Privacy Policy

Controller

Data Protection Officer

We are not required to appoint a Data Protection Officer.

Overview

• We process the minimum necessary personal data.
• We do not sell personal data.
• We use cookieless analytics (Umami) without cross-site tracking.

Data we process

• Server logs

  IP address (short-lived), user agent, timestamp, requested URL, referrer. Used for security and troubleshooting.

• Business contact data

  Name, email, company and message contents when you email us or engage our services.

• Analytics (aggregated)

  Non-identifying usage metrics collected via Umami without cookies.

Where we get data

We collect personal data directly from you (e.g., when you email us or engage our services). If we receive data from third parties (e.g., referrals), this is limited to business contact details such as name, work email, company and role.

If you must provide data

Providing business contact data is necessary for us to respond to inquiries and to enter into or perform a contract. If you do not provide this information, we cannot deliver services. Server logs are collected automatically when you visit our site.

Legal bases

• Art. 6(1)(f) GDPR: Legitimate interests: service security, fraud prevention, product analytics.
• Art. 6(1)(b) GDPR: Pre-contractual steps and contract performance when you engage us.
• Art. 6(1)(c) GDPR: Legal obligations (accounting, tax recordkeeping).
• Art. 6(1)(a) GDPR: Consent where required (e.g., optional marketing).

Purposes of processing

• Operate and secure our website and infrastructure.
• Respond to inquiries and deliver services.
• Plan capacity and improve reliability.
• Maintain legal and accounting records.

Automated decisions

We do not use automated decision-making or profiling that produces legal or similarly significant effects.

Retention

We keep personal data only as long as necessary for the purposes above or to meet legal obligations.

• Server logs: 90 days
• Support & sales emails: 24 months
• Contract & billing records: 10 years (accounting)

Processors & recipients

• Google Cloud Platform

  Hosting & infrastructure provider · EU/EEA regions

International transfers

We do not intentionally transfer personal data outside the EEA. If a transfer occurs, we rely on Standard Contractual Clauses and additional safeguards.

Your GDPR rights

Under the GDPR you have the following rights:

• Access (Art. 15)
• Rectification (Art. 16)
• Erasure (Art. 17)
• Restriction (Art. 18)
• Portability (Art. 20)
• Objection (Art. 21)
• Withdraw consent at any time (Art. 7(3))

To exercise your rights, contact us via the email below. We respond within one month.

Cookies

We do not use tracking cookies. Essential cookies may be used only if technically necessary.

Contact

Supervisory authority

Children's privacy

Our services target businesses. We do not knowingly collect data about children under 16.

Changes to this policy

We may update this policy. The latest version applies from the "Last updated" date above.