PRIVACY
Privacy policy
As of: 6 October 2026
1. Privacy at a glance
This privacy policy informs you which personal data we process when you visit our website moodrock.de, when you send us enquiries, place orders and during a project, for what purposes and on what legal basis this happens, and which rights you have.
Personal data is any information relating to an identified or identifiable natural person, for example your name, your email address or your IP address.
In short: our website is operated on Wix. We do not use analytics or advertising services such as Google Analytics or the Meta Pixel, the font is served locally and our forms work without external captcha services.
2. Controller
The controller responsible for data processing on this website within the meaning of the General Data Protection Regulation (GDPR) is:
Moodrock Tizian Eberhardt Kerschensteinerstraße 1b 82362 Weilheim in Oberbayern Germany
Email: info@moodrock.online
No data protection officer has been appointed, as there is no legal obligation to do so. If you have any questions about data protection, please contact us directly at the email address above.
3. Hosting and technical provision by Wix
Our website is operated on the Wix platform. The provider is Wix.com Ltd., 5 Yunitsman St., Tel Aviv, Israel (“Wix”).
In particular, Wix provides the following services for us:
Hosting and delivery of the website, including via a content delivery network (CDN)
•
Databases in which the information submitted via our forms is stored
•
Shop and ordering functions, including checkout and customer accounts
•
Delivery of images via Wix media servers
•
Sending automatic emails, for example after an order
•
Wix processes the data on our behalf. We have a data processing agreement with Wix pursuant to Art. 28 GDPR, which ensures that Wix processes the data only according to our instructions and in compliance with the GDPR.
The legal basis is Art. 6(1)(f) GDPR. Our legitimate interest lies in providing our website securely, quickly and reliably. Insofar as the processing serves to initiate or perform a contract, the legal basis is additionally Art. 6(1)(b) GDPR.
Wix is based in Israel. The European Commission has issued an adequacy decision for Israel (Art. 45 GDPR). Wix also uses sub-processors that may process data in other third countries, in particular the USA. Such transfers are based on the EU-U.S. Data Privacy Framework where the recipient is certified under it (Art. 45 GDPR), or on standard contractual clauses of the European Commission (Art. 46(2)(c) GDPR).
For more information, see Wix’s privacy policy: https://www.wix.com/about/privacy
4. Server log files
Every time our website is accessed, Wix automatically records information transmitted by your browser (server log files). This includes:
IP address
•
Date and time of access
•
Page or file accessed and amount of data transferred
•
Referrer URL (the previously visited page)
•
Browser type and version as well as operating system
•
This data is required to deliver the website, ensure its stability and security, and detect errors and attacks. We do not combine it with other data sources and do not analyse it for advertising purposes.
The legal basis is Art. 6(1)(f) GDPR. The log files are stored only as long as necessary for these purposes and are then deleted or anonymised.
5. Cookies and similar technologies
Cookies are small text files that your browser stores on your device. Comparable technologies include, for example, the browser’s local storage. Whether information may be stored on or read from your device is governed by Section 25 of the German Telecommunications Digital Services Data Protection Act (TDDDG); the subsequent processing of personal data is governed by the GDPR.
Strictly necessary cookies
We use cookies that are strictly necessary for operating the website and the functions you use. These include in particular:
“wixSession”: stores an anonymous session token that allows your browser to use the Wix shop and ordering functions during your visit. The cookie is deleted when you close the browser.
•
“wixLanguage”: stores the website language, if applicable, so that content is displayed in the correct language.
•
Cookies of the Wix platform for security, load balancing, session management, cart and checkout, logging into the customer account and storing your cookie settings (for example “XSRF-TOKEN”, “hs”, “svSession” or “ssr-caching”).
•
The legal basis for storing and reading this information is Section 25(2) No. 2 TDDDG. The associated processing of personal data is based on Art. 6(1)(f) GDPR (legitimate interest in a functional and secure website) or Art. 6(1)(b) GDPR insofar as the cookies are required for an order. Consent is not required for this.
Statistics and marketing
We do not use analytics or advertising services such as Google Analytics or the Meta Pixel. Insofar as Wix uses cookies or comparable technologies for statistical purposes on pages displayed by Wix (for example in the checkout or customer account), this only happens if you have consented beforehand via our cookie banner.
