Privacy policy

The controller responsible for data processing on this website within the meaning of the General Data Protection Regulation (GDPR) is:

We have not appointed a data protection officer, as there is no legal obligation to do so (Art. 37 GDPR, § 38 BDSG). For any question about data protection, you can reach us at the address above.

This website is delivered through the network of Cloudflare, Inc., 101 Townsend Street, San Francisco, CA 94107, USA (“Cloudflare”). On every request, Cloudflare processes the connection data that is technically required to deliver the page to you and to protect it against attacks:

• the IP address of the requesting device,
• the date and time of the request,
• the requested address (URL) and the HTTP status code,
• the amount of data transferred,
• the previously visited page (referrer), if your browser sends it,
• browser type and version, operating system and preferred language.

If you open the start address without a language, your browser's preferred language is evaluated to redirect you to the German or English version. This evaluation is not stored.

The legal basis is Art. 6(1)(f) GDPR. Our legitimate interest lies in delivering the website securely, reliably and quickly.

Cloudflare processes this data as our processor under Art. 28 GDPR on the basis of its Data Processing Addendum. We have set up no additional logging and do not analyse the connection data on a personal level, unless this is necessary to fend off a specific attack. According to Cloudflare, it keeps the connection data only as long as required to deliver the website, protect it against attacks or meet statutory obligations. Cloudflare does not publish a fixed period; according to Cloudflare, the deciding criteria are the purpose of the processing, whether it can be achieved with less data, and statutory obligations.

Data may be transferred to the USA in the process. Cloudflare is certified under the EU-US Data Privacy Framework; the transfer is based on the European Commission's adequacy decision (Art. 45 GDPR). Should it lapse, the European Commission's Standard Contractual Clauses apply (Art. 46(2)(c) GDPR).

If Cloudflare classifies a request as suspicious, for instance during an attack, a short security check may appear before the page. A Cloudflare script reads technical properties of your browser and sends them to Cloudflare in order to detect automated access. Only if you pass the check does Cloudflare set a cookie (“cf_clearance”) recording this, so that the check is not repeated on every request. It expires after 30 minutes.

The legal basis for storing and reading it is § 25(2) no. 2 TDDDG, and Art. 6(1)(f) GDPR for any further processing. Our legitimate interest lies in protecting the website against abusive access. On an ordinary visit, this website sets no cookies.

From the connection data, Cloudflare compiles aggregated statistics, such as the number of requests and the countries they come from. We only see these figures in aggregated form. No usage profiles are created, and nothing is stored on or read from your device for this purpose.

The legal basis is Art. 6(1)(f) GDPR. Our legitimate interest lies in knowing whether and to what extent the website is used.

If you email us, we process your email address, your name if you give it, the content of your message and the technical details of the email in order to handle your request.

The legal basis is Art. 6(1)(b) GDPR where your request concerns a contract or pre-contractual steps, and Art. 6(1)(f) GDPR otherwise. Our legitimate interest lies in answering enquiries.

Our email is processed by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, as part of Google Workspace, acting as our processor. A transfer to Google LLC in the USA may take place. It is based on the European Commission's adequacy decision for the EU-US Data Privacy Framework, under which Google LLC is certified (Art. 45 GDPR), and alternatively on the European Commission's Standard Contractual Clauses (Art. 46(2)(c) GDPR).

We delete your message once your request has been dealt with, unless statutory retention obligations apply. If it concerns a commercial transaction, we keep it, for example as business correspondence, for six years from the end of the year of receipt (§ 257 HGB, § 147 AO).

The Impressum contains a contact form. When you submit it, we process your email address, your message and your name, if you give it, in order to handle your request. We need your email address and message to be able to reply; your name is optional.

Cloudflare receives the form as our processor and forwards it as an email to our mailbox. Cloudflare stores the message itself only temporarily, until it has been delivered; it logs the sending for up to 31 days with its time and delivery status, without your details. The processing of your details, including this forwarding, rests on the legal bases set out above under “Contact by email”. Once the message has reached our mailbox, what is said there also applies to how long it is kept.

