Privacy notice

1. Controller

2. Hosting and access data

Server-side processing of this website, including the contact form, runs in Vercel’s Frankfurt, Germany region (fra1). The hosting provider is Vercel Inc., 440 N Barranca Avenue #4133, Covina, CA 91723, USA. Requests reach that region through Vercel’s worldwide points of presence, so connection data may also be processed outside the European Economic Area (EEA), including in the USA.

Each request causes Vercel to process the visitor’s IP address, the time of the request, the page requested, the referring page, browser and operating system data, and technical error and security data. The purpose is to deliver the website, to protect it against misuse, and to produce aggregate access statistics. The legal basis is Article 6(1)(f) GDPR; the legitimate interests are the secure and reliable operation of the website and knowing its reach.

The aggregate statistics come from Vercel Web Analytics, which sets no cookies. A hash derived from the incoming request is used instead, reset every 24 hours; it permits neither identification nor recognition on another day or another website. There are no custom events, no advertising measurement and no individual visitor profiles.

Access data is deleted or anonymised once it is no longer required for those purposes. Data required to investigate a specific security incident is retained until that investigation and any related legal claims are concluded.

3. Contact form and email

Messages sent through the contact form or by email are processed in order to answer the enquiry. The data processed is the contact details provided, any organisation named, and the subject and content of the message. Providing this data is voluntary; without contact details and a message, an enquiry cannot be answered.

The legal basis is Article 6(1)(b) GDPR where an enquiry concerns a contract or pre-contractual steps, and otherwise Article 6(1)(f) GDPR; the legitimate interest is answering professional correspondence.

Contact-form messages are delivered by Brevo GmbH, Köpenicker Str. 126, 10179 Berlin, Germany, which hosts its databases in the European Union. Email is received, stored and sent using Microsoft 365 (Exchange Online), provided by Microsoft Ireland Operations Limited, Dublin, Ireland; mailbox data is stored in Germany under Microsoft’s EU Data Boundary.

Enquiries that do not lead to a business relationship are deleted within two years of the final reply. Contract-related correspondence is retained for the duration of the contract and for the applicable statutory retention periods.

4. Recipients and transfers

Beyond the providers named above, personal data is disclosed only to tax or legal advisers and to public authorities, and only where legally required.

Where these providers process data outside the EEA, the safeguards are the European Commission’s adequacy decisions — including the EU-U.S. Data Privacy Framework for certified recipients — or the Commission’s Standard Contractual Clauses. A copy of the applicable safeguards is available on request.

5. Rights of data subjects

Subject to the statutory conditions, data subjects have the right of access, rectification, erasure, restriction of processing and data portability (Articles 15–20 GDPR). Requests go to the contact details in section 1.

Right to object (Article 21 GDPR): where processing is based on Article 6(1)(f) GDPR, the data subject may object at any time on grounds relating to their particular situation. Processing will then cease, unless compelling legitimate grounds are demonstrated which override the interests, rights and freedoms of the data subject.

A complaint may be lodged with a data protection supervisory authority, in particular in the member state of residence or place of work. The authority responsible for the controller is Der Hessische Beauftragte für Datenschutz und Informationsfreiheit, Postfach 3163, 65021 Wiesbaden.