Privacy notice.

We have not designated a data protection officer because the statutory thresholds in BDSG § 38 are not met (fewer than 20 persons regularly engaged in automated processing, no high-risk processing under GDPR Art. 35).

If that situation changes, this section will be updated and a DPO contact will be published before any obligation triggers.

We process the following categories of personal data:

• +Server logs (IP address, user-agent, request URL, timestamp, response status, referring URL) — purpose: site security and stability, abuse prevention, debugging. Legal basis: Art. 6 (1)(f) GDPR (legitimate interest in operating a secure web service). Retention: maximum 7 days, then automatically deleted at the hosting layer.
• +Contact form / email enquiries (name, email address, phone if provided, company, message content) — purpose: replying to your enquiry. Legal basis: Art. 6 (1)(b) GDPR (pre-contractual measures) where you ask about our service, otherwise Art. 6 (1)(a) (consent). Retention: as long as needed to handle the enquiry plus statutory commercial / tax retention periods (HGB § 257, AO § 147 — typically 6 to 10 years for documents that become commercial correspondence).
• +Language preference (stored client-side) — purpose: rendering the site in the chosen language on subsequent visits. Legal basis: TTDSG § 25 (2) Nr. 2 (strictly necessary for the user-requested service). Retention: until you clear your browser storage.
• +Cookie consent record (stored client-side) — purpose: documenting your consent decision per Art. 7 (1) GDPR and avoiding repeated prompts. Legal basis: TTDSG § 25 (2) Nr. 2 + Art. 6 (1)(c) GDPR (legal obligation to demonstrate compliance). Retention: 12 months, then re-prompted.

This site is hosted by Vercel Inc., 340 S Lemon Ave #4133, Walnut, CA 91789, USA, with primary serving from EU edge locations (Frankfurt am Main / Stockholm / Dublin). A data processing agreement (DPA) under Art. 28 GDPR is in place. Where Vercel processes data outside the EU/EEA, transfers are based on the EU-US Data Privacy Framework (Vercel is a self-certified participant) and additionally on Standard Contractual Clauses (Commission Implementing Decision (EU) 2021/914) as a fallback safeguard.

The server-side logs described above are processed by Vercel on our instructions and deleted on the schedule disclosed.

Personal data is shared only with processors strictly necessary for the operation of the site and the handling of enquiries:

• +Vercel Inc. — hosting and CDN (data processor under Art. 28 GDPR).
• +Email infrastructure of the controller — for receiving and replying to enquiries. We do not send marketing email without separate, specific consent.
• +Tax advisors, auditors, and legal counsel — only where commercial / tax retention obligations require it.

Where transfers outside the EU/EEA occur (currently limited to Vercel infrastructure as described above), they are governed by:

• +EU-US Data Privacy Framework (Commission adequacy decision of 10 July 2023, where applicable to the recipient).
• +Standard Contractual Clauses (SCCs) per Commission Implementing Decision (EU) 2021/914.
• +Additional technical and organisational measures (encryption in transit, encryption at rest, access controls).

You have the following rights under the GDPR with respect to personal data we process about you:

• +Right of access (Art. 15) — confirmation whether we process your data and a copy thereof.
• +Right to rectification (Art. 16) — correction of inaccurate data.
• +Right to erasure (Art. 17) — deletion where the legal grounds permit.
• +Right to restriction of processing (Art. 18).
• +Right to data portability (Art. 20) — for data you provided to us based on consent or contract.
• +Right to object (Art. 21) — to processing based on legitimate interests.
• +Right to withdraw consent (Art. 7 (3)) — at any time, without affecting the lawfulness of processing before withdrawal.
• +Right to lodge a complaint with a supervisory authority (Art. 77) — typically the authority of your habitual residence, place of work, or place of the alleged infringement.

For complaints about our processing in Germany: Landesbeauftragter für den Datenschutz und die Informationsfreiheit Baden-Württemberg, Lautenschlagerstraße 20, 70173 Stuttgart, Germany. Web: baden-wuerttemberg.datenschutz.de.

For matters falling under federal jurisdiction: Bundesbeauftragter für den Datenschutz und die Informationsfreiheit (BfDI), Graurheindorfer Straße 153, 53117 Bonn, Germany. Web: bfdi.bund.de.

We do not engage in automated decision-making within the meaning of GDPR Art. 22 (including profiling) on this website.

We will update this notice when our processing changes (new vendors, new categories, new purposes). The date at the top of the page indicates the last material change. If the change concerns cookie / storage categories, the consent banner will reappear so you can re-decide.