysis is carried out exclusively on the servers of the internet provider. Any personal data of users is stored only there. Data is not passed on to third parties.

2. Analysis procedure used

We use the web analytics service STRATO WebAnalytics, provided by: STRATO AG | Otto-Ostrowski-Straße 7 | 10249 Berlin | Germany.

STRATO WebAnalytics collects data on the browser type, browser version, operating system, referrer URL, accessed page, duration of visit, and anonymised IP address. Collection and evaluation take place exclusively on servers in Germany and without the use of cookies. Personal attribution is not possible.

3. Legal basis for the processing of personal data

For purely anonymous, cookie-free access statistics, the legal basis is Article 6, paragraph 1, point e GDPR in conjunction with Section 3 of the Data Protection Act of Saxony-Anhalt, namely the performance of public duties, or Article 6, paragraph 1, point f GDPR, namely our legitimate interest in statistical evaluation.

For purely anonymous, cookie-free access statistics:

For analysis methods using cookies or other identifiers:

4. Purpose of data processing
Processing users’ personal data enables us to analyze their browsing behavior. By evaluating the data obtained, we are able to compile information regarding the use of individual components of our website. This helps us to continuously improve our website and its user-friendliness. These purposes also constitute our legitimate interest in processing the data pursuant to Art. 6(1)(f) GDPR. Anonymizing the IP address sufficiently takes into account the users’ interest in the protection of their personal data.

5. Recipients and commissioned processing

Processing is carried out exclusively by DeKiTa Municipal Enterprise or by contractually bound processors pursuant to Article 28 GDPR.
Personal data is not transmitted to third parties or to third countries.

6. Storage duration

The anonymised or pseudonymised data is stored for a maximum of six weeks and is then deleted.
Longer-term storage or linking with other data does not take place.

7. Objection and withdrawal options

You may object to the statistical recording of your use of the website at any time or withdraw your consent. If you have given your consent via the cookie banner, you can change or withdraw it there at any time with effect for the future.

You can also prevent cookies from being stored by adjusting your browser settings.

IX. Rights of Data Subjects

Responsible supervisory authority of the State of Saxony-Anhalt

State Commissioner for Data Protection of Saxony-Anhalt
Landesbeauftragter für den Datenschutz Sachsen-Anhalt — LfD LSA
Leiterstraße 9 | 39104 Magdeburg
Phone: +49 (0)391 / 818 03-0

1. Right of access
You may request confirmation from the controller as to whether personal data relating to you is being processed by us.

If such processing is taking place, you may request information from the controller about the following:

You also have the right to request information as to whether the personal data relating to you is transferred to a third country or to an international organisation. In this context, you may request to be informed about the appropriate safeguards pursuant to Article 46 GDPR in connection with the transfer.

2. Right to rectification
You have the right to obtain rectification and/or completion from the controller if the personal data relating to you that is processed is inaccurate or incomplete. The controller must carry out the rectification without undue delay.

3. Right to restriction of processing

You may request the restriction of the processing of personal data relating to you under the following conditions:

If the processing of personal data relating to you has been restricted, such data may, apart from being stored, only be processed with your consent, or for the establishment, exercise, or defence of legal claims, or for the protection of the rights of another natural or legal person, or for reasons of important public interest of the European Union or of a Member State.

4. Right to erasure

a) Obligation to erase
You may request that the controller erase the personal data relating to you without undue delay.

The controller is obliged to erase such data without undue delay if one of the following reasons applies:

b) Information to third parties
vIf the controller has made the personal data relating to you public and is obliged to erase it pursuant to Article 17, paragraph 1 GDPR, the controller shall, taking into account available technology and the cost of implementation, take reasonable measures, including technical measures, to inform controllers processing the personal data that you, as the data subject, have requested the erasure of all links to this personal data, or copies or replications of this personal data.

c) Exceptions
The right to erasure does not apply to the extent that processing is necessary:

5. Right to notification
If you have asserted the right to rectification, erasure, or restriction of processing against the controller, the controller is obliged to notify all recipients to whom the personal data relating to you has been disclosed of this rectification, erasure, or restriction of processing, unless this proves impossible or involves disproportionate effort. You have the right to be informed by the controller about these recipients.

6. Right to data portability
You have the right to receive the personal data relating to you that you have provided to the controller in a structured, commonly used, and machine-readable format.
You also have the right to transmit this data to another controller without hindrance from the controller to which the personal data was provided, provided that:

In exercising this right, you also have the right to have the personal data relating to you transmitted directly from one controller to another, where technically feasible. The rights and freedoms of other persons must not be adversely affected.

The right to data portability does not apply to the processing of personal data that is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller.

7. Right to object
You have the right, on grounds relating to your particular situation, to object at any time to the processing of personal data relating to you that is based on Article 6, paragraph 1, point e or point f GDPR. This also applies to profiling based on these provisions.

The controller will no longer process the personal data relating to you unless the controller demonstrates compelling legitimate grounds for the processing that override your interests, rights, and freedoms, or unless the processing is necessary for the establishment, exercise, or defence of legal claims.

If the personal data relating to you is processed for direct marketing purposes, you have the right to object at any time to the processing of personal data relating to you for such marketing. This also applies to profiling insofar as it is related to such direct marketing.

If you object to processing for direct marketing purposes, the personal data relating to you will no longer be processed for such purposes.

8. Right to withdraw consent under data protection law
You have the right to withdraw your consent under data protection law at any time.

The withdrawal of consent does not affect the lawfulness of processing carried out on the basis of consent before its withdrawal.

10. Recht auf Beschwerde bei einer Aufsichtsbehörde
Unbeschadet eines anderweitigen verwaltungsrechtlichen oder gerichtlichen Rechtsbehelfs steht Ihnen das Recht auf Beschwerde bei einer Aufsichtsbehörde, insbesondere in dem Mitgliedstaat ihres Aufenthaltsorts, ihres Arbeitsplatzes oder des Orts des mutmaßlichen Verstoßes, zu, wenn Sie der Ansicht sind, dass die Verarbeitung der Sie betreffenden personenbezogenen Daten gegen die DSGVO verstößt.
Die Aufsichtsbehörde, bei der die Beschwerde eingereicht wurde, unterrichtet den Beschwerdeführer über den Stand und die Ergebnisse der Beschwerde einschließlich der Möglichkeit eines gerichtlichen Rechtsbehelfs nach Art. 78 DSGVO.

9. Right to lodge a complaint with a supervisory authority
Without prejudice to any other administrative or judicial remedy, you have the right to lodge a complaint with a supervisory authority, in particular in the Member State of your habitual residence, your place of work, or the place of the alleged infringement, if you consider that the processing of personal data relating to you infringes the GDPR.

The supervisory authority with which the complaint has been lodged will inform the complainant of the progress and outcome of the complaint, including the possibility of a judicial remedy pursuant to Article 78 GDPR.

10. Automated individual decision-making, including profiling
You have the right not to be subject to a decision based solely on automated processing—including profiling—which produces legal effects concerning you or similarly significantly affects you.

This does not apply if the decision:

However, such decisions must not be based on special categories of personal data referred to in Article 9(1) GDPR, unless Article 9(2)(a) or (g) GDPR applies and suitable measures to safeguard your rights and freedoms and legitimate interests are in place. In the cases referred to in (1) and (3), the controller shall implement suitable measures to safeguard your rights and freedoms and legitimate interests, which shall include at least the right to obtain human intervention on the part of the controller, to express your point of view, and to contest the decision.