Privacy policy

Controller

The controller for data processing on this website, on the Instagram account @anoza_labs, when preparing proposals and when handling quotes, contracts and invoices is Kai Anacker, Anoza Labs, Reginastraße 1, 34119 Kassel, Germany, email info@anoza-labs.com. Further details are given in the legal notice. For the statistics on Instagram I am a joint controller together with Meta Platforms Ireland Limited, as described in the section “Account statistics on Instagram”.

Hosting and server log files

This website is hosted by Vercel Inc., 440 N Barranca Avenue #4133, Covina, CA 91723, USA, acting as a processor. The server region is Frankfurt am Main; static content is additionally served through a worldwide delivery network. When you access the site, technically necessary data is processed: IP address, date and time, page or file requested, browser type and operating system. The legal basis is Art. 6(1)(f) GDPR: the legitimate interest in secure and stable operation. As Vercel Inc. is based in the USA, a transfer to a third country takes place. It is permitted under Art. 45 GDPR because Vercel is certified under the EU-U.S. Data Privacy Framework, for whose participants the European Commission has found an adequate level of protection.

Fonts

All fonts are served locally from this site's own server. There is no connection to third-party font providers, and no IP address is transmitted to any such provider.

Contact form

If you write to me via the form, I process the data you provide solely to handle your enquiry. The legal basis is Art. 6(1)(b) GDPR for contract-related enquiries, otherwise Art. 6(1)(f) GDPR: the legitimate interest in answering enquiries addressed to me. To protect against automated submissions, the form receives a signed timestamp without any identifier when it loads and after a sending error; it is valid for at most 24 hours. It is transmitted to me with your enquiry, and I use it only to check that it is genuine and still valid and that a few seconds have passed between loading and sending. It is not stored permanently in your browser and disappears when you close the page. The legal basis is Art. 6(1)(f) GDPR: the legitimate interest in protecting the form against abusive automated use. The message is delivered through the domain's email mailbox, hosted by STRATO GmbH, Otto-Ostrowski-Strasse 7, 10249 Berlin, Germany, acting as a processor. This processing takes place in Germany; no transfer to a third country is involved. The data is deleted once your enquiry has been dealt with conclusively and no statutory retention periods apply. If your enquiry leads to a quote or an order, the sections “Quotes, contracts and invoices” and “Recipients and retention for orders” apply from then on.

Audience measurement

To understand which parts of this site are used, I use Vercel Web Analytics, a service of Vercel Inc., 440 N Barranca Avenue #4133, Covina, CA 91723, USA. It records the pages requested, the referring page, the country of origin, device type and browser. The service works without cookies and stores no identifier on your device. The measurement script reads what your browser provides, such as details of your browser and the referring page. It also queries an entry in your browser's local storage that this site never creates. No recognition takes place over time or across other websites. Measurement only runs if you have consented beforehand; nothing is loaded before that. The legal basis is Art. 6(1)(a) GDPR. You may withdraw your consent at any time with effect for the future, via “Privacy settings” in the footer. The lawfulness of processing carried out until withdrawal remains unaffected (Art. 7(3) GDPR). The same basis applies to the transfer to the USA as for hosting: Art. 45 GDPR on the grounds of certification under the EU-U.S. Data Privacy Framework.

Storage on your device

Only two items are stored permanently, locally in your browser: your consent decision and your light or dark appearance preference. The items themselves are not transmitted to me. The decision is stored so that you are not asked again on every visit. Both are required for the functionality you asked for and therefore need no consent. You can delete them at any time through your browser settings. The film in the “Services” section of the home page and its still image exist in a light and a dark version, each for wide and for narrow windows. Which version your browser requests depends on the site's appearance and the shape of your window. Like every request, it appears in the server log files (see the section “Hosting and server log files”). This shows whether you view the site in light or dark mode and whether your window is wide or narrow. The timestamp of the contact form is held only by the open page; it is described in the section “Contact form”.

No advertising, no profiling on this website

This website uses no advertising networks and no cookies. No profiling and no cross-site tracking takes place. Without your consent, no audience measurement data is collected. All of this applies only to this website. What happens on Instagram is described in the following sections.

