Privacy Policy

1 · Controller

The controller within the meaning of the General Data Protection Regulation (GDPR) is:

Jonas Westphal
Sole proprietorship
Address and further contact details: see Imprint
Email: datenschutz@westphal.tech

2 · Website delivery, hosting and server logs

This website is delivered through Cloudflare Pages and Cloudflare's global content delivery network. Cloudflare, Inc., 101 Townsend Street, San Francisco, CA 94107, USA, is used as a processor for this purpose.

On every request, Cloudflare processes technically necessary connection and log data. This may include the IP address, date and time, requested URL or file, referrer, browser and device information, HTTP status and information used to detect and prevent abusive access.

Processing serves secure and fast delivery, error analysis and protection of the website. The legal basis is Article 6(1)(f) GDPR. My legitimate interest is the reliable and secure operation of this website.

Cloudflare operates a global network, so processing of personal data outside the EU or EEA cannot be fully excluded. For transfers of personal data to the USA, Cloudflare relies in particular on its certification under the EU-US Data Privacy Framework. In addition, Cloudflare's Data Processing Addendum contains the European Commission's Standard Contractual Clauses.

Log data is processed only for as long as required for these purposes, contractual obligations or the prevention and investigation of security incidents.

3 · Fonts and externally loaded scripts

This website serves all fonts itself. No fonts are loaded from external third parties.

The only externally loaded resources are the analytics services described in the following sections and, when the contact form is opened, Cloudflare Turnstile.

4 · Cloudflare Web Analytics

Cloudflare Web Analytics is enabled on the production website.

A JavaScript beacon from Cloudflare is loaded to record aggregated page-view and performance data. Cloudflare states that it does not use cookies or localStorage for this purpose and does not identify or track visitors across websites using their IP address, user agent or similar characteristics.

To the extent that personal connection data is processed when the beacon is requested, the legal basis is Article 6(1)(f) GDPR.

My legitimate interest is data-minimised measurement of the reach, stability and technical performance of this website.

Cloudflare is the recipient. For possible third-country transfers, section 2 applies.

5 · Umami Analytics

In addition, a self-hosted Umami instance at analytics.arkato.xyz is used for reach and usage analytics.

I operate the domain arkato.xyz and the Umami instance myself. The technical infrastructure is located on a server of netcup GmbH in Germany. Analytics data is therefore not passed on to an external Umami operator.

On each page view, the website ID, hostname, browser language, page title, screen size, referrer and the visited URL are processed in particular. Of the URL, only campaign parameters (utm_source, utm_medium, utm_campaign,utm_content and utm_term) are transmitted; all other query parameters are removed in the browser before transmission. Fragments (the part after #) are not transmitted. The IP address is necessarily transmitted to the server first.

Umami may derive the browser, operating system, device type and approximate country from this. For session attribution, a non-readable value is created from technical characteristics such as IP address, user agent and website ID.

The Umami instance is self-hosted. The script does not set cookies and respects the browser's Do Not Track setting.

Only predefined events are additionally recorded, in particular:

• opening, submitting, successfully completing or technically failing the contact form,
• opening project examples,
• selected external links,
• reaching time and scroll milestones, and
• technical performance metrics such as LCP, INP, CLS, FCP and TTFB.

Additional properties are restricted to controlled categories such as entry point, enquiry topic, language, project slug or error stage.

Form input, email addresses, names, companies, message contents and security or authentication tokens are not intentionally sent to Umami.

Session replays and heatmaps are currently disabled. Session replays are not planned. Any further analytics features will only be enabled after a new privacy review.

Processing is based on Article 6(1)(f) GDPR. My legitimate interest is evaluating and improving the usage, content and technical quality of my own websites in a data-minimised way.

The technical processor for the server infrastructure is netcup GmbH.

Analytics data is stored for 12 months and then deleted or, where technically supported, aggregated so that it can no longer be attributed to individual sessions.

The Umami instance is operated exclusively for my own projects.

6 · Local browser settings

The website stores your chosen language under the key

• site-language

in your browser's localStorage.

For the duration of the browser session it also stores the paths visited in this tab and their current position under the keys

• nav-stack and
• nav-index

in your browser's sessionStorage.

The language value remains stored until you change the setting or delete your browser data. The session values end when the tab is closed. Light or dark mode follows your device's system setting; nothing is stored for this.

This storage is used solely to provide settings you explicitly chose or that are required for presentation.

