Privacy notice

Controller

The controller within the meaning of the GDPR is the person named in the legal notice, at the address stated there, reachable at the e-mail address and the telephone number stated there.

Data protection officer

A data protection officer has not been appointed. Whether one is required under Article 37(1)(c) GDPR is being examined by a specialist lawyer; the result is entered here.

Server logs

Operating log: the full IP address, the time, the address called up and the status code are stored for the purpose of IT security and the prevention of misuse, Article 6(1)(f) GDPR. Retention: 7 days, then deletion.

Evaluation log: the IP address is shortened at the moment of writing to the /24 prefix for IPv4 and to /32 for IPv6, the timestamp is rounded to the full hour, the referrer is shortened to the host. Retention: 24 months. A figure is only reported where at least five records fall under it.

No reach measurement with recognition takes place. No profile is formed and no visit is linked to another.

You may object at any time to processing based on Article 6(1)(f) GDPR — Article 21 GDPR.

No cookies, no tracking

Nothing is stored on your device and nothing is read from it. Section 25 TDDDG therefore does not apply. There is no consent dialogue, no cookie, no processor for measurement and no transfer to a third country for that purpose.

Fonts and external requests

All fonts are hosted on the same server. On first load the site makes zero external requests. You can check that in the network tab of your browser.

Contact form

There is currently no contact form on this site. Contact is made by telephone, by Threema or by e-mail.

Channels of communication

• Telephone — connection data are processed by the network operator.
• Threema Work, Threema GmbH, Pfäffikon SZ, servers in Switzerland, adequacy decision under Article 45 GDPR.
• File drop on Hetzner Storage Share, data centre FSN1 Falkenstein, Germany.
• Mail at Heinlein Hosting (mailbox.org), Berlin, Germany.
• Website hosting within the European Union.

Named expressly: on an iPhone, the notification of an incoming Threema message runs through Apple’s push service. The content is not readable there; that a message has arrived is. For each provider there is a processing agreement under Article 28 GDPR and a written obligation of secrecy under Section 203(4) of the German Criminal Code.

Case records and retention

Case records lie on an encrypted drive with an encrypted offline backup in a second location. No cloud service is used for them. Where a treatment relationship exists, they are kept for ten years after completion, Section 630f(3) of the German Civil Code. If no mandate comes about, they are deleted within 30 days. A copy is handed out on request, Section 630g of the German Civil Code.

Enquiry journal

Enquiries are recorded in a journal with date, route, capacity and the deadline agreed — without diagnosis and without findings. Purpose: traceability of the deadlines promised, Article 6(1)(f) GDPR; where Article 9 is touched, Article 9(2)(h) in conjunction with Section 22 BDSG. Deletion after 36 months.

Record of processing activities

• Server logging.
• Contact form.
• Enquiry journal.
• Case records.

Your rights

You have the right of access, to rectification, to erasure, to restriction of processing, to data portability and to object under Article 21 GDPR. Where processing rests on consent, you may withdraw it at any time with effect for the future.

You may lodge a complaint with the supervisory authority: ⟨AUFSICHTSBEHÖRDE⟩, ⟨ANSCHRIFT DER AUFSICHTSBEHÖRDE⟩.

Status of this notice

This notice is as at 2026-08-07.