Privacy Policy

1. Controller

The controller within the meaning of the General Data Protection Regulation (GDPR) is:

Chris Zemmel
Ostendstraße 1
75331 Engelsbrand, Germany
Email: [email protected]

2. No cookies, no tracking of individuals

This website sets no cookies and writes nothing to your browser’s local or session storage. There is no advertising network, no cross-site tracking and no visitor profiling. Because nothing is stored on or read from your device, no consent banner under § 25 TDDDG is required.

3. Hosting and server logs

This website is hosted by Vercel Inc. (340 S Lemon Ave #4133, Walnut, CA 91789, USA). When the website is accessed, Vercel processes technically necessary access data (including IP address, time of access, requested resource, volume of data transferred, and user agent) in order to deliver the page and ensure the security of operation. The legal basis is Art. 6 (1) (f) GDPR (legitimate interest in the secure and stable operation of the site). For transfers to the USA, we rely on the EU Commission’s Standard Contractual Clauses and/or the EU-US Data Privacy Framework.

4. Audit request form

If you use the “Request an audit” form, we process the data you enter: the name or protocol you give, the engagement you select, your chosen contact channel and handle or address, an optional repository link, and an optional free-text description. This is used solely to respond to your enquiry. The legal basis is Art. 6 (1) (b) GDPR (steps taken at your request prior to entering into a contract) and Art. 6 (1) (f) GDPR (legitimate interest in processing enquiries).

Two things happen automatically when you submit the form, which we mention for the sake of completeness:

• Repository link check. If you supply a repository link, our server resolves that hostname and makes a single minimal request to it in order to confirm the link is reachable before we accept the submission. The operator of that address may record this request. We do not store the response.
• Abuse protection. Your IP address is held briefly in the memory of the handling server to limit how many submissions can be made in a short period. It is not written to any database and is not part of the notification we receive.

5. Transfer to Telegram

Submissions from the form in section 4 are delivered to the operator via the messaging service Telegram (Telegram FZ LLC, Dubai, UAE). In doing so, the data you entered may be transferred to a third country outside the EU/EEA for which no adequacy decision by the EU Commission exists. A corresponding data protection risk cannot be entirely ruled out. If you would prefer your enquiry not to pass through Telegram, please email us at the address in section 1 instead.

6. Reach measurement (Vercel Analytics)

This website uses Vercel Analytics to record aggregate page views and referrer information. According to the provider, the service operates without cookies and without cross-site tracking, and does not build profiles of individual visitors. The legal basis is Art. 6 (1) (f) GDPR (legitimate interest in understanding the reach of the offering). You may object to this processing at any time (see section 9).

7. Fonts and external links

The fonts used (Inter and Space Grotesk) are downloaded at build time and served locally from our server; no connection is made to Google Fonts when you visit the site, and no request carrying your IP address reaches Google.

The “Book a call” buttons link to Calendly (Calendly LLC, USA). Following that link takes you to Calendly’s own website, where Calendly acts as the controller for any data you provide and for any cookies it sets. Their privacy policy applies from that point. The same is true of the GitHub, X, Telegram and LinkedIn links in the footer of the home page.

8. Storage period

We store personal data only for as long as is necessary for the respective purposes or as required by statutory retention periods. Enquiries are deleted once they have been dealt with and no statutory retention obligation prevents this.

9. Your rights

You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20), and the right to object to processing based on Art. 6 (1) (f) GDPR (Art. 21). To exercise your rights, a message to the email address above is sufficient.

10. Right to lodge a complaint

You have the right to lodge a complaint with a data protection supervisory authority. The competent authority includes the State Commissioner for Data Protection and Freedom of Information of Baden-Württemberg (Der Landesbeauftragte für den Datenschutz und die Informationsfreiheit Baden-Württemberg).