The German version is authoritative.
1. Controller
The controller responsible for data processing on this website is Attestria GbR, Bildungscampus 11, 74076 Heilbronn, Germany. Contact: hello@attestria.com.
We are not legally required to appoint a data protection officer (§ 38 BDSG). Please direct all data protection matters to the address above.
2. Website delivery and server log files
This website is served through Cloudflare from a data centre in Frankfurt am Main. In doing so, technically necessary data (in particular IP address, date and time of access, page requested, volume of data transferred, browser and operating system information) is processed in order to deliver the website and to protect it against attacks and automated access.
The legal basis is our legitimate interest in the secure and stable operation of the website, Art. 6(1)(f) GDPR. This data is processed solely by our infrastructure provider, held there only briefly for security and stability purposes and then deleted automatically. We do not store this data ourselves beyond that, and it is not combined with other data sources.
Fonts are served locally from our own server. No fonts, scripts or other content are loaded from third-party CDNs.
3. Contact and pilot form
If you contact us through the form, we process the data you provide (name, email address, company, and optionally role and message) solely in order to handle your enquiry and to communicate with you about it.
The legal basis is Art. 6(1)(b) GDPR where the processing serves to take steps at your request prior to entering into a contract, and otherwise our legitimate interest in responding to business enquiries, Art. 6(1)(f) GDPR. Consent is not required for this; the checkbox in the form merely confirms that you have taken note of this privacy policy.
Providing the data is voluntary and is neither legally nor contractually required. However, without your name, email address and company we cannot process your enquiry.
Technically, the form is processed by this website’s Cloudflare Worker; the request is then sent via Google Workspace from the authorised account emre@attestria.com to the internal Google Group hello@attestria.com.
4. Recipients and processors
We use the following service providers as processors for the operation of this website and the handling of enquiries, with a data processing agreement pursuant to Art. 28 GDPR in place with each of them:
Cloudflare (website delivery, protection against abuse, form processing) and Google (Google Workspace, email delivery of the enquiry to our mailbox). Your data is not passed on to any other third parties unless we are legally obliged to do so.
5. Processing in third countries
The service providers named above are companies whose registered office or parent company is in the United States (Cloudflare, Inc. and Google LLC). Even though processing takes place primarily in data centres within the EU, access from a third country cannot be entirely ruled out.
Any such transfer is based on the European Commission’s adequacy decision on the EU-US Data Privacy Framework, provided the respective provider is certified under it. Where that is not the case, we base the transfer on the European Commission’s standard contractual clauses pursuant to Art. 46(2)(c) GDPR. You may request a copy of the standard contractual clauses at hello@attestria.com.
6. Cookies and tracking
This website sets no tracking, analytics or marketing cookies, embeds no advertising networks and uses no analytics services. No profiling takes place.
Cloudflare may set a technically necessary security cookie in order to distinguish automated access from human visits. This storage is exempt from consent under § 25(2)(2) TDDDG because it is strictly necessary to provide the service you requested. A cookie banner is therefore not required.
7. Retention
We store personal data only for as long as is necessary for the respective purpose. We delete pilot and contact enquiries once the enquiry has been fully handled and no statutory retention duties (in particular commercial and tax law periods) prevent deletion. Server log files are deleted as described in section 2.
8. No automated decision-making
No automated decision-making, including profiling, within the meaning of Art. 22 GDPR takes place on this website. This concerns this website only; how our product works is independent of it and is governed separately with customers.
9. Your rights
You have the right to obtain information about the data stored about you (Art. 15 GDPR), to rectification (Art. 16 GDPR), to erasure (Art. 17 GDPR), to restriction of processing (Art. 18 GDPR) and to data portability (Art. 20 GDPR).
Where processing is exceptionally based on consent, you may withdraw that consent at any time with effect for the future (Art. 7(3) GDPR). The lawfulness of processing carried out before the withdrawal remains unaffected.
An informal message to hello@attestria.com is sufficient to exercise your rights.
10. Right to object
You have the right to object at any time, on grounds relating to your particular situation, to processing of personal data concerning you which is based on Art. 6(1)(f) GDPR (Art. 21 GDPR). We will then no longer process that data unless we can demonstrate compelling legitimate grounds which override your interests, rights and freedoms, or the processing serves to establish, exercise or defend legal claims.
11. Right to lodge a complaint with a supervisory authority
Without prejudice to any other remedy, you have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR). The authority competent for us is the State Commissioner for Data Protection and Freedom of Information of Baden-Württemberg, Lautenschlagerstraße 20, 70173 Stuttgart, Germany. You may also contact the supervisory authority where you reside.