Privacy Policy

1. Privacy at a Glance

The following notes provide a simple overview of what happens to your personal data when you visit this website. Personal data is any data that can be used to personally identify you. PNT Wundzentren is a specialist brand of PNT Pflegenotfallteam GmbH & Co. KG. Detailed information on data protection can be found in the sections below.

2. Data Controller

The controller responsible for data processing on this website within the meaning of the General Data Protection Regulation (GDPR) is:

PNT Pflegenotfallteam GmbH & Co. KG
Jaguarring 2
23795 Bad Segeberg
Germany

Phone: +49 (0) 4551 89 37 150
Fax: +49 (0) 4551 89 37 177
Email: info@pflegenotfallteam.de

3. Data Protection Contact

If you have questions about data protection or wish to exercise your rights, you can reach us at:
Email: datenschutz@pnt-pflegedienste.de

We have appointed an external data protection officer:
DataGAP GmbH, Markus Altenburg
Bessemerstr. 82, 10. OG Süd
12103 Berlin, Germany
Email: info@pflegenotfallteam.de (subject "Datenschutz")

4. Hosting and Operation of the Website

This website runs on a server of DigitalOcean, LLC, 105 Edgeview Drive, Ste. 425, Broomfield, CO 80021, USA. The server is located in a data centre in Frankfurt am Main, Germany. The server is operated and maintained on our instructions by Social-MediaStudio.com GmbH, Jaguarring 2, 23795 Bad Segeberg, Germany, a company of the PNT group.

DigitalOcean processes the data as our processor on the basis of a data processing agreement (Art. 28 GDPR). DigitalOcean is certified under the EU-U.S. Data Privacy Framework, so an adequacy decision of the European Commission applies to any access from the USA (Art. 45 GDPR). In addition, the EU Standard Contractual Clauses apply (Art. 46(2)(c) GDPR).

The legal basis is our legitimate interest in providing the website securely and reliably (Art. 6(1)(f) GDPR).

5. Server Log Files

Each time the website is accessed, the server automatically stores the following in an access log:

  • full IP address of the requesting device
  • date and time of the request
  • requested address (request)
  • referrer URL (the previously visited page)
  • browser and operating system (user agent)
  • HTTP status code
  • amount of data transferred

We need this data to deliver the website, find errors and fend off attacks. The legal basis is Art. 6(1)(f) GDPR. The log files are deleted automatically after 7 days. The data is not combined with other data sources.

6. Encryption

This website is delivered exclusively in encrypted form via HTTPS (TLS). Your browser is also instructed to connect to this website only in encrypted form (HSTS). Data you send to us, for example via the contact form, therefore cannot be read by third parties during transmission.

7. Contact Form and Enquiries

If you send us an enquiry via the contact form, we process the following data:

  • Mandatory: your name, a phone number or an email address (at least one of the two), your preferred location and your role (patient, relative, doctor, care service, clinic or other), as well as your consent.
  • Optional: the second contact channel and your message.

In addition, the language version of the page and the time of your enquiry are transmitted. We need the mandatory details to handle your enquiry and contact you; without them, we cannot process your enquiry. Providing your data is neither a statutory nor a contractual requirement.

Your enquiry is sent as an email via the outgoing mail server of IONOS SE, Elgendorfer Str. 57, 56410 Montabaur, Germany, to our mailbox info@pnt-wundzentren.de at Microsoft 365 (Microsoft Ireland Operations Limited, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, Ireland). Both providers are contractually bound as processors (Art. 28 GDPR). Where Microsoft processes data in the USA, the transfer is based on its certification under the EU-U.S. Data Privacy Framework (Art. 45 GDPR) and the EU Standard Contractual Clauses (Art. 46(2)(c) GDPR). The form data is not stored in a database or log on the website.

If you contact us directly by email or phone, we process the details you provide in order to deal with your request. The legal basis is Art. 6(1)(b) GDPR where your request relates to a contract or pre-contractual measures (e.g. arranging care or an appointment), and otherwise our legitimate interest in answering enquiries (Art. 6(1)(f) GDPR). Please only give us the information needed for your request.

8. Health Data and Your Consent

As this website is about wound centres and wound management, an enquiry as a patient or relative already reveals information about health. Your message may also contain further details about your state of health (e.g. type of wound, pre-existing conditions, course of treatment). Such information constitutes special categories of personal data within the meaning of Art. 9 GDPR.

We therefore process the data from the contact form, including any health information, on the basis of your explicit consent (Art. 6(1)(a) and Art. 9(2)(a) GDPR), which you give by ticking the checkbox. You can withdraw your consent at any time with effect for the future, for example by email to info@pnt-wundzentren.de (Art. 7(3) GDPR). The withdrawal does not affect the lawfulness of the processing carried out until then.

Please note: Our contact form does not ask for detailed medical findings. Please do not send any sensitive documents such as wound photos or medical diagnoses via the form. If such documents are needed, we will agree a suitable way of sending them with you.

If you give us details about another person (e.g. as a relative), please make sure that this person agrees.

If your enquiry leads to care or treatment by us, we process the health data required for this within the care relationship on the basis of Art. 9(2)(h) GDPR in conjunction with § 22(1)(1)(b) of the German Federal Data Protection Act (BDSG).

9. Protection against Spam and Misuse

To protect the contact form against spam and misuse, we use the following measures:

  • a hidden field that only automated programs fill in (honeypot),
  • a check that the form was operated in the browser,
  • a minimum time for filling in the form; for this purpose, the time the form was loaded and the time of your last submission are stored in your session,
  • content filters (e.g. against messages with too many links),
  • a limit of a maximum of 5 submissions per hour per IP address. For this, the server stores a non-reversible hash value (SHA-256) of your IP address for the duration of this window (1 hour).

