Privacy policy

Controller

The controller responsible for processing your data within the meaning of the General Data Protection Regulation (GDPR) is:

Webcodic
Owner: Kevin Blecha
Sauerweg 7
70563 Stuttgart
Email: hello@webcodic.de
Phone: +49 151 401 803 27

Visiting the booking page

These pages are delivered via the platform of Cloudflare (Cloudflare, Inc., USA). With every request, Cloudflare processes technically necessary access data: your IP address, date and time, the requested address, technical information from your browser (e.g. user agent) and information derived from it such as the approximate country. The purpose is to deliver the pages, operate them securely and fend off attacks and abuse.

The legal basis is Art. 6(1)(f) GDPR. Our legitimate interest is the secure and functional provision of the pages.

The booking itself is processed by our management system (Business OS), which is also operated on Cloudflare (os.webcodic.de). The same access data is processed there.

We have concluded a data processing agreement with Cloudflare pursuant to Art. 28 GDPR.

For transfers to third countries, see Third countries.

Abuse protection (Cloudflare Turnstile)

Before you book, we use Cloudflare Turnstile to check whether the request comes from a human. For this, your browser loads a script from challenges.cloudflare.com in the last step. Turnstile evaluates your IP address and technical characteristics of your browser and device and stores an entry (“cf.turnstile.u”) in your browser's storage for challenges.cloudflare.com; Turnstile does not set cookies. Our management system verifies the result (a single-use token) with Cloudflare together with your IP address when you book.

The check is embedded so that it only becomes visible when Cloudflare needs a confirmation from you.

The legal basis is Art. 6(1)(f) GDPR; our legitimate interest is protecting the booking against automated requests and abuse.

The entry in your browser's storage is strictly necessary for the booking you requested; no consent is required for it (section 25(2) no. 2 TDDDG).

In addition, we limit the number of bookings and personal link requests per IP address and hour. For this, our management system stores a checksum (SHA-256) of the IP address with a timestamp, not the address itself. The checksum is pseudonymous, not anonymous. A field that only automated programs fill in also helps to detect spam.

Your details when booking

When you book an intro call, we process the chosen appointment, your name and your email address (required), optionally your phone number and your company, and your optional answers to the project questions (e.g. project, existing website, desired features, budget range from/to in euros) and the language of the booking.

If you reach us via a link with a campaign tag (e.g. from a letter with a QR code or our Google Business Profile, recognisable by parameters such as utm_source in the address), the booking page sends these tags along with the booking. We store them with the prospect record to evaluate through which channels enquiries and orders reach us. Nothing is stored in your browser for this. The legal basis is Art. 6(1)(f) GDPR (legitimate interest in focusing our advertising on effective channels).

The purpose is to prepare and hold the call and, if you wish, to prepare a quote. The legal basis is Art. 6(1)(b) GDPR (pre-contractual measures at your request).

Management in our Business OS

We store and manage your booking in our internal management system (Business OS). The database is operated by Supabase (Supabase Pte. Ltd., Singapur) in Frankfurt am Main, Germany (region eu-central-1). There we create a record for your booking as a prospect (company or name, contact with email address and, if provided, phone number) and note the booking with your answers in the history. A push notification on our own devices (company or name and appointment) informs us of new bookings, reschedulings and cancellations.

Uploaded files

After booking, you can optionally upload up to three files (PDF or Word, at most 10 MB each) as a briefing. Your browser uploads the file with a time-limited upload link directly to non-public storage at Supabase (Supabase Pte. Ltd., Singapur) (Frankfurt am Main, Germany (region eu-central-1)); Supabase receives your IP address in the process. Our management system then checks size and type. If the call leads to an engagement and we create a client folder for you, we move the files to that folder in Google Drive and then delete them from the storage at Supabase.

The legal basis is Art. 6(1)(b) GDPR.

Google Calendar, Meet, Gmail and Drive

For appointments, video calls and emails, we use Google Workspace from Google (Google Cloud EMEA Limited, Dublin, Irland):

• Google Calendar: We calculate available times from the occupancy of our calendar (no data about you is transmitted for this). When you book, we create an event in our calendar titled “Erstgespräch – company or name”, with your email address as a guest and your personal link in the description. Google does not send you its own invitation.
• Google Meet: We create a Meet link for the appointment. When you join the video call, Google processes the data required for it (e.g. video, audio, name, IP address).
• Gmail: We send confirmations and reminders from our Google Workspace mailbox (see Booking emails).
• Google Drive: only in the case of an engagement, for your uploaded files (see Uploaded files).

The legal basis is Art. 6(1)(b) GDPR.

We have concluded a data processing agreement with Google pursuant to Art. 28 GDPR.

Booking emails

We send you an email confirmation with a calendar entry, reminders 24 hours and one hour before the appointment (the 24-hour reminder only if you booked more than about a day in advance) and messages if the appointment is rescheduled or cancelled. The legal basis is Art. 6(1)(b) GDPR.

Your personal link

With your personal link you can view, reschedule or cancel the appointment and upload files. We only store a checksum of the link, not the link itself. The link is valid until 90 days after the appointment; after that we invalidate it. The expiry of the link does not delete your data; see Storage period.

Recipients and service providers

• Cloudflare (Cloudflare, Inc., USA) (processor): delivery of the booking page, operation of the management system, Turnstile.
• Supabase (Supabase Pte. Ltd., Singapur) (processor): database and file storage of the management system in Frankfurt am Main, Germany (region eu-central-1).
• Google (Google Cloud EMEA Limited, Dublin, Irland) (processor): Calendar, Meet, Gmail and Drive.
• Push services of device manufacturers (Apple, Google, Mozilla or Microsoft, depending on our device): delivery of notifications to our own devices; the content is end-to-end encrypted (Web Push).

We have concluded a data processing agreement with Supabase pursuant to Art. 28 GDPR.

Third countries

Cloudflare, Supabase and Google are companies headquartered in, or with parent companies in, the USA. It is therefore possible that data is processed in the USA or other countries outside the EU, or accessed from there. Database and file storage are located in Frankfurt am Main, Germany (region eu-central-1); this does not rule out access by the provider from third countries.

Cloudflare is certified under the EU-US Data Privacy Framework; transfers to the USA are based on the European Commission's adequacy decision (Art. 45 GDPR). Standard contractual clauses of the European Commission have been agreed with Cloudflare (Art. 46(2)(c) GDPR).

Standard contractual clauses of the European Commission have been agreed with Supabase (Art. 46(2)(c) GDPR).

Google is certified under the EU-US Data Privacy Framework; transfers to the USA are based on the European Commission's adequacy decision (Art. 45 GDPR). Standard contractual clauses of the European Commission have been agreed with Google (Art. 46(2)(c) GDPR).

Storage period

If no engagement results from the intro call, our management system automatically removes your contact details and answers from the booking six months after the appointment and deletes uploaded files from storage. This applies to cancelled, declined and completed appointments.

Other places where details of your booking are kept are not covered automatically. The following applies to them:

• We delete the record of your enquiry as a prospect (contact details and history) six months after the last appointment if no engagement results.
• Our management system deletes the entry in our Google Calendar together with the booking data six months after the appointment if no engagement results.
• We delete emails about your enquiry six months after the last contact if no engagement results.
• Our management system deletes the checksums used to limit requests after two days.
• According to Supabase, it makes daily backups of the database. Deleted data may remain in these backups until they are overwritten; on our plan we have no access to these backups.

If the call leads to an engagement, we keep the data as part of the client relationship. Statutory retention periods of up to ten years apply to quotes, contracts and invoices (including section 147 AO, section 257 HGB). No later than three years after the last contact or after the end of the project and maintenance, we anonymise your data; exceptions are records such as approvals and scope confirmations, and documents subject to the statutory periods mentioned.

Your rights

Under the GDPR, subject to the conditions set out there, you have the following rights:

• access to the data stored about you (Art. 15 GDPR),
• rectification of inaccurate data (Art. 16 GDPR),
• erasure (Art. 17 GDPR), unless a legal retention obligation applies,
• restriction of processing (Art. 18 GDPR),
• data portability (Art. 20 GDPR) for data you have provided to us and that we process by automated means on the basis of a contract or consent.

Right to object (Art. 21 GDPR)

Where we process data on the basis of legitimate interests (Art. 6(1)(f) GDPR), you may object to this processing at any time on grounds relating to your particular situation. We will then no longer process the data unless we can demonstrate compelling legitimate grounds that override your interests, or the processing serves the establishment, exercise or defence of legal claims.

You may withdraw consent at any time with effect for the future (Art. 7(3) GDPR). We do not currently ask for consent on these pages.

To exercise your rights, simply send an email to hello@webcodic.de.

Complaint

You have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR), in particular in the member state of your habitual residence, place of work or the place of the alleged infringement. The authority responsible for us is the State Commissioner for Data Protection and Freedom of Information of Baden-Württemberg (Germany).

Obligation to provide data

You are not legally or contractually obliged to provide us with data. Without name and email address, however, we cannot arrange the call or reach you; without the Turnstile check, booking is not possible. Phone number, company, project questions and files are optional; without them, we prepare the call in less detail.

Automated decisions

Available times, confirmations and reminders are derived automatically from our calendar. The only other automated step is abuse protection (Turnstile, limiting requests); if a booking fails because of it, you can still reach us by email or phone. Whether and on what terms we make a quote is decided by us personally. In our assessment, this does not involve a decision within the meaning of Art. 22 GDPR.

Cookies and browser storage

According to our code, the booking page itself does not set cookies and does not store anything in your browser's local or session storage. We serve fonts and explainer videos ourselves. The page only loads content from third-party servers for Turnstile (see Abuse protection).

According to our configuration, Cloudflare does not set cookies either.