It is permitted without consent under Section 25(2) no. 2 TDDDG.

These values are not used for analytics or advertising.

Under the configuration in use, the website itself does not set cookies. For technically necessary cookies of the client portal, see section 11.

7 · Contact form

When you use the contact form, I process in particular:

• your name,
• your email address,
• an optional company,
• the selected enquiry type,
• the message and
• the language of the page.

This does not subscribe you to a newsletter or automatically add you to a marketing list.

The details are sent directly to Business OS. I operate Business OS myself on a server of netcup GmbH in Germany.

The submitted form data and the complete submission are stored there as a record. The verification token generated by Cloudflare Turnstile is not stored permanently.

Your IP address is not stored permanently. To limit abusive requests, Business OS creates a truncated SHA-256 hash of the IP address for the current 10-minute window. These hashes are deleted every hour.

I receive a technical notification email about new enquiries via Brevo. This notification contains no names, email addresses, companies, message contents or other contents of the contact form. It only indicates that a new enquiry is available in Business OS and contains a link to the internal system.

The enquiry is processed to take pre-contractual measures on the basis of Article 6(1)(b) GDPR.

If an enquiry does not lead to a contract, the personal data stored for it is generally deleted 12 months after the last contact.

Longer storage only takes place where required by statutory obligations or where data is still needed in an individual case to establish, exercise or defend legal claims.

If an enquiry leads to an engagement, the rules for client and invoice data in section 12 apply in addition.

8 · Cloudflare Turnstile

The contact form is protected against automated spam and abuse by Cloudflare Turnstile.

When the form is opened, a script from Cloudflare is loaded. It generates a short-lived verification token, which Business OS then validates with Cloudflare.

For this security check, Cloudflare processes in particular your IP address and user agent, as well as other technically necessary information for abuse detection.

Processing is based on Article 6(1)(f) GDPR.

My legitimate interest is protecting the contact form and the infrastructure behind it against automated abuse, spam and attacks.

Cloudflare, Inc. is based in the USA. For transfers of personal data to the USA, Cloudflare relies in particular on the EU-US Data Privacy Framework. In addition, the European Commission's Standard Contractual Clauses are part of Cloudflare's Data Processing Addendum.

9 · Contact by email

If you contact me directly by email, the following data is processed in particular:

• sender and recipient addresses,
• date and time,
• subject,
• message and
• any attachments.

I use Proton Mail for email communication. The processor is Proton AG, Route de la Galaise 32, 1228 Plan-les-Ouates, Switzerland.

The European Commission has adopted an adequacy decision for Switzerland.

Proton states that Proton Mail data is stored encrypted on servers in Switzerland, Germany or Norway. For transfers outside this area, the data processing agreement provides additional appropriate safeguards.

Where your message relates to entering into or performing a contract, processing is based on Article 6(1)(b) GDPR.

For other business enquiries, it is based on Article 6(1)(f) GDPR. My legitimate interest is handling and answering business communication.

For enquiries that do not lead to a contract, the retention period is generally 12 months after the last contact, unless statutory retention obligations or legitimate reasons require longer storage.

10 · AI-assisted evaluation of enquiries

AI-assisted evaluation of personal contact enquiries is currently not active.

Business OS has the technical capability to summarise, classify or draft replies to incoming enquiries in future using an external AI interface.

This feature is currently not used. Personal content of contact enquiries or support tickets is therefore currently not transferred to OpenAI or any other external AI provider for this purpose.

Before any future activation, the data protection and contractual requirements, including data processing, data transfers, retention periods and, where applicable, data residency, will be reviewed again and this privacy policy updated accordingly.

No solely automated decision about clients or prospects takes place.

11 · Client portal

The client portal at app.westphal.tech/portal is only accessible to invited client contacts.

Sign-in works without a permanent password, using a one-time code or a time-limited sign-in link delivered by email.

Brevo is used to send these transactional emails.

The client portal stores in particular:

• the contact's name, email address and language,
• the time of the invitation and of the last sign-in,
• comments and text answers,
• uploaded files,
• material requests,
• support and project tickets including attachments, and
• approvals of project stages including name, email address, time and version label.

Approvals of project stages serve as a record of the approval or acceptance given.

Where such records are required to comply with legal obligations or to establish, exercise or defend legal claims, they may be retained beyond the regular deletion period. Article 17(3)(b) and (e) GDPR apply in this respect.

