Privacy policy

The controller for the processing described here, within the meaning of Art. 4(7) GDPR, is:

Otho Gabisonia, Brohrainstraße 5, 76131 Karlsruhe

Email: hello@ggs-network.com

No data protection officer has been appointed. The conditions of § 38(1) BDSG are not met: fewer than twenty people are permanently engaged in the automated processing of personal data, no processing subject to a data protection impact assessment takes place, and there is no commercial processing for the purpose of transfer or of market and opinion research.

For any question about data protection you can reach us directly using the contact details above.

This notice covers the publicly accessible pages under this domain, the signed-in area and our mobile app. It does not cover linked third-party services, which have their own privacy notices.

This website is a self-presentation: it presents the studio and its way of working and announces projects in development. No services are offered through it, no contracts are concluded and no payments are processed. Accordingly, neither order data nor payment data are processed.

It also does not cover systems we operate on behalf of our clients. There we act as a processor, not as a controller, and the notice of the respective client applies.

This website, its interface and the background service run on servers of Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Deutschland. The data centres are in Nuremberg and Falkenstein, Germany.

The provider processes the data solely on our behalf and on our instructions. A data processing agreement under Art. 28 GDPR is in place. The legal basis for using them is Art. 6(1)(f) GDPR — our legitimate interest in providing this service securely and at a workable cost.

For hosting, databases and mail delivery the data never leave Germany. No transfer to a third country is involved here.

Every request generates technically necessary access data. This happens not only at the hosting provider named above but in our own application: the interface logs every single request.

The legal basis is Art. 6(1)(f) GDPR. Our legitimate interest is to deliver the service reliably, to investigate faults and to detect and repel attacks. Without this processing, operating a service on the internet is technically impossible.

These logs are not combined with other data and are not used to build usage profiles. They are deleted as soon as they are no longer needed for the purposes above, at the latest after 30 days. Only individual entries relating to a specific security incident are kept longer, and only until that incident has been resolved.

What is recorded:

• IP address of the requesting device
• date and time of the request
• requested address and method used
• amount of data transferred and status message
• browser type, browser version and operating system
• referring address, where the browser sends one

We set strictly necessary cookies without consent (§ 25(2) no. 2 TDDDG). They are first-party only and are either required for operation or store a setting you made yourself. No advertising service is embedded, and no profiles are built.

Audience measurement runs only with your consent, which you give or refuse in the cookie notice; see “Audience measurement with Cloudflare Web Analytics”.

There is exactly one exception, and it sits behind the sign-in: the page “Account → Cards” loads Stripe.js from js.stripe.com. Card industry rules do not allow the number and security code of a company card to touch our servers, so Stripe displays them inside its own frame, served by Stripe. The provider is Stripe Payments Europe Ltd., Dublin. The policy allows Stripe throughout the signed-in area; Stripe.js is loaded on that one page only. On every publicly reachable page the restriction described above remains fully in force.

Which cookies are set in detail, and for how long, is listed in our cookie policy. The legal basis for the associated processing of personal data is Art. 6(1)(f) GDPR, and Art. 6(1)(b) GDPR for the cookies of the sign-in process.

With your consent we use Cloudflare Web Analytics to measure which pages of this website are opened and how fast they load. For this, your browser loads a script from Cloudflare that reads details from the browser and sends them to Cloudflare: the address opened, the referring page, browser, operating system and device type, and load and rendering times. Your IP address is transmitted to Cloudflare in the process. The script sets no cookies, no profiles are built, and we only see aggregated figures.

The legal basis is your consent (Art. 6(1)(a) GDPR, § 25(1) TDDDG). Without consent the script is not loaded. You can withdraw your consent at any time through “Cookie settings” at the bottom of every page; the page then reloads without the script. Consent lasts six months, after which we ask again.

We store your decision in your browser, in the cookie and the local storage entry c15t, together with a random identifier. As proof of your consent (Art. 7(1) GDPR) we also keep every decision on our servers: the identifier, your choice, the time, the version of this notice and whether you decided in the notice or in the settings, without your IP address. If you are signed in at the time, the entry belongs to your account, and your decision then also applies on your other devices. We delete the entries three years after the decision.

The legal basis for the proof is Art. 6(1)(c) GDPR in conjunction with Art. 7(1) GDPR, and for linking it to your account our legitimate interest in not asking you again on every device (Art. 6(1)(f) GDPR).

The recipient is Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107, USA. The transfer to the USA relies on the European Commission's adequacy decision for the EU-U.S. Data Privacy Framework (Art. 45 GDPR).

Besides cookies we keep three entries in your browser's local storage: your appearance preference (light, dark or system), a marker that the introductory tour of the signed-in area has already been shown, and your decision on audience measurement (c15t, like the cookie of the same name).

The first two never leave your device. We also keep the decision on audience measurement on our servers as proof, as described above. All three can be removed at any time through your browser settings.

The fonts Inter, JetBrains Mono and Playfair Display are downloaded when the site is built and served from our own server. Visiting this website therefore creates no connection to Google servers and transmits no IP address to them. The content security policy would block such a request at runtime in any case.