Account and messages on Instagram

On Instagram, a service of Meta Platforms Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland, I run the account @anoza_labs. If you follow the account, like a post, view a story or mention me, I see this together with your profile name. I see comments and direct messages with their content. I use this information to present the account, to communicate with you and to handle enquiries. The legal basis is Art. 6(1)(f) GDPR: the legitimate interest in showing my services on Instagram and in answering comments and messages addressed to me. If your enquiry is contract-related, the legal basis is Art. 6(1)(b) GDPR. Comments and messages remain in my Instagram account until you or I delete them there. How long Meta stores them is determined by Meta. I delete copies outside Instagram, for example in my email inbox, once the enquiry has been dealt with conclusively and no statutory retention periods apply. If your enquiry leads to a quote or an order, the sections “Quotes, contracts and invoices” and “Recipients and retention for orders” apply from then on. You do not have to use Instagram to reach me: you can just as well write to me via the contact form or by email to info@anoza-labs.com. Whatever Meta does with your data beyond this is decided by Meta under its own responsibility. I have no influence on it. Details are given in Meta's privacy policy.

• Meta's privacy policy

Account statistics on Instagram

Meta provides me with statistics on the account, known as Insights. They show, for example, how many accounts a post has reached and how often the profile has been viewed. In the statistics I see only aggregated figures, not the data of individual people from which Meta compiles them. Which data Meta collects for this is determined by Meta alone. For the processing by which Meta compiles the statistics, Meta Platforms Ireland Limited and I are joint controllers (Art. 26 GDPR). My legal basis is Art. 6(1)(f) GDPR: the legitimate interest in recognising which posts resonate and in shaping the account accordingly. For Pages on Meta Products, Meta has set out the division of obligations in the “Page Insights Controller Addendum”. Under it, Meta informs you about the processing for Page Insights, fulfils your rights and ensures the security of the data. The addendum does not name Instagram expressly. You can exercise your rights against Meta and against me (Art. 26(3) GDPR). If a request concerning the statistics reaches me, I forward it to Meta, because only Meta has access to this data.

• Page Insights Controller Addendum (Meta)
• Meta's information about Insights data

Recipients and transfer to the USA for Instagram

The recipients of the data are Meta Platforms Ireland Limited and, as its processor, Meta Platforms, Inc., 1 Meta Way, Menlo Park, CA 94025, USA. This involves a transfer of data to the USA. It is permitted under Art. 45 GDPR because Meta Platforms, Inc. is certified under the EU-U.S. Data Privacy Framework, for whose participants the European Commission has found an adequate level of protection.

Preparing proposals

Before I make a business a proposal for a new website, I collect what its existing website delivers without logging in: page texts, page titles and page addresses. The data therefore comes from a publicly accessible source. It may contain names and other information about people, for example about owners or employees. Customer testimonials may contain such information as well. A program stores the page texts on my computer. In doing so it masks the email addresses, telephone numbers and bank account numbers it recognises. If a page's address identifies it as a page about people, such as /team or /reviews, the program only counts the page. It does not store its text. Names on other pages, for example under “About us”, remain in the stored text. I use the data to estimate the scope of a new website and to prepare the proposal. The legal basis is Art. 6(1)(f) GDPR: the legitimate interest in making a business a proposal that fits its existing website. What you tell me about the proposal in a conversation or give me as documents, I process for the same purpose. If you asked for the proposal and would yourself be my contracting party, the legal basis for this is Art. 6(1)(b) GDPR. Otherwise it is Art. 6(1)(f) GDPR. If no contract results, I delete the data three months after the meeting at which I present the proposal. If there is no meeting, the period starts with the collection. If you ask for time to consider, I extend the period to at most six months.

Recipients when preparing proposals

To analyse this data, I use Claude Code, an AI tool from Anthropic. What I process with it is received by Anthropic Ireland, Limited, 6th Floor, South Bank House, Barrow Street, Dublin 4, D04 TR29, Ireland. This includes a report from the program consisting of figures, fixed terms and the addresses of embedded services. Such an address may contain a name, for example if an account with a service is named like a person. Anthropic also processes the data in the USA. No adequacy decision of the European Commission applies to this, because Anthropic is not certified under the EU-U.S. Data Privacy Framework. For transfers to countries without an adequacy decision, Anthropic refers to standard contractual clauses (Art. 46 GDPR). I have not concluded a data processing agreement with Anthropic. Anthropic therefore processes the data under its own terms. This may include training its models. How long Anthropic stores the data is also governed by these terms. Details on Anthropic are given in its privacy policy and in its information for people who do not use Claude themselves. Emails you send me about the proposal reach me through the domain's email mailbox. It is hosted by my processor, STRATO GmbH, Otto-Ostrowski-Strasse 7, 10249 Berlin, Germany. No data is transferred to a third country in the process.

