Last updated: 8 October 2026
This notice explains how personal data is processed when you visit EnzymeNews, use its privacy controls or contact its operator.
1. Who is responsible?
The controller for EnzymeNews is:
Dr. Matheus Regis Belisário Ferrari
c/o COCENTER
Koppoldstr. 1
86551 Aichach, Germany
Email: m.ferrari@enzymenews.com
Contact form: Contact EnzymeNews
In this notice, “I” refers to the operator named above. Some providers also process data for their own purposes, as explained below.
EnzymeNews publishes news and information. It does not currently offer reader accounts, reader comments, newsletter subscriptions or online purchases.
2. Legal bases and your choices
The General Data Protection Regulation (GDPR) applies to the processing described here. I rely on consent under Article 6(1)(a) for optional analytics, and on legitimate interests under Article 6(1)(f) for necessary website operation, security, recovery backups and responding to direct correspondence. The relevant interests are explained in the service sections. Processing necessary to meet legal obligations, including documenting consent where required, is based on Article 6(1)(c).
Storing information on your device or accessing information already stored there is separately subject to § 25 of the German Telecommunications Digital Services Data Protection Act (TDDDG). Optional storage or access requires consent under § 25(1). The exceptions in § 25(2) apply only where their requirements are met, including storage strictly necessary to provide a service you expressly request.
You can read the website without agreeing to optional analytics. Advertising is currently disabled. Refusing Analytics consent prevents the optional Analytics tag from loading. You can change a consent-based choice later without affecting processing that was lawful before withdrawal.
3. Hosting and email
The website and its email mailbox are hosted by ALL-INKL.COM – Neue Medien Münnich, proprietor René Münnich, Hauptstraße 68, 02742 Friedersdorf, Germany. A data-processing agreement covers its processing on my behalf.
When your browser connects to the website, technical information is processed to deliver pages and maintain availability and security. This includes the IP address, requested address, request time and browser information. The legal basis is Article 6(1)(f) GDPR, reflecting the legitimate interest in operating and protecting the website.
Optional access-log generation is disabled in the hosting control panel. This does not prevent the technical processing needed to handle a connection or the separate security records described below. Necessary operational information is retained for its operational or security purpose and any applicable legal requirements.
Further information: ALL-INKL data-protection information.
4. Contacting me
If you use the contact form or send an email, I process the name, email address, message and any other information you choose to provide, together with delivery information needed to receive and answer the inquiry. An email address is needed if you want an email response.
The form uses WPForms Lite. Notifications are sent through the website’s ALL-INKL email service using WP Mail SMTP. Form submissions are not saved as entries in the WordPress database, and the WPForms Lite Connect entry-backup feature is disabled. Correspondence is kept in the ALL-INKL mailbox. Separate security records may be generated when a form is accessed or submitted.
The contact form requests consent to process your submission for answering the inquiry; the legal basis is Article 6(1)(a) GDPR. You can withdraw this consent by contacting me. For messages sent directly by email, the basis is Article 6(1)(f): the legitimate interest in responding to correspondence addressed to me.
Correspondence is retained while the inquiry and necessary follow-up are being handled. Once no longer needed, it is deleted unless a legal retention obligation or a specific need to establish, exercise or defend a legal claim requires longer retention. Information about other people or sensitive information should only be included where needed for the inquiry.
5. Privacy choices, cookies and InMobi
EnzymeNews uses InMobi’s consent management platform to display privacy choices, record preferences and communicate them to participating services. The provider is InMobi Technology Services Pte Ltd., 160 Robinson Road, #19-08 SBF Business Center, Singapore 068914. Its privacy contact is privacy@inmobi.com.
Data involved can include consent choices and their time, consent identifiers, IP address, browser and device information, page or referring address and approximate location. Consent information is also stored in your browser so your choices can be remembered. Necessary processing to record consent evidence is based on Article 6(1)(c), together with Article 7(1) GDPR; necessary processing to provide and respect privacy preferences is based on Article 6(1)(f).
InMobi acts as an independent controller under its CMP agreement. Its contractual purposes also include advertising optimisation, analytics and reporting, and audience segmentation, subject to applicable law and consent requirements. These broader contractual purposes should be distinguished from the consent-recording function itself. Provider information is available in the InMobi CMP terms, CMP data-protection agreement and EEA privacy policy.
The browser consent cookie IABGPP_HDR_GppString is configured for approximately 13 months (390 days). The Google-choice record gbc_consent uses local storage, which has no automatic browser expiry and remains until replaced or removed. These browser periods do not determine how long InMobi retains server-side records. Its retention is governed by the service purpose, its privacy policy, applicable legal requirements and any need to resolve disputes or enforce agreements.
To change your choices: use the Privacy control at the bottom of the website. Open More Options to review purposes and vendors, including Google consents, and save changes using Save & Exit. To withdraw optional permissions together, use Privacy → Reject All. Closing a preferences window alone does not withdraw a previously saved choice.
Choices normally apply to the browser and device where you make them. Clearing browser data or using another browser or device may cause the notice to appear again. Necessary records of a refusal may remain so it can be respected. Browser controls can also delete cookies or local storage. Details are available in the Cookie Policy.
Previous consent records: CookieYes
CookieYes was replaced as the active banner on 18 September 2026. The WordPress plugin is deactivated, but its service account remains open. Earlier consent evidence may therefore remain with CookieYes Limited, 3 Warren Yard, Warren Park, Wolverton Mill, Milton Keynes, MK12 5NW, United Kingdom.
Such evidence can include consent identifiers, choices and timestamps. It is kept for documenting earlier privacy choices and meeting consent-accountability obligations. CookieYes processes this customer data under its data-processing agreement. Account closure and contractual deletion provisions are separate from plugin deactivation; deactivation does not itself erase historical records. Relevant records are retained only as needed for those purposes and applicable legal requirements, subject to the provider’s deletion and backup provisions.
6. Google Analytics
Google Analytics helps me understand how visitors find and use EnzymeNews. The provider under the applicable German service terms is Google Ireland Limited. A data-processing agreement has been accepted for covered processing on my behalf. See Google’s Analytics terms and data-processing terms.
The Analytics tag is loaded after you expressly allow Analytics in the privacy settings. The legal basis is Article 6(1)(a) GDPR, with consent under § 25(1) TDDDG for optional device storage or access. The Analytics permission can be withdrawn through the privacy controls described above. Withdrawing it stops further Analytics collection through the site’s loading control and reloads the page; it does not automatically erase information already sent to Google.
Measurement information can include pages viewed, interactions, referring addresses, browser and device characteristics, approximate city-level location and cookie identifiers. Cookies such as _ga and _ga_* help distinguish visitors and maintain session information. First-party cookies and pseudonymous identifiers are not automatically anonymous data.
Google states that IP addresses from users in the EU, Switzerland and the UK are used to derive approximate location and then discarded before measurement data is logged. Google still receives connection information when a request reaches its servers. See Google’s regional data-handling explanation.
Google signals and Analytics ads personalisation are disabled. City-level location and detailed device collection remain enabled. This Analytics property has no Google Ads or AdSense product links.
At account level, sharing for Google products & services is disabled. Sharing for Modeling contributions & business insights, Technical support and Recommendations for your business is enabled. These settings permit contributions to aggregated modelling and benchmarking, support access when needed, and use of account information for business recommendations, respectively. See Google’s explanation of account data sharing.
For data covered by the property’s retention controls, event-data retention is set to two months and user-data retention to 14 months. The user retention period restarts with new activity, so continued use can extend it. Google removes expired data through a monthly deletion process. These controls do not set the retention of standard aggregated reports. See Analytics retention information.
Browser-cookie lifetimes are separate. Google documents a default two-year lifetime for _ga and _ga_*, subject to browser limits and renewal. See Google’s cookie information and the website’s Cookie Policy.
7. Advertising
EnzymeNews does not currently use Google AdSense or display Google ads. Google Analytics is a separate, optional service described above.
The privacy controls may list advertising vendors even though their advertising services are not active on this website. InMobi’s own processing is described in section 5.
Google Ireland Limited is independently responsible for information it received through earlier advertising-related requests. Its privacy information and retention policy explain how that information is handled.
8. Website security: Wordfence
Wordfence helps detect attacks, block malicious requests and protect the WordPress installation. It is provided by Defiant Inc., 1700 Westlake Ave N, Ste 200, Seattle, WA 98109, United States. Its privacy contact is privacy@defiant.com.
Live Traffic is set to record security-related events, such as login attempts and blocked requests. Depending on the event, records can contain IP addresses, request times, requested URLs and browser user-agent information. The local Live Traffic log has a 30-day age limit and a 2,000-record limit, checked daily. The record-count limit can cause earlier removal. Backups may retain copies after removal from the active database.