No videos, maps, social networks or other third-party content are embedded.

One exception concerns images in blog posts: an editorially embedded image may point at an external address. If such a page loads an image from a third-party server, that server learns your IP address and your browser identification. We therefore embed images from our own object storage as a rule.

We keep a user account for the signed-in area.

The legal basis for creating and maintaining the account is Art. 6(1)(b) GDPR: the account is how the usage relationship created by granting access is performed. We additionally rely on Art. 6(1)(f) GDPR, our interest in secured access. The IP address and browser identification stored per session serve security only: they make it visible to you and to us which devices a given account is signed in from, and they allow a foreign session to be ended deliberately.

Several sign-in methods are available: password, sign-in link by email, one-time code by email, passkey following the WebAuthn standard, sign-in through the identity providers we operate, and a second factor via an authenticator app or recovery codes. When you sign in through an identity provider, we receive the details needed to run the account and store the associated access and refresh credentials in order to keep the connection alive.

There is no open registration. Accounts are created either through the identity providers we operate or by redeeming a personal invitation.

The data processed are:

• name and email address, plus whether the address has been confirmed
• the address of a profile picture, where the identity provider supplies one
• the password only as a cryptographic hash, never in clear text
• for sign-in through an identity provider: the provider id and the access, refresh and identity credentials
• for two-factor authentication: the authenticator app secret and the recovery codes
• for passkeys: the public key, the credential id and the model identifier of the security key
• per session: time, expiry, IP address and browser identification
• the time of last activity, role and group membership, and any suspension marker with its reason

When you set or change a password, we check whether it has appeared in known data breaches by querying the Have I Been Pwned service.

The query uses k-anonymity: our server hashes the password and transmits only the first five characters of that hash. Neither the password nor your email address nor your IP address is transmitted, and the request originates from our server rather than from your device. The legal basis is Art. 6(1)(f) GDPR, our interest in account security.

Access to the signed-in area is granted through personal invitations. We store the invited email address, the invitation code, the intended roles, the expiry date and who issued the invitation. When an invitation is redeemed, we additionally record which account redeemed it and when.

The legal basis is Art. 6(1)(b) GDPR for preparing access and Art. 6(1)(f) GDPR for the record of who granted access to whom. A withdrawn invitation is marked invalid rather than deleted so that this record is preserved.

Security-relevant events in the signed-in area are logged separately. Each entry records the time, the type of event, its outcome, the id and email address of the person acting, and their IP address and browser identification.

Logged events include sign-ins and sign-outs, changes to accounts and permissions, the issuing and withdrawal of invitations, and, which is the part that concerns people without an account, failed sign-in and password attempts. For a failed attempt the email address given in that attempt is stored, even where no account exists for it. The legal basis is Art. 6(1)(f) GDPR; our legitimate interest lies in detecting account takeover attempts and in keeping administrative actions traceable.

These entries are deleted automatically after twelve months. If an account is deleted, entries already written to this log are retained: they document what happened, and deleting them would defeat the purpose of the log. The basis for this is Art. 17(3)(e) GDPR. Only people with an explicitly granted read permission can access the log.

We send emails to confirm an address, to reset a password, for sign-in links and one-time codes, and for invitations. The recipient address and the content of the message are transmitted.

Messages are generated through a queue inside our own system and then delivered over the mail server of Hetzner Online GmbH, where the recipient address and the content of the message are processed. The data processing agreement under Art. 28 GDPR covers that part as well. The legal basis is Art. 6(1)(b) GDPR where the message serves the performance of the user relationship, and otherwise Art. 6(1)(f) GDPR.

Email is an unencrypted medium unless sender and recipient take additional measures. Transport encryption is negotiated between the servers involved wherever possible; beyond that we cannot secure the delivery path.

To protect individual endpoints against automated bulk requests we use Cloudflare Turnstile. The provider is Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107, USA, represented in the European Union by Cloudflare Germany GmbH.

The check runs on our server: our application transmits the submitted verification token together with the IP address of the request to Cloudflare and receives the result. For this check no Cloudflare script is loaded on the public pages of this website, and no Cloudflare cookie is set in your browser.

The legal basis is Art. 6(1)(f) GDPR, our interest in repelling automated attacks. A data processing agreement under Art. 28 GDPR is in place with the provider.

For operating, monitoring and reviewing the sign-in system we use the hosted administration layer of the vendor of our authentication software. Account and session events as well as activity timestamps are transmitted to their systems.

The legal basis is Art. 6(1)(f) GDPR, our interest in operating sign-in securely and observably. A data processing agreement under Art. 28 GDPR is in place with the vendor.

Images and files for the blog and the signed-in area are held in object storage we operate ourselves and are delivered through our own interface. No third-party delivery network sits in between.

On upload we store the file together with the time and the uploading account. The legal basis is Art. 6(1)(f) GDPR.

For published posts the name of the author is shown publicly as a byline and additionally emitted in the structured data of the page so that search engines can read it. The legal basis is Art. 6(1)(f) GDPR, the interest in traceable authorship.

There is no comment function.

