Privacy Policy

1. Controller

The controller responsible for processing personal data on this website is:

You can also reach us through the contact form.

2. Provision of the website and hosting

Our website is hosted by STRATO GmbH, Otto-Ostrowski-Straße 7, 10249 Berlin, Germany. To deliver the pages and files you request, your IP address, the requested resource, the date and time, and technical connection data are processed.

Processing serves the availability, stability and security of the website. The legal basis is Article 6(1)(f) GDPR; our legitimate interest is operating a secure and functioning website. We have entered into a data processing agreement under Article 28 GDPR with STRATO.

3. Server logs

When you access the website, data including your IP address or an anonymised connection identifier, access time, files requested, status codes, data volume, browser and device information and, if transmitted, the referrer URL may be processed.

According to STRATO, visitor IP addresses used to detect and prevent attacks are retained for no more than seven days. Logs available to customers use anonymised identifiers according to the provider and can be accessed in the customer area for six weeks. This availability period is not equivalent to the retention period for full IP addresses.

The legal basis is Article 6(1)(f) GDPR (website operation and security).

4. Cookies and similar technologies

When you open the contact form, we use the technically necessary session cookie “ECAS_CONTACT”. It associates your requests with a session and enables the security question, protection against forged requests (CSRF), and prevention of abusive submissions.

The cookie stores a session identifier, is configured as HttpOnly and SameSite=Strict and is transmitted securely over HTTPS (Secure). It is a session cookie without a fixed expiry date and normally expires at the end of the browser session. Associated session data are stored on the server.

The cookie is necessary to provide the contact form expressly requested by the visitor and does not require separate consent under Section 25(2)(2) TDDDG. Associated personal data are processed under Article 6(1)(f) GDPR.

The website code does not implement advertising or analytics cookies, marketing trackers, or Local Storage or Session Storage for visitor profiling.

5. Contact form and email enquiries

When you use the contact form, we process the details you provide to receive, handle and reply to your enquiry. Required fields are name, email address and message. Optional fields are company, phone number and topic. Answering the security question is required to submit the form.

Your details are validated on the server and transmitted to our STRATO-hosted business mailbox over an encrypted SMTP connection, where the message is stored as an email. The form code does not maintain a separate database of message contents.

The legal basis is Article 6(1)(b) GDPR where your enquiry concerns steps prior to entering into or performing a contract with you, and otherwise Article 6(1)(f) GDPR (our legitimate interest in communicating with and responding to business contacts). Where statutory retention duties apply, Article 6(1)(c) GDPR provides the basis for continued storage.

The required fields are necessary to process an enquiry using this form. Without them, the form cannot submit your enquiry; you may instead contact us by email.

6. Security question and abuse prevention

To prevent automated submissions and misuse, the form uses a locally generated arithmetic challenge, a hidden honeypot field, a CSRF token and time-based limits on submissions. No external CAPTCHA provider is used.

The server processes temporary session information (including verification tokens, the question and answer, timestamps and the time of a successful submission). To limit repeated submissions, a pseudonymous identifier is derived from the IP address using a secret key. Server-side counters record the times of submission attempts and successful submissions. These counter files do not store IP addresses in plain text; the identifiers should not be considered anonymous.

The purpose is to protect the website and communication channels against abuse. The legal basis is Article 6(1)(f) GDPR.

7. Retention periods

According to STRATO, visitor IP addresses retained for attack prevention are deleted within seven days. Anonymised customer logs remain available for six weeks.

The “ECAS_CONTACT” cookie is intended for the current browser session. Server-side session files are managed by PHP, with a configured session lifetime of 3,600 seconds; actual physical deletion of files may take place later.

Abuse prevention timestamps are evaluated within a 15-minute window. The underlying counter files may remain on the server after that window until removed during server administration.

Email enquiries and related correspondence are retained as long as necessary to respond and maintain business records; statutory retention requirements may require longer storage.

8. Recipients of personal data

STRATO processes technical access data as our hosting provider. Contact enquiries are transmitted through STRATO's SMTP service to our business mailbox and handled there. Where STRATO acts as a processor, this is governed by our Article 28 GDPR agreement. STRATO may engage subprocessors.

We do not sell visitor data or disclose contact enquiries to third parties for advertising. Disclosures required by law remain unaffected.

9. Third-country transfers and external services

Under the deployed application configuration, our website does not embed external marketing, analytics or social-media tracking services. Images, scripts and design resources are delivered from the website itself; fonts are system fonts or locally hosted files.

Hosting and contact-form email delivery are provided by STRATO. Any processing by subprocessors and any transfers outside the European Economic Area are subject to the hosting provider's disclosures and contractual safeguards under Articles 44 et seq. GDPR.

10. Your data protection rights

Subject to the relevant legal conditions, you have rights of access (Article 15 GDPR), rectification (Article 16), erasure (Article 17), restriction of processing (Article 18), data portability (Article 20) and objection (Article 21 GDPR).

Where processing is based on legitimate interests, you may object on grounds relating to your particular situation under the legal conditions. If processing is based on consent, you may withdraw it at any time for the future (Article 7(3) GDPR).

To exercise your rights, please contact the email address above. You may lodge a complaint with a data protection supervisory authority (Article 77 GDPR), in particular the Saxon Data Protection and Transparency Commissioner, Maternistraße 17, 01067 Dresden, Germany, where this authority has jurisdiction.

11. Security, automated decision-making and updates

When accessed via HTTPS, the website uses an encrypted connection. The contact form only accepts HTTPS requests and implements CSRF protection, a local security question and measures against automated submissions to protect confidentiality and integrity.

The website does not use solely automated decision-making producing legal or similarly significant effects within the meaning of Article 22 GDPR.

We update this privacy policy when the services used or the processing of personal data change.