Privacy notice

Website access and hosting

We use a hosting provider in Germany to deliver this website.

Validatus UG (haftungsbeschränkt) handles the technical operation of the website on our behalf.

Your IP address and the requested resources are processed to deliver the website. Our web server produces technical access and error logs. These may include your IP address, timestamps, requested resources, browser information, referrers and technical status messages. No additional access or error logs containing personal data are maintained in our website stack.

The purpose is reliable, secure website delivery and identifying and resolving faults. The legal basis is Article 6(1)(f) GDPR; our legitimate interest is the secure operation of this website.

Ordinary web server logs are deleted after seven days from creation of each entry. Where individual entries are needed to investigate a specific security incident, further retention is limited to the documented investigative or evidentiary purpose.

Contacting us

The contact form processes your first and last name, email address, organization, telephone number, enquiry type and message. You may also provide a job title. When you email us, we process the contact information and message content you provide.

We use these details to handle and respond to your enquiry. Required fields are identified in the form. We may be unable to handle an enquiry without the information necessary to do so.

Article 6(1)(b) GDPR applies where an enquiry concerns entering into or performing a contract with you. Other enquiries are processed under Article 6(1)(f) GDPR, based on our interest in responding to incoming requests.

We generally delete completed enquiries and related emails 30 days after handling is complete. Statutory retention obligations or necessary evidence may justify longer storage.

We also store a reference identifier and processing timestamps to associate and delete a form enquiry. This does not additionally store the message content in the website database.

Insights and email updates

When you sign up for insights, we collect your first name, last name and email address. Our website stores these details and the registration timestamp in our own database. An internal notification of the signup is also sent.

The purpose is to manage your signup and the email updates you request. The intended delivery of updates is based on your consent under Article 6(1)(a) GDPR. You may withdraw consent at any time with effect for the future by contacting [email protected]. This does not affect the lawfulness of earlier processing.

Signing up is voluntary. An email address is necessary to deliver updates. Fastmail currently sends SMTP form notifications; this does not identify a separate service for sending email campaigns.

Active subscriptions remain stored until cancellation. After cancellation, we generally delete signup information within 30 days, unless statutory retention obligations or necessary evidence require otherwise.

Email processing

We use Fastmail for SMTP messages generated by the website forms and for the support mailbox used to handle enquiries. The provider is Fastmail Pty Ltd, PO Box 234, Collins Street West, VIC 8007, Australia. The information needed for each form message is transmitted, including your contact details and, where applicable, message content.

This enables delivery of your enquiry or an internal signup notification. The legal basis follows the purpose of the enquiry or signup. This does not implement Fastmail marketing or newsletter tracking.

Fastmail offers different storage regions. Even with primary EU storage, replicas, backups and other operational data may be processed in the United States. Fastmail describes standard contractual clauses among its safeguards for transfers outside the EU.

• Fastmail privacy policy
• Fastmail data regions
• Fastmail data-protection agreement

Language preference and site search

When you switch language, the website stores your choice in the NEXT_LOCALE cookie on your device. It contains your language preference, applies to this website and has a maximum lifetime of one year. It supports your selected German or English version.

The related data processing is based on Article 6(1)(f) GDPR; our interest is retaining your chosen language. Section 25(2)(2) TDDDG applies where this device storage is strictly necessary for the service you expressly request. You can delete the cookie in your browser settings.

Site search uses an index delivered by our own website. Search terms are processed in your browser rather than sent to an external search-engine provider.

Self-hosted form protection

Our contact and signup forms use open-source Cap on our own website stack. The widget, verification and required files are delivered through our website. Google reCAPTCHA and external CAPTCHA services are not integrated.

Cap presents a short-lived computational challenge and checks technical browser characteristics for signs of automation. These may include browser identifiers, window and screen dimensions, automation markers and text metrics. Verification data is transmitted to our server and checked there; the application does not persist these probe vectors.

Challenge and form tokens are each valid for five minutes and may be used once. To prevent reuse, our database stores verification keys or hashes, the form scope and expiry. Expired entries are invalid and are removed on subsequent verification requests. The form protection sets no cookie of its own and integrates no external tracking service.

The purpose is protecting our forms against spam and abuse. Article 6(1)(f) GDPR is the intended legal basis for personal-data processing, based on our interest in securely operating the forms.

Locally delivered fonts

We deliver the Sora font through our own website. Loading the font creates no connections to Google Fonts or other external font providers. The general website-access and hosting information applies to these files.

Recipients and retention

Recipients are the people handling your enquiry or signup and the hosting and email providers required for the respective purpose. Other recipients may follow from legal obligations.

The following retention periods and starting points have been defined for each type of data:

Longer retention applies only where a specific statutory obligation or the necessary preservation of evidence justifies it. Such data must be limited to what is necessary. Retention ends when the applicable obligation or documented evidentiary purpose ends; the data is then deleted. This exception does not apply automatically to all enquiries or subscriptions.

Rights

Subject to the applicable legal conditions, you have rights of access, rectification, erasure, restriction and data portability under Articles 15–20 GDPR. You may withdraw consent with effect for the future under Article 7(3) GDPR.

For processing under Article 6(1)(f) GDPR, you may object on grounds relating to your particular situation under Article 21 GDPR. You may object to direct-marketing processing at any time.

Contact [email protected] to exercise your rights. You may also complain to a supervisory authority under Article 77 GDPR, particularly where you live or work or where you believe an infringement occurred.

• North Rhine-Westphalia data-protection authority

Changes to this notice

We update this notice when our services, data processing or legal requirements change. The version provided on this website is the applicable version.