Privacy policy
Last updated: October 2026
Google Tag Manager: We embed Google's container GTM-TFZJGN3F through www.googletagmanager.com. Loading it transmits IP addresses and HTTP request data to Google. Its tags are controlled through CookieYes and Google Tag Manager configuration, not an additional application-level gate. [[OFFEN: Confirm container tags, actual consent controls, provider, legal bases, recipients, retention and international transfer safeguards]].
1. Controller
Cell Clinics is a service of Cell Education - The Institute GmbH & Co. KG, Frankfurter Straße 7, 61462 Königstein im Taunus, Germany. The controller is Cell Education - The Institute GmbH & Co. KG. Contact: info@cell-education.com.
2. Hosting and server logs
We use Vercel Inc., USA, to host this website. IP addresses, dates, times, requested pages and browser information may be processed. The basis is Article 6(1)(f) GDPR; our legitimate interest is secure and reliable operation. [[OFFEN: Confirm Vercel address, processing agreement, hosting region, log retention and additional services/log drains]]. US transfers may rely on the EU-US Data Privacy Framework where certification is valid, or standard contractual clauses. [[OFFEN: Check the DPF register and document the actual transfer safeguards]].
3. Cookies
NEXT_LOCALE stores the language preference as a necessary session cookie (Path=/, SameSite=Lax). It expires at the end of the browser session; browser session restoration may extend this. Basis: section 25(2) TDDDG and Article 6(1)(f) GDPR. CookieYes stores consent choices in a necessary cookie. [[OFFEN: Confirm exact CookieYes cookie names and lifetimes for the configured site]]. Basis: section 25(2) TDDDG and Article 6(1)(c) GDPR. Statistics and marketing are optional and disabled without express consent. Optional cookies rely on section 25(1) TDDDG and Article 6(1)(a) GDPR. [[OFFEN: Identify the source, purpose, lifetime and use of the previously reported _tccl_visitor cookie; no producer or technical necessity established in application code]].
4. Partner inquiries
The form processes practice name, country, practice type, profession, contact person, email and optionally website and phone, together with consent and submission time. The purpose is to respond to your partnership inquiry and prepare possible cooperation, Article 6(1)(b) GDPR. Our API sends the details by email through Resend when a key is configured, otherwise through FormSubmit. The default recipient is info@cell-education.com. [[OFFEN: Confirm active provider, recipient overrides, legal entities, processing agreements, subprocessors and international transfer safeguards]]. Application code has no form database. [[OFFEN: Specify deletion periods for mailboxes, delivery services and backups, and statutory retention obligations]].
5. Patient regional inquiries
We process your name, email, postcode/city, consent and submission time to respond to your regional inquiry and contact you as requested. The basis is Article 6(1)(a) GDPR. You may withdraw consent for the future at info@cell-education.com. Delivery and recipients are as described in section 4. Do not submit health data; there is no symptom or complaint field. [[OFFEN: Confirm retention, deletion and consent evidence for the FormSubmit fallback]].
6. Form security
To prevent automated abuse, we briefly process IP addresses to sign form tokens and derive an HMAC key for a process-local rate limit. Counters use a one-hour window and are removed on the next access after expiry or when the process ends; tokens are valid for up to 24 hours. A hidden honeypot and minimum completion time also apply. Basis: Article 6(1)(f) GDPR, abuse prevention. Application error logs do not record form contents; see section 2 for hosting logs.
7. Location and practice search
The location feature requires browser permission. Coordinates are used in your browser to calculate distances and are not sent to a geocoding server by our application. Basis: Article 6(1)(a) GDPR. You can revoke permission in your browser. For postcode/city searches, our API sends the search text, selected country and browser language to Nominatim (nominatim.openstreetmap.org), without forwarding your IP address. Search responses may be cached for 24 hours. Basis: Article 6(1)(f) GDPR, providing the requested search. [[OFFEN: Confirm Nominatim operator, terms and log retention]]. Practice data and coordinates are served locally; the current network view does not load external map tiles.
8. Videos, links and local resources
The Vimeo preview is loaded locally. Only clicking the labelled button connects your browser to Vimeo, which may receive your IP address, browser information and usage data. Basis: Article 6(1)(a) GDPR and, where applicable, section 25(1) TDDDG. The player uses dnt=1; this does not replace consent. [[OFFEN: Check Vimeo legal entity, retention and transfer safeguards]]. Leaving or reloading the page stops the embedded player. YouTube is an external link only. Fonts, images and application scripts are served locally; Google Fonts is fetched at build time, not by visitors' browsers.
9. CookieYes and withdrawal
When a site ID is configured, CookieYes Limited, United Kingdom, manages and records cookie choices. Decisions, timestamps and a pseudonymous consent identifier are processed; the provider states that IP addresses are masked. Full anonymity is not guaranteed. The UK is covered by an EU adequacy decision. Basis: Article 6(1)(c) in conjunction with Article 7(1) GDPR. Use Cookie settings in the footer to change or withdraw consent. [[OFFEN: Confirm site ID, necessary cookies, statistics/marketing categories, consent retention, processing agreement and subprocessors]]. No CookieYes banner loads without a site ID. Google Analytics and Meta Pixel are prepared only and inactive without IDs; this policy must be completed before activation.
10. Your rights
Subject to applicable conditions, you have rights of access (Article 15 GDPR), rectification (16), erasure (17), restriction (18), notification (19) and portability (20). Under Article 21 you may object to processing based on legitimate interests for reasons relating to your situation, and to direct marketing at any time. Consent may be withdrawn prospectively without affecting prior lawful processing. Contact info@cell-education.com. You may complain to a supervisory authority, particularly the Hessian Commissioner for Data Protection and Freedom of Information, Postfach 3163, 65021 Wiesbaden, Germany.