1.Controller
The controller responsible for data processing on this website under the General Data Protection Regulation (GDPR) is:
Leon Redlich
Mühlenseßmar 21
[postcode] Gummersbach, Germany
Email: [contact email]
Further details can be found in our Imprint.
2.Summary
- We only collect the data we need to run our website and provide your servers.
- No tracking, no analytics, no advertising, no social media plugins.
- Everything, including fonts, is served from our own server in Germany. Your browser does not connect to third parties when you visit us.
- We only use one cookie, and only after you log in. It is technically required.
- We never sell your data.
3.Hosting
Our website and customer area run on a server operated by our hosting provider virtbase in a data centre in Aachen, Germany. All data described in this policy is stored and processed on this server within the European Union. Where required, we have concluded a data processing agreement with the provider under Art. 28 GDPR.
Our TLS certificate is issued by Let's Encrypt. Your browser may check the certificate's validity with the certificate authority. No personal data is transferred to Let's Encrypt by us.
4.Server log files
Each time you visit our website, our web server automatically stores the following information in log files:
- IP address of the requesting device
- Date and time of the request
- Requested page or file, HTTP status code and amount of data transferred
- Referrer URL (the page you came from), if sent by your browser
- Browser type and version, operating system (user agent)
Purpose and legal basis: These data are needed to deliver the website, to keep it secure, and to detect and defend against attacks and misuse. The legal basis is our legitimate interest under Art. 6(1)(f) GDPR.
Storage period: Log files are deleted automatically after 14 days, unless a specific security incident requires us to keep individual entries for longer to investigate it.
5.Customer account
When you create an account, we store:
- Your email address
- Your password, only as a salted cryptographic hash (scrypt). We cannot see or recover your password.
- The date your account was created
- Login sessions: a hashed session identifier and its creation and expiry time
Purpose and legal basis: We need these data to provide your account and our services, i.e. to perform our contract with you or to take steps prior to entering into one (Art. 6(1)(b) GDPR).
Protection against misuse: To protect accounts from brute-force attacks, we briefly keep the IP address and the email address used for login and registration attempts in memory to limit the number of attempts. These entries are not written to disk and are deleted after at most one hour. Legal basis: Art. 6(1)(f) GDPR, our legitimate interest in the security of our service.
Storage period: Sessions expire after 30 days or when you log out. Your account data are stored until you delete your account. You can do this at any time in your account settings. Your data are then deleted immediately. Where we are legally required to retain data (e.g. invoices under German commercial and tax law for up to 10 years), we restrict processing of these data to that purpose.
6.Cookies
We use exactly one cookie:
- Name: __Host-sid
- Purpose: keeps you logged in to your customer account
- Set: only after you log in or register
- Lifetime: 30 days, or until you log out
- Type: first-party, technically required, not readable by scripts (HttpOnly), only sent over encrypted connections
Because this cookie is strictly necessary to provide the service you request, no consent is required (§ 25(2) no. 2 TDDDG). The legal basis for the related processing is Art. 6(1)(b) GDPR. We do not use any tracking or marketing cookies.
7.Security measures
All connections to our website are encrypted using TLS (HTTPS). Passwords are stored only as salted hashes, and session identifiers are stored only in hashed form. Administrative access to our servers is restricted to authorised persons.
8.Contacting us
If you contact us by email, we process your email address and the content of your message to answer your request. Legal basis: Art. 6(1)(b) GDPR if your request relates to a contract, otherwise Art. 6(1)(f) GDPR (our legitimate interest in answering enquiries). We delete these data once your request has been fully dealt with, unless statutory retention obligations apply.
9.Data on your servers
We do not access the contents of the virtual servers you rent from us, except where necessary to provide the service, to investigate abuse or security incidents, or where required by law. If you process personal data of third parties on your server, you are the controller for that data. If you need a data processing agreement (Art. 28 GDPR) with us, please contact us.
10.What we don't use
We do not use web analytics (such as Google Analytics), advertising networks, social media plugins, external fonts, external content delivery networks, or tracking pixels. There is no automated decision-making or profiling within the meaning of Art. 22 GDPR. We do not transfer personal data to countries outside the EU/EEA.
11.Your rights
Under the GDPR you have the right to:
- Access the personal data we hold about you (Art. 15)
- Rectification of inaccurate data (Art. 16)
- Erasure of your data (Art. 17). You can delete your account yourself at any time.
- Restriction of processing (Art. 18)
- Data portability (Art. 20)
- Object to processing based on our legitimate interests (Art. 21), on grounds relating to your particular situation
To exercise your rights, simply contact us using the details in section 1.
You also have the right to lodge a complaint with a data protection supervisory authority, in particular in the EU member state of your habitual residence, your place of work or the place of the alleged infringement (Art. 77 GDPR).
12.Changes
We update this policy when our services or legal requirements change. The current version is always available on this page. When we introduce new processing, for example online payments, we will add the relevant information here before it goes live.