Privacy Policy
Information on the processing of your personal data in accordance with GDPR
1. Privacy at a Glance
General Information
The following notes provide a simple overview of what happens to your personal data when you visit this website. Personal data is any data that can be used to personally identify you.
Who is responsible for data collection on this website?
Data Controller:
Dennis Keßler
Kesbyte Digital
Rotmilanstraße 9
27211 Bassum
Germany
Email:
2. Hosting and Server Logs
IONOS Hosting
This website is hosted by IONOS SE (Elgendorfer Str. 57, 56410 Montabaur, Germany) on servers in Germany. IONOS acts as a processor on our behalf.
When you visit the website, your IP address is necessarily processed so that the page can be delivered to your device (connection data). The website runs as an application in a container that is made reachable by an upstream reverse proxy (Traefik).
Legal basis: Art. 6 para. 1 lit. f GDPR (legitimate interest in the secure and reliable operation of the website).
Server logs: We do not store access logs containing IP addresses: the reverse proxy is configured not to write access logs, and the application itself does not log IP addresses or the content of requests. Its error logs contain only technical error messages and timestamps.
Note on the hosting provider: Which technical logs IONOS keeps in the course of operating its own infrastructure is outside our control; see the IONOS privacy policy for details.
The statistics software we use for audience measurement (section 7) is operated by us on our own server (stats.kesbyte-digital.com) and is not hosted by IONOS.
More information: IONOS Privacy Policy
3. Contact Form and Email Delivery
When you contact us via contact form or email, the following data is processed:
- Name
- Email address
- Subject (if provided) and message content
- Request timestamp
Email Delivery via Resend (Data Processor)
For email delivery, we use the service Resend (Resend Inc., San Francisco, USA).
We have a Data Processing Agreement (DPA) with Resend according to Art. 28 GDPR. Resend processes your data exclusively on our behalf and only for the purpose of email delivery.
Legal basis: Art. 6 para. 1 lit. b GDPR (processing your enquiry and pre-contractual measures at your request)
Storage period: Messages in our mailbox are kept as long as needed to handle your enquiry. They are then deleted, unless statutory retention obligations apply (e.g. for business letters under Section 257 of the German Commercial Code, six years).
Retention at Resend: According to Resend, email and log data is retained for 30 days on the standard plans (Free, Pro, Scale); after an account is terminated, the remaining customer data is deleted within 90 days. Beyond the terms of the data processing agreement we have no influence on this.
Confirmation email: After your enquiry we send a short confirmation to the address you provided (Art. 6 para. 1 lit. f GDPR, confirming receipt). The same address receives at most one confirmation within 24 hours; for this period the address is kept in the server's memory. The confirmation contains none of your input.
Data transfer to third countries: Resend stores data in the USA. Resend Inc. is listed in the public EU-U.S. Data Privacy Framework directory (dataprivacyframework.gov) with EU-U.S. certification and UK Extension (checked on 3 November 2026: status "Active", re-certification under review). The transfer is additionally based on the EU Standard Contractual Clauses (SCC) in the data processing agreement, which apply on their own.
More information: Resend Privacy Policy
4. Spam Protection in the Contact Form (ALTCHA)
To protect the contact form against automated submissions, we use ALTCHA, a self-hosted proof-of-work check. Your browser solves a small computational task issued by our server. The computation runs entirely in your browser. No third-party service is involved, no cookies are set, nothing is stored in your browser for this purpose and no user profile is created.
The task and its solution contain no personal data. The task is signed with a secret key on the server and is valid for two minutes. Solutions that have been used are kept until they expire (about three minutes), so they cannot be submitted again.
To stop a single sender from submitting many messages, we limit submissions to three per IP address within one hour. For this, the IP address, as passed on by the upstream proxy, is held in the server's memory with each submission attempt. These entries are removed no later than about 65 minutes after the time window began; they are not written to disk and are not output in the application's logs. A restart of the service deletes them.
The widget contains a link to the ALTCHA website. This link is not called when the page loads; a connection to it is only made if you click it.
Legal basis: Art. 6 para. 1 lit. f GDPR (legitimate interest in protecting the contact form against misuse and spam).
6. Local Storage in Your Browser
When you actively switch the display (light or dark) with the toggle, this website stores your choice in your browser's local storage. This storage is not a cookie and is transmitted neither to our server nor to third parties. As long as you do not use the toggle, nothing is stored.
Stored entry: Key theme-choice with the value light or dark.
Purpose: Remembers whether you chose the light or the dark display, so that it is shown again on your next visit. The entry is only set after you have used the toggle, and updated whenever you switch again. Without an entry, the display follows your system setting and its changes.
Transmission and tracking: The value is not transmitted and not analysed. No tracking takes place.
Storage period: Until you delete the entry. It does not expire automatically.
Legal basis: Section 25 (2) No. 2 TDDDG (strictly necessary so that we can provide a service explicitly requested by you, here the chosen display). No further processing of personal data takes place; any future processing would be based on Art. 6 para. 1 lit. f GDPR.
Deletion: Via the site data for this domain in your browser settings, or by removing the theme-choice entry in the developer tools. An entry named theme created by earlier versions of this website is removed once on your next visit.
7. Audience Measurement with Plausible Analytics
To understand how our website is used, we use the privacy-friendly statistics software Plausible Analytics. The software runs on our own server (stats.kesbyte-digital.com), which we operate ourselves. No data is passed on to third parties or transferred to third countries.
Plausible uses no cookies and stores no information on your device; it also does not read any information from your device beyond the connection data that is transmitted anyway. To count visits, a hash is generated from your IP address and browser identifier and rotates daily; the IP address itself is not stored. Recognising you across several days or other websites is therefore not possible. We only see aggregated statistics, no information about individual persons.
Data processed: Usage data (pages visited, origin of the visit/referrer, country or region, device type, browser and operating system).
Purpose: Audience measurement and improvement of the website.
Legal basis: Art. 6 para. 1 lit. f GDPR (legitimate interest in audience measurement and improving our offering). Since no information is stored on or read from your device, no consent under Section 25 (1) TDDDG is required.
Objection: You can object to the measurement at any time (Art. 21 GDPR); an informal message to us is sufficient. Common ad and tracking blockers also prevent the measurement.
More information: Plausible Data Policy
8. SSL/TLS Encryption
For security reasons and to protect the transmission of confidential content (e.g., contact requests), this website uses SSL/TLS encryption. You can recognize an encrypted connection by the "https://" string in your browser's address bar and the lock icon.
9. Your Rights (Data Subject Rights)
You have the following rights regarding your personal data:
What data is stored about you?
Correction of incorrect data
Right to be forgotten
Restriction of processing
Receive your data in structured format
Object to data processing
Contact for data subject rights:
Dennis Keßler
Email:
10. Right to Complaint with Supervisory Authority
You have the right to file a complaint with a data protection supervisory authority regarding the processing of your personