Privacy notice

Controller

Privacy requests may be sent by post to:

Application delivery and technical logs

Technically necessary connection data

When the application is accessed, the IP address, time, requested URL, HTTP metadata, and browser and device information may be processed. This is necessary to deliver pages, prevent attacks, diagnose errors, and operate the application securely.

The legal basis is Article 6(1)(f) GDPR. The legitimate interest is the secure, stable, and accountable operation of the application.

Vercel

The application is delivered through Vercel Inc. Its configured server execution region is Frankfurt am Main, Germany.

Vercel may use further locations and subprocessors for delivery, security, support, and service-related metadata. This may involve processing outside the European Economic Area, particularly in the United States. Such transfers are safeguarded by the agreed data protection terms and appropriate safeguards, in particular the EU Standard Contractual Clauses.

Supabase

Supabase Inc. provides authentication and the hosted database. It may process the email address, authentication and session identifiers, login and security metadata, the selected language, and, in future, authorized customer and workspace data.

Covered customer data is stored and primarily processed in the infrastructure region configured for the Supabase project. Support and subprocessors may require processing in other countries, including the United States; the agreed data protection terms and appropriate safeguards apply.

Contact form and email inquiries

When the contact form is used, the name, reply email address, selected category, message, language, and technically necessary request metadata are processed to deliver and respond to the inquiry. The application sends the message through a Supabase Edge Function and Amazon Simple Email Service (AWS SES) to the responsible internal mailbox. The recipient address is not disclosed in the website source, and the application does not store the submitted form content in its database.

Processing is based on Article 6(1)(b) GDPR where the inquiry concerns steps prior to entering into or performing a contract. For other inquiries, it is based on Article 6(1)(f) GDPR; the legitimate interest is to receive, route, protect, and respond to legitimate messages.

Account and protected workspace

During registration and sign-in, the application processes the email address, authentication data in a technically protected form, session identifiers, login and security metadata, and the language stored in the account. Further profile, customer, and interview data may be added later where required for the commissioned IT Health Check and after the functional and data-protection rules have been defined.

Processing is necessary to take steps before entering into and to perform a contract under Article 6(1)(b) GDPR, and to secure accounts and the application under Article 6(1)(f) GDPR. Authorization is assigned separately after registration.

Cookies and local storage

The application uses only technically necessary cookies. These do not require consent under section 25(2)(2) TDDDG. The associated processing of personal data is based on Article 6(1)(b) and (f) GDPR.

The application does not use optional analytics, marketing, advertising, or social-media cookies. If such functionality is introduced later, it must not load before valid consent; this notice and the consent controls must first be updated.

Recipients and international transfers

Data is disclosed only to the processors Vercel, Supabase, and Amazon Web Services for email delivery, including their necessary subprocessors, authorized persons involved in the IT Health Check, and public authorities where disclosure is legally required. Transfers to third countries take place only on the basis of an adequacy decision or appropriate safeguards such as the EU Standard Contractual Clauses.

Retention

The language cookie is retained for no more than one year. Account, authentication, and workspace data is deleted or anonymized when it is no longer required for its purpose and no statutory retention obligation applies. Contact messages and correspondence are retained only for as long as needed to process the inquiry and meet applicable statutory documentation and retention obligations. Technical delivery, security, and error logs are retained for a limited period according to the necessary and configured provider settings.

Your rights

Where the legal requirements are met, data subjects have the following rights in particular:

• Access to personal data being processed
• Rectification of inaccurate or incomplete data
• Erasure of personal data
• Restriction of processing
• Data portability
• Objection to processing based on legitimate interests

Data subjects also have the right to lodge a complaint with a data protection supervisory authority.

No automated decision-making, including profiling, takes place.

Changes to this notice

This privacy notice will be updated when functionality, service providers, or legal requirements change. The current version is available on this page.