Server-based IP-location lookups are enabled. For these lookups, Wordfence receives an IP address to return approximate city and country information used in security features. This does not use a device’s precise GPS location. See Wordfence’s explanation of IP-location lookups.
The legal basis for necessary and proportionate security processing is Article 6(1)(f) GDPR: protecting the website, its operator and visitors from attacks and misuse. Defiant’s data-processing addendum addresses its processing on customers’ behalf. Its default provider-side retention is the agreement’s term plus one month, subject to the addendum’s exceptions. This differs from the local log limit. Further information is in the Wordfence Privacy Policy.
9. Recovery backups
UpdraftPlus creates website-file and database backups so the site can be restored after data loss or a technical failure. New backups currently remain on the ALL-INKL web server; no remote storage destination is selected in UpdraftPlus. Copies may include personal data contained in the website database or files, such as security records. These website backups are separate from the ALL-INKL mailbox.
The current schedule is configured to retain two monthly file backups and 52 weekly database backups. Older scheduled copies are removed as new backups exceed those counts. With an uninterrupted schedule, this corresponds to approximately two months of file backups and one year of database backups. These are copy-count limits; a stopped or failed schedule can leave older copies in place. They also do not automatically apply to copies separately downloaded or retained for a specific recovery task. Retention of any separately kept copies is limited to the recovery purpose or an applicable legal obligation.
The legal basis for necessary recovery backups is Article 6(1)(f) GDPR, reflecting the interest in restoring the website and protecting against data loss. Data deleted from the active website may remain in existing backups until those copies are replaced or deleted.
Earlier backups were stored in a personal Google Drive account, and older Google Drive backup sets remain listed in UpdraftPlus. Disabling remote storage does not delete those copies. The current scheduled retention limits do not automatically remove copies from a disconnected remote destination. Earlier remote copies may therefore remain until they are separately removed, subject to the recovery purpose and any applicable legal retention requirement. Google’s processing of retained copies is addressed in its Drive terms and privacy policy. Storage and support infrastructure may involve processing outside the EEA, as discussed below.
10. Recipients and international transfers
The providers described above receive information needed for the purposes explained in this notice. Depending on the service, they process it on my behalf or as independent controllers. Information may also be disclosed where necessary to meet a binding legal requirement or establish, exercise or defend legal claims.
Some providers or their infrastructure are outside the European Economic Area, including InMobi in Singapore and Defiant in the United States. Google also operates international infrastructure. German website hosting does not mean all connected processing takes place in Germany.
For relevant restricted transfers, InMobi’s CMP agreement provides controller-to-controller standard contractual clauses; Defiant’s addendum provides controller-to-processor clauses. CookieYes’s agreement also provides standard contractual clauses for relevant transfers involving its processors and subprocessors. The linked provider agreements describe these safeguards.
Google describes reliance on adequacy decisions, the EU–US Data Privacy Framework for covered transfers to certified US entities, and standard contractual clauses where applicable. See Google’s international-transfer framework information. The appropriate mechanism depends on the recipient and service; a transfer mechanism and a data-processing agreement serve different purposes.
You may contact me using the details above to request further information about recipients and safeguards, or a copy of relevant safeguards subject to necessary protection of confidential information.
11. Your rights
Subject to the conditions in the GDPR, you may request access to your personal data, correction of inaccurate information, deletion, restriction of processing and data portability. You may withdraw consent at any time without affecting the lawfulness of earlier processing.
Where processing relies on legitimate interests, you may object on grounds relating to your particular situation. Processing must then stop unless compelling legitimate grounds override your interests, rights and freedoms, or the data is needed for legal claims. You may object to processing for direct marketing, including related profiling, at any time.
Contact m.ferrari@enzymenews.com to exercise these rights. I may need proportionate information to verify identity and locate the relevant records. For browser-based consent, changing the choice on the same browser and device helps apply it directly. If an independent provider controls the data, you can also use its privacy contact or rights process.
You have the right to complain to a data-protection supervisory authority, particularly in the EU member state of your habitual residence, workplace or an alleged infringement.
I do not use solely automated decisions that produce legal or similarly significant effects on you.
12. Changes to this notice
This notice will be updated when relevant services or processing practices change. Its update date identifies the version. Where a new use requires consent, that consent must be obtained before the use begins.