In this case, the legal basis is your consent pursuant to Section 25(1) TDDDG and Art. 6(1)(a) GDPR. You can withdraw your consent at any time with effect for the future by changing your choice in the cookie settings or deleting the cookies in your browser. The lawfulness of processing carried out until withdrawal remains unaffected.
Browser settings
You can set your browser to inform you when cookies are set, to allow cookies only in individual cases or to block them entirely. If you block strictly necessary cookies, some functions of the website, in particular orders, may not be available.
6. Fonts
The font used on this website (Montserrat) is embedded locally and delivered together with the website. No connection to servers of Google or other font providers is established when the website is accessed.
7. Contact form
When you send us a message via the contact form, we process the following information:
Name and email address (required)
•
Phone number and company (optional)
•
The package you are interested in (optional)
•
The content of your message (required)
•
We use this information solely to process your enquiry and to communicate with you about it. The information is stored in a database at Wix (see section 3).
If your enquiry is aimed at concluding a contract or at pre-contractual measures, the legal basis is Art. 6(1)(b) GDPR. In all other cases, the legal basis is Art. 6(1)(f) GDPR; our legitimate interest lies in answering your enquiry.
To protect against automated spam submissions, the form contains a field that is invisible to humans and checks how quickly it was submitted. No further personal data is collected and no external services such as Google reCAPTCHA are used. The legal basis is Art. 6(1)(f) GDPR.
We delete your enquiry once it has been fully dealt with and no statutory retention obligations apply. If a contract is concluded, the retention periods in section 9 apply.
8. Contact by email
If you contact us by email, we process your email address, the content of your message and, where applicable, your name and any other information you voluntarily provide in order to process your enquiry.
The legal basis is Art. 6(1)(b) GDPR insofar as your enquiry relates to a contract or a possible order, and otherwise Art. 6(1)(f) GDPR. Deletion is handled in the same way as for the contact form.
9. Orders via the Wix checkout
You can order our website packages and care plans online. When you select a package or plan, we create an order process at Wix with the selected product and any selected add-ons and redirect you to the Wix order page (checkout).
In the checkout and when processing the order, we process in particular:
Name, billing address, email address and, where applicable, phone number
•
Services ordered, prices, order number and order date
•
Payment method and payment status; for subscriptions also start date, term and billing period
•
We use this data to conclude and perform the contract, issue invoices, allocate payments, send you order and payment confirmations and communicate with you about your project. Order confirmations are sent via the Wix email system. The legal basis is Art. 6(1)(b) GDPR.
After the contract has been completed, we store the data insofar as we are legally obliged to do so (Art. 6(1)(c) GDPR). Under German commercial and tax law (Section 257 HGB, Section 147 AO), the retention periods are generally six, eight or ten years, depending on the type of document.
10. Customer account
In the checkout you can create a customer account or log into an existing account. A customer account may be required to take out a care plan, so that you can manage your plan, orders, addresses and payment methods.
In doing so, we process your email address, your password (stored encrypted and not visible to us), your name and the addresses, orders and plans stored in your account. Saved payment methods are managed by Wix or the respective payment service provider; full card or account details are not visible to us.
The legal basis is Art. 6(1)(b) GDPR. You can request the deletion of your customer account at any time by sending a message to info@moodrock.online. Statutory retention obligations for order data remain unaffected.
11. Payment processing
Payment is made in the Wix checkout. Depending on the payment method selected, the data required for payment, in particular name, billing address, email address, amount and order number, is transmitted to the respective payment service provider. You can see which payment methods and payment service providers are available in the checkout.
Your full payment details (for example credit card or bank account details) are processed directly by the payment service provider; we only receive information about the payment status. For subscriptions, the stored payment method is saved for the monthly debit for as long as the subscription runs.
The legal basis is Art. 6(1)(b) GDPR. Payment service providers are themselves responsible for part of their processing, for example for fraud prevention or to comply with statutory anti-money-laundering obligations. Their privacy notices apply additionally in this respect.
12. Project start: onboarding email and project form
After a successful order, Wix redirects you to our “Project start” page and passes on an identifier of your order. We use it to retrieve the order number and your email address from Wix and send you a one-time email with the link to the project form. So that you don’t receive this email more than once, we store the order identifier, your email address, the package ordered and the sending status in a database at Wix.
In the project form, you give us the information we need to build your website:
Name and email address (required), phone number and company (optional)
•
Package booked and order number
•
Information about your offer (required) as well as target group, goals, desired pages, style and colours
•
Example websites, your domain and other notes
•
Links to your materials such as logo, texts and images
•
The information is stored in a database at Wix and used solely to carry out your project. The legal basis is Art. 6(1)(b) GDPR.