• Anthropic's privacy policy
• Anthropic's Non-User Privacy Policy

Quotes, contracts and invoices

If you ask me for a quote or give me an order, I process names, job titles and contact details. I also process the information in the quote, contract and invoice, as well as information about incoming payments. I use them to prepare the quote, to conclude the contract, to perform it and to invoice it. I receive the data from you or from the business for which you are my contact person. What I collect beforehand from your existing website is described in the section “Preparing proposals”, including its own deletion period. If you yourself are my contracting party, the legal basis is Art. 6(1)(b) GDPR. If you are a contact person at a business, it is Art. 6(1)(f) GDPR: the legitimate interest in handling the contract with that business. I keep invoices and business letters because tax law requires it (Art. 6(1)(c) GDPR in conjunction with § 147 AO, the German Fiscal Code). I keep further contract documents so that I can prove how the order was carried out and defend against claims (Art. 6(1)(f) GDPR). These are a data processing agreement and, for the takeover check, the assurance on copying the program and a copy of the report without your answers to the questionnaire. For the takeover check I process personal data on behalf of your business. I then keep the name and contact details of your business's contact person in the record under Art. 30(2) GDPR for as long as the order runs (Art. 6(1)(c) GDPR). If you have agreed that I may name your business as a reference, this website publicly shows its name and the type of work. I only add a link to your website if you have also agreed to that. The legal basis is your consent (Art. 6(1)(a) GDPR). You may withdraw it at any time with effect for the future (Art. 7(3) GDPR). Without a name, an address and a contact person I cannot conclude a contract. No automated decision-making takes place.

Recipients and retention for orders

The recipients are STRATO GmbH, Otto-Ostrowski-Strasse 7, 10249 Berlin, Germany, which runs my email mailbox as a processor, and the Finom group, where I hold my business account and write my invoices. Public authorities also receive the data where the law requires it. For the account and invoices, these are PNL Fintech B.V. and Finom Payments B.V., both Jachthavenweg 109H, 1081 KM Amsterdam, the Netherlands. According to Finom, it stores the data in the EU. For service providers outside the EU, Finom refers to an adequacy decision, standard contractual clauses or the EU-U.S. Data Privacy Framework. For website projects, project documents that may contain the name and contact details of your business's contact person are also kept in a code repository at GitHub, Inc., 88 Colin P. Kelly Jr. Street, San Francisco, CA 94107, USA. This transfer to the USA is permitted under Art. 45 GDPR because GitHub, Inc. is certified under the EU-U.S. Data Privacy Framework. A reference is also kept with the source code of this website at GitHub, Inc. The website is hosted by Vercel Inc. as a processor. What the section “Hosting and server log files” says applies to it, including the transfer to the USA. Beyond that, I do not transfer this data to a country outside the EU. If no contract results, I delete the data three months after the quote expires. Otherwise I keep invoices and accounting records for eight years and business letters for six years, each from the end of the calendar year in which they were created (§ 147(3) and (4) AO). I keep the further contract documents until the end of the third calendar year after the order is completed (§§ 195, 199 BGB, the German Civil Code). For the same period I keep the entry in the record under Art. 30(2) GDPR as evidence (Art. 6(1)(f) GDPR). Naming you as a reference ends when you withdraw your consent.

Your rights

You have the right to access, rectification, erasure, restriction of processing, data portability and objection. Please contact the address given in the legal notice. For the statistics on Instagram you can also contact Meta. You also have the right to lodge a complaint with a data protection supervisory authority.

Right to object

Where I process data on the basis of Art. 6(1)(f) GDPR, you may object to this processing at any time on grounds relating to your particular situation (Art. 21(1) GDPR). This concerns hosting and enquiries via the form or via Instagram that are not aimed at a contract. It also concerns the preparation of proposals you asked for, the data of contact persons for quotes and contracts, and keeping contract documents and entries in the record under Art. 30(2) GDPR. On the Instagram account, it concerns its presentation, communication and statistics. I will then no longer process the data unless I can demonstrate compelling legitimate grounds that override your interests, rights and freedoms, or unless the processing serves the establishment, exercise or defence of legal claims. Please send your objection to the address given in the legal notice. You can also object to the processing for the statistics on Instagram directly with Meta.

Objecting to direct marketing

If I prepare a proposal without you having asked for it, this is direct marketing. You may object to this processing at any time without giving reasons (Art. 21(2) GDPR). I will then no longer process your data for this purpose (Art. 21(3) GDPR) and will delete the documents relating to the proposal. Please send your objection to the address given in the legal notice.