Our mobile app processes the same account data as the signed-in area in the browser. The session is kept in the secure storage of the operating system. If you enable access by face or fingerprint recognition, the check happens exclusively on the device; biometric data never reach us.

If you enable notifications, a device identifier for the notification service is stored with us together with the platform and app version. That identifier is obtained through Expo's services. No notifications are currently being sent; the identifier is merely held. You can have it removed by disabling notifications or unregistering the device. The legal basis is Art. 6(1)(a) GDPR; consent can be withdrawn at any time with effect for the future.

From within the signed-in area we administer databases and servers of our own. Results of such access may contain personal data and are cached for a limited time: result data are removed after 24 hours, the associated job record after 30 days. The legal basis is Art. 6(1)(f) GDPR, our interest in operations that can be accounted for.

Where a system is administered on behalf of a third party, we act as a processor under Art. 28 GDPR to that extent and not as a controller; the basis is then the respective data processing agreement. Data subjects should address their rights to the controller named there, and we forward any such request without delay.

On the website of the partner studio Nouvex you can sign in with your account here. Nouvex sends you to our sign-in page for that, and only after you have signed in do we pass to Nouvex your account identifier, your name, your email address and whether it is confirmed, and the address of your profile picture if there is one. Your password, passkeys and second factor never leave our system in the process.

The legal basis is Art. 6(1)(b) GDPR: data are passed on only when you start the sign-in at Nouvex yourself. For the handover we store, per sign-in, an access key that expires after one hour and a renewal key that expires after seven days. Both are deleted together with your account.

We pass on personal data only where this is necessary for the purposes described or where we are legally obliged to do so. Data are never sold and are never passed on for advertising purposes. The recipients are:

• Hetzner Online GmbH for server operation and mail delivery
• Cloudflare, Inc. for repelling automated requests
• the vendor of our authentication software for the hosted administration layer
• Have I Been Pwned for checking passwords against known breaches
• public authorities and courts, where we are legally obliged to disclose

Data processing agreements under Art. 28 GDPR are in place with all the processors named above. By far the largest part of the processing — hosting, databases and mail delivery — takes place exclusively in Germany.

A third country is involved only for Cloudflare, for the vendor of the hosted administration layer and for the query against Have I Been Pwned. Where data are transferred to the United States, the transfer relies on the European Commission's adequacy decision on the EU-US Data Privacy Framework of 10 July 2023, supplemented by standard contractual clauses under Art. 46(2)(c) GDPR.

We keep personal data only for as long as they are needed for the respective purpose or as long as statutory retention obligations require.

Once the respective period has elapsed, the data are deleted or anonymised so that no reference to a person can be re-established.

In detail:

• operational logs: at most 30 days
• security log: twelve months
• browser sessions: seven days, in the mobile app up to 30 days
• account data: until the account is deleted
• invitations and their redemption: until expiry, then up to three years as a record
• results of access to third-party systems: 24 hours, job records 30 days

An informal message to the address or email address given above is enough to exercise your rights. We respond without undue delay and at the latest within one month. To protect your rights we may need to establish your identity before giving information.

You have the following rights in relation to us:

• access to the data we process about you, Art. 15 GDPR
• rectification of inaccurate data and completion of incomplete data, Art. 16 GDPR
• erasure, Art. 17 GDPR
• restriction of processing, Art. 18 GDPR
• data portability in a commonly used format, Art. 20 GDPR
• objection to processing based on legitimate interests, Art. 21 GDPR
• withdrawal of a consent given, with effect for the future, Art. 7(3) GDPR

Where we process data on the basis of Art. 6(1)(f) GDPR, you have the right to object at any time, on grounds relating to your particular situation, to that processing.

If you object, we will no longer process the data concerned unless we can demonstrate compelling legitimate grounds that override your interests, rights and freedoms, or the processing serves to establish, exercise or defend legal claims.

Without prejudice to any other remedy, Art. 77 GDPR gives you the right to lodge a complaint with a data protection supervisory authority, in particular in the Member State of your residence, place of work or the place of the alleged infringement.

The authority responsible for us is: Der Landesbeauftragte für den Datenschutz und die Informationsfreiheit Baden-Württemberg, Postfach 10 29 32, 70025 Stuttgart. Visiting address: Heilbronner Straße 35, 70191 Stuttgart. Phone: 0711 615541-0, email: poststelle@lfdi.bwl.de, web: https://www.baden-wuerttemberg.datenschutz.de

Access data arise as a technical necessity; without them the page cannot be retrieved. The account details are required in order to provide the signed-in area — without them no access can be set up.

Everything beyond that is voluntary. Not providing it has no disadvantage for you other than that the respective function cannot be used.

There is no automated decision-making, including profiling, within the meaning of Art. 22 GDPR. No assessment of personal aspects takes place and no usage profiles are built.

This website is delivered exclusively over an encrypted connection, recognisable from the address prefix and the padlock symbol in your browser. Content you send to us cannot be read by third parties in transit.

We update this notice whenever the processing described here changes or the legal situation requires it. The version available here at the time applies; the date of the last change is shown at the top of this page.