Other project-specific content of the client portal is generally deleted or anonymised 12 months after the respective project is completed, unless statutory retention obligations or overriding reasons require further storage.

Uploaded files are stored privately in the Cloudflare R2 object storage. Downloads only work through short-lived signed links.

Invoices and billing information may be embedded or displayed from Lexware Office.

The client portal only uses technically necessary cookies:

• sessionid to keep you signed in (HttpOnly, Secure, SameSite=Lax),
• csrftoken to protect against cross-site request forgery.

These cookies are required to provide the client portal you explicitly requested and are permitted without consent under Section 25(2) no. 2 TDDDG.

The client portal uses no web tracking and no analytics.

Processing is generally based on Article 6(1)(b) GDPR for the performance of the respective contract.

Delivery via Brevo

Brevo is used for transactional emails such as one-time codes and sign-in links.

Personal open and click tracking is anonymised in my Brevo account.

Transaction logs are retained for three months according to the configuration I have set.

12 · Client, contract and invoice data

Client master data such as company, address, VAT ID and contacts, as well as offers and invoices, are managed in Lexware Office in particular and synchronised with Business OS where required for the functions provided there.

For Lexware Office, Haufe Service Center GmbH, Munzinger Straße 9, 79111 Freiburg, Germany, is used as a processor.

Client and contract data is processed on the basis of Article 6(1)(b) GDPR.

Where I am legally required to retain business and tax records, further processing is based on Article 6(1)(c) GDPR.

The specific retention period depends on the type and content of each document. Under current commercial and tax law, the statutory retention periods are in particular:

• 10 years for certain books, records, annual financial statements and comparable accounting documents,
• 8 years for accounting vouchers and
• 6 years for certain commercial and business letters and other documents subject to retention.

The periods generally begin at the end of the calendar year in which the document was created or the relevant transaction was completed.

Where other statutory retention periods apply in individual cases or documents are needed longer due to ongoing tax or legal proceedings, the actual retention period may be extended accordingly.

13 · Hosting, storage and backups of Business OS

The technical infrastructure of Business OS is set up as follows:

• The application and database run on a server of netcup GmbH in Germany.
• Uploaded files and encrypted database backups are stored in the Cloudflare R2 object storage.
• The R2 buckets in use are configured with the EU jurisdiction. Objects stored there are therefore stored and processed within the European Union.
• Database backups are encrypted with age.
• Backups are deleted after 30 days.
• The source code is managed on GitHub. No client data is stored in the source repository.

For general account, security or connection data at Cloudflare, the international processing described in section 2 may still take place.

14 · Recipients and processors

The following service providers are used in particular for the processing described above:

The Umami instance at analytics.arkato.xyz is not an external recipient; I operate it myself. netcup only provides the technical server infrastructure.

OpenAI is currently not a recipient of personal data from Business OS, as AI evaluation is currently disabled.

15 · External links

This website links to external services, in particular GitHub and other websites.

Merely loading my website does not send any data to a provider through a normal external link.

Only when you open such a link does your browser connect to the respective provider. That provider receives the technically necessary connection data and processes it under its own data protection responsibility.

16 · Rights of data subjects

Where the statutory requirements are met, you have in particular the right to:

• access under Article 15 GDPR,
• rectification under Article 16 GDPR,
• erasure under Article 17 GDPR,
• restriction of processing under Article 18 GDPR and
• data portability under Article 20 GDPR.

Where processing is based on Article 6(1)(f) GDPR, you may object to it under Article 21 GDPR on grounds relating to your particular situation.

Please send requests regarding your data protection rights to:

datenschutz@westphal.tech

Where an access or data export is produced via Business OS, it may be provided as a JSON document. A download copy created for this purpose is deleted after 7 days.

You also have the right to lodge a complaint with a data protection supervisory authority.

The supervisory authority responsible for the controller is in particular:

Independent State Centre for Data Protection Schleswig-Holstein (ULD)
Holstenstraße 98
24103 Kiel
Germany
Email: mail@datenschutzzentrum.de

17 · Automated decisions

No solely automated decision-making, including profiling within the meaning of Article 22 GDPR, takes place.

Automated technical processes such as spam detection, rate limiting or the evaluation of technical performance data do not lead to decisions with legal or similarly significant effects on data subjects.

18 · Updates to this privacy policy

I update this privacy policy when the website, Business OS, service providers, technical processing or legal requirements change.

The current version is available at /en/privacy.