Blocked attempts are recorded in the server's error log with the reason for the rejection only, without any form content, and deleted after 7 days. The legal basis is our legitimate interest in a secure contact form (Art. 6(1)(f) GDPR).

10. Legal Bases at a Glance

  • Consent (Art. 6(1)(a) and Art. 9(2)(a) GDPR): processing of the contact form data, including health information.
  • Pre-contractual measures and contract (Art. 6(1)(b) GDPR): enquiries by email or phone about care, appointments or cooperation.
  • Care and treatment (Art. 9(2)(h) GDPR in conjunction with § 22(1)(1)(b) BDSG): processing of health data within a subsequent care or treatment relationship.
  • Legitimate interest (Art. 6(1)(f) GDPR): hosting, server log files, security, spam protection, strictly necessary cookies and answering other enquiries.
  • Legal obligation (Art. 6(1)(c) GDPR): compliance with statutory retention obligations.

11. Storage Duration

  • Enquiries: We delete your enquiry as soon as it has been fully dealt with and no statutory retention obligations apply, at the latest when you withdraw your consent. Business correspondence is kept for up to 6 years (§ 257 German Commercial Code, HGB) and tax-relevant documents for up to 10 years (§ 147 German Fiscal Code, AO).
  • Subsequent care: If care or treatment follows, the statutory retention periods for care and treatment documentation apply.
  • Server log files: 7 days.
  • Hash value for the submission limit: 1 hour.
  • Cookies and browser storage: see section 13.

12. Recipients and Processors

We treat your personal data confidentially. Within the PNT group, only the departments that handle your enquiry receive access to your data. We use the following contractually bound processors (Art. 28 GDPR), who act on our instructions:

  • DigitalOcean, LLC (hosting, see section 4),
  • Social-MediaStudio.com GmbH (operation and maintenance of the website, see section 4),
  • IONOS SE (sending of emails, see section 7),
  • Microsoft Ireland Operations Limited (mailbox, see section 7).

We do not pass on your data to any other third parties unless we are legally obliged to do so.

13. Cookies and Browser Storage

We only use cookies and browser storage that are strictly necessary. There is no tracking, we do not use any analytics or marketing services, and we do not create user profiles.

  • PHPSESSID: session cookie that protects the contact form; the associated session data (e.g. form load time, security token) is stored on our server. It is only set on pages with the contact form and is deleted when you close your browser. HttpOnly, Secure, SameSite=Lax.
  • csrf_token: random security token against cross-site request forgery (CSRF), stored for 7 days. HttpOnly, Secure, SameSite=Lax.
  • pnt_cookie_consent (localStorage): remembers that you have closed the cookie notice and which option you chose. This entry stays in your browser until you delete it; it is not transmitted to our server.

The legal pages (legal notice and privacy policy) do not set any cookies. Storing and reading this information is strictly necessary for the service you request and is therefore permitted without consent (§ 25(2) no. 2 of the German Telecommunications Digital Services Data Protection Act, TDDDG). The associated processing is based on our legitimate interest in a secure and functional website (Art. 6(1)(f) GDPR). You can delete or block cookies and browser storage in your browser at any time; the contact form will then no longer work.

14. Route Links and Links to Other Websites

We do not embed any maps on our website. Instead, we offer simple links to Google Maps (under "Plan route"). Only when you click such a link do you leave our website, and Google may then collect your IP address and other data. We have no influence on the data processing by Google.

This website also links to the websites of other companies and brands of the PNT group and to the website of our partner Jebusch. Data is only transmitted to these websites when you click such a link. The respective operator is responsible for the processing there.

15. Fonts, Icons and External Resources

This website does not load any external resources. No web fonts are loaded; texts are displayed in your device's system fonts. The icons come from an icon font (Bootstrap Icons) hosted on our own server. All scripts and style sheets are also delivered from our own server, so no data is transmitted to content delivery networks (CDNs) or other third parties when the page is loaded.

16. Your Rights

Within the framework of the GDPR, you have the following rights regarding your personal data:

  • Right of access (Art. 15 GDPR)
  • Right to rectification (Art. 16 GDPR)
  • Right to erasure (Art. 17 GDPR)
  • Right to restriction of processing (Art. 18 GDPR)
  • Right to data portability (Art. 20 GDPR)
  • Right to withdraw consent at any time with effect for the future (Art. 7(3) GDPR)

Right to object: Where we process data on the basis of Art. 6(1)(f) GDPR, you may object to this processing at any time on grounds relating to your particular situation (Art. 21 GDPR). We will then no longer process the data unless we can demonstrate compelling legitimate grounds for the processing or the processing serves the establishment, exercise or defence of legal claims.

To exercise these rights, you can contact us by email at any time: datenschutz@pnt-pflegedienste.de.

17. No Automated Decision-Making

We do not make any automated decisions and do not carry out profiling within the meaning of Art. 22 GDPR.

18. Right to Lodge a Complaint with a Supervisory Authority

You have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR). The supervisory authority responsible for us is:

Unabhängiges Landeszentrum für Datenschutz Schleswig-Holstein (ULD)
Holstenstraße 98
24103 Kiel
Germany
Email: mail@datenschutzzentrum.de

19. Validity and Changes to this Privacy Policy

Status: October 2026. We will adapt this privacy policy if our website, our services or the legal situation change.