To protect the form against automated access, we use Cloudflare Turnstile. Only when you start filling in the form does your browser load a script for it from challenges.cloudflare.com. It solves small computational tasks in the browser, reads technical characteristics of your browser and device, may also evaluate how you interact with the page, and sends this information, together with your IP address, the TLS fingerprint of the connection, your browser identifier (user agent) and the address of our page, to Cloudflare, which uses it to assess whether a human is using the form. According to Cloudflare, Turnstile does not read what you enter in the form. The form receives the result as a single-use token, not as a cookie. When you submit the form, we check this token with Cloudflare and send your IP address along for that purpose. The form cannot be submitted without this check; you can then reach us by email.

Cloudflare processes this information as our processor in order to carry out the check for us. At the same time, Cloudflare uses the same information as a controller in its own right to improve its detection of automated access. We cause it to reach Cloudflare for that purpose by embedding Turnstile; we are responsible for this collection and transmission. Cloudflare alone decides on any further use, which is governed by Cloudflare's Turnstile privacy addendum (www.cloudflare.com/turnstile-privacy-policy). To that extent, you can also exercise your rights directly against Cloudflare (dpo@cloudflare.com). Cloudflare does not publish how long it keeps this information; the criteria set out above under “Hosting and server log files” apply.

In addition, Cloudflare counts on our behalf how often the form is submitted from an IP address, and briefly blocks that address if there are too many requests. Each count lasts only a few seconds and serves this limit alone. If a request is blocked, Cloudflare shows us this, with the IP address, for up to 31 days in its overview of security events.

The legal basis for storing information in your browser and reading the browser and device characteristics is § 25(2) no. 2 TDDDG: it is strictly necessary for us to provide the form you expressly wish to use, protected against automated misuse. For the remaining processing — the check by Cloudflare, the transmission of your IP address on submission, the limit per IP address and the transmission to Cloudflare for its own purposes as well — it is Art. 6(1)(f) GDPR. Our legitimate interest lies in protecting our mailbox against automatically sent messages and in using effective, continuously improved protection for that purpose.

Cloudflare may process this information in the USA. The transfer is based on the adequacy decision for the EU-US Data Privacy Framework, under which Cloudflare is certified (Art. 45 GDPR); insofar as Cloudflare acts on our behalf, alternatively on the Standard Contractual Clauses (see “Hosting and server log files”).

If you choose a light or dark theme with the toggle, your browser stores that choice in its local storage (localStorage) so it is kept for your next visit. The setting never leaves your device and is not transmitted to us or to anyone else. You can change it at any time with the toggle or delete it in your browser.

Storing it is permitted without consent under § 25(2) no. 2 TDDDG, because it is strictly necessary to provide the display you explicitly chose. No personal data is processed in doing so.

Apart from hosting through Cloudflare and the contact form's spam protection, which loads only once you start filling in the form, this website loads no third-party resources: all other fonts, graphics and scripts are served from our own domain. It uses no analytics or tracking services.

You are under no statutory or contractual obligation to provide us with data. Without the connection data, however, the website cannot be delivered. There is no automated decision within the meaning of Art. 22 GDPR. Turnstile does decide automatically whether the contact form can be submitted; this has no legal effect on you and does not similarly significantly affect you, because you can always reach us by email.

You have the right to

• access the data stored about you (Art. 15 GDPR),
• rectification of inaccurate data (Art. 16 GDPR),
• erasure (Art. 17 GDPR),
• restriction of processing (Art. 18 GDPR),
• data portability (Art. 20 GDPR).

To exercise these rights, an email to the data protection address above is enough.

You have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR), in particular in the Member State of your habitual residence, place of work or place of the alleged infringement. The authority competent for us is: