Privacy policy

Data controller

Website delivery and security

When this website is accessed, your browser transmits technically necessary connection data. This may include, in particular, the IP address, date and time, requested URL, referrer URL, browser and operating system information, and other HTTP headers. Without the transmission of the IP address in particular, the website cannot be delivered.

The website is delivered via Cloudflare Pages. The provider is Cloudflare, Inc., 101 Townsend Street, San Francisco, CA 94107, USA. Cloudflare processes the data on our behalf to deliver, accelerate and secure the website. This includes automatic protection against overload attacks and abusive access, which checks requests based on connection and header data and may block suspicious requests or subject them to a security check. Recipients are Cloudflare and the subprocessors engaged by Cloudflare. We do not export any personal access logs to an analytics system of our own.

When the home page is requested, a server-side function uses the preferred language transmitted by your browser to redirect to the German or English version. The function does not store this information.

Cloudflare obfuscates the email addresses shown on this website to protect them from automated harvesting by spam programs. For this purpose, Cloudflare delivers a script via this domain that makes the addresses readable again in your browser. The script sets no cookies and transmits no data.

Legal basis

Art. 6(1)(f) GDPR

Legitimate interest

Secure, fast and reliable delivery of this website

Retention period

Cloudflare deletes or anonymizes personal log data according to product- and plan-specific periods. These depend on the type of log and on whether it is needed for security and incident analysis. We do not make any further copy.

Cloudflare operates a global network; data may therefore also be processed outside the European Economic Area. Transfers to the certified Cloudflare, Inc. in the USA are covered by the adequacy decision for the EU-U.S. Data Privacy Framework. Where neither this nor another adequacy decision applies, Cloudflare relies in particular on EU Standard Contractual Clauses and supplementary measures. Cloudflare data processing terms and list of subprocessors.

Cookies and similar technologies

We do not use any cookies of our own, no local or session storage, no client-side audience measurement, no advertising, and no externally embedded fonts, media or scripts. Cloudflare currently does not set a cookie on a regular page view either.

Cloudflare may set technically necessary cookies during security-relevant events or when corresponding protective features are enabled, such as __cf_bm for bot detection or cf_clearance after a security check. These cookies serve to defend against abusive access, not our analytics or advertising. Their names, purposes and lifetimes are described in the Cloudflare cookie policy. We base their storage and retrieval on Section 25(2) No. 2 of the German Telecommunications Digital Services Data Protection Act (TDDDG). We do not use any technologies that require consent; therefore we do not use a consent banner.

Contact by email

When you contact us by email, we process the sender and recipient addresses, technical header data, the content and any attachments in order to handle your inquiry. Providing this data is voluntary; without a reachable sender address and the necessary information, we cannot answer your inquiry.

Incoming email is received by Cloudflare Email Routing. A function at Cloudflare checks the size and recipient address and forwards the message to Amazon Simple Email Service (Amazon SES) in Frankfurt am Main, Germany; it stores neither addresses nor content. According to its own documentation, Cloudflare retains routing event data such as sender, recipient, subject, message ID and processing status for up to 31 days.

We operate our email system ourselves on Amazon Web Services in the Frankfurt am Main region. The provider is Amazon Web Services EMEA SARL, 38 Avenue John F. Kennedy, L-1855 Luxembourg. Amazon SES automatically scans incoming messages for spam and malware and determines the results of the SPF, DKIM and DMARC sender checks. Messages and the data derived from them are stored encrypted in Amazon S3 and Amazon DynamoDB. Messages that fail the spam or virus check are stored separately and deleted automatically after 30 days. The technical logs of our system are designed to contain no addresses or content and are deleted after 14 days.

We send our replies via the email delivery service SMTP2GO, operated by Sand Dune Mail Ltd, Christchurch, New Zealand, through its data center in the European Union. For this purpose, SMTP2GO processes the complete message, including the recipient addresses, and reports the delivery status for each recipient to us. Open and click tracking and archiving at SMTP2GO are disabled.

Recipients are therefore Cloudflare, Amazon Web Services and SMTP2GO and their subprocessors; they process the data on our behalf. The safeguards for international data transfers described above apply to Cloudflare. New Zealand, where SMTP2GO is based, is covered by an adequacy decision of the European Commission. Where Amazon Web Services or SMTP2GO process data outside the European Economic Area, they rely on adequacy decisions or EU Standard Contractual Clauses.

The legal basis is Art. 6(1)(b) GDPR insofar as your inquiry concerns a contract or pre-contractual measures, and otherwise Art. 6(1)(f) GDPR. Our legitimate interest is handling the inquiry addressed to us. We delete inquiries that do not lead to a contractual relationship no later than six months after they have been fully handled. Where messages are required for a contractual relationship, legal defense or statutory retention obligations, we store them for the applicable period. This is generally three years for potential claims, six years for commercial and business letters, and eight years for accounting records, in each case calculated in accordance with the statutory requirements. The legal basis for retention for legal defense is Art. 6(1)(f) GDPR, and for statutory retention obligations Art. 6(1)(c) GDPR.

Your rights

Subject to the statutory requirements, you have the right of access, rectification, erasure, restriction of processing, data portability and objection to processing. A message to the contact address above is sufficient to exercise your rights. Where processing is based on Art. 6(1)(f) GDPR, you may object to it on grounds relating to your particular situation.

Right to lodge a complaint

You have the right to lodge a complaint with a data protection supervisory authority. The competent authority is, in particular:

Last updated

October 13, 2026