If you provide us with materials via cloud services such as Google Drive or Dropbox, we retrieve them via the respective service. The privacy policies of these providers apply to their processing. Please only provide us with personal data of third parties, such as photos or names of employees, if you are entitled to do so.
We store the project data for the duration of the project and any subsequent care. We then delete it, unless statutory retention obligations apply or we need it to establish, exercise or defend legal claims.
13. Withdrawal via the online form
If you withdraw from a contract using our withdrawal form, we process your name, your email address, optionally the order number and order date, and your declaration of withdrawal. The information is stored in a database at Wix.
We use it to process your withdrawal, confirm receipt and unwind the contract. The legal basis is Art. 6(1)(c) GDPR in conjunction with Sections 355 et seq. of the German Civil Code (BGB) and Art. 6(1)(b) GDPR.
In order to be able to prove whether and when a withdrawal was received, we store the information until the statutory limitation period, generally three years, has expired. The legal basis in this respect is Art. 6(1)(f) GDPR.
14. Recipients of personal data
We only pass on your data if this is necessary to perform a contract, if we are legally obliged to do so, if there is a legitimate interest or if you have consented. Recipients are in particular:
Wix as technical service provider for hosting, databases, shop, checkout, customer accounts and email delivery (see section 3)
•
Payment service providers for processing payments
•
Our email provider for communication by email
•
Where applicable, tax advisors and tax authorities, insofar as this is necessary for accounting or due to legal obligations
•
We use service providers that process data on our behalf on the basis of a data processing agreement pursuant to Art. 28 GDPR. Data is only transferred to countries outside the European Union or the European Economic Area if the requirements of Art. 44 et seq. GDPR are met.
15. Storage period and obligation to provide data
We store personal data only for as long as necessary for the respective purpose or as long as statutory retention obligations exist. The specific retention periods can be found in the individual sections. The data is then deleted.
You are neither legally nor contractually obliged to provide us with personal data. However, without the information marked as required, we cannot process your enquiry or conclude a contract with you. The data technically transmitted when accessing the website is required to use the website.
16. SSL/TLS encryption
For security reasons, this website uses SSL/TLS encryption. You can recognise an encrypted connection by the address beginning with “https://” and the lock symbol in your browser. Data you send us, for example via our forms, is thus protected against being read by third parties in transit.
17. Your rights
Under the GDPR, provided the respective requirements are met, you have the following rights:
Access to the data we process (Art. 15 GDPR)
•
Rectification of inaccurate data (Art. 16 GDPR)
•
Erasure (Art. 17 GDPR)
•
Restriction of processing (Art. 18 GDPR)
•
Data portability (Art. 20 GDPR)
•
Objection to processing (Art. 21 GDPR, see section 18)
•
Withdrawal of consent given, with effect for the future (Art. 7(3) GDPR)
•
Complaint to a data protection supervisory authority (Art. 77 GDPR, see section 19)
•
To exercise your rights, an informal message to info@moodrock.online is sufficient.
18. Right to object
Insofar as we process your data on the basis of Art. 6(1)(f) GDPR (legitimate interests), you have the right under Art. 21(1) GDPR to object to this processing at any time on grounds relating to your particular situation. We will then no longer process your data unless we can demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms, or the processing serves to establish, exercise or defend legal claims.
If your data is processed for direct marketing purposes, you may object to this processing at any time without giving reasons pursuant to Art. 21(2) GDPR. We currently do not use your data for direct marketing.
You can send your objection informally to info@moodrock.online.
19. Right to lodge a complaint with a supervisory authority
If you believe that the processing of your data violates the GDPR, you can lodge a complaint with a data protection supervisory authority, in particular in the member state of your habitual residence, your place of work or the place of the alleged infringement. The authority responsible for us is:
Bayerisches Landesamt für Datenschutzaufsicht (BayLDA) Promenade 18 91522 Ansbach Germany Email:
poststelle@lda.bayern.de
https://www.lda.bayern.de
20. Automated decision-making
No exclusively automated decision-making, including profiling within the meaning of Art. 22 GDPR, takes place.
21. Changes to this privacy policy
We update this privacy policy when our website, the services we use or the legal requirements change. The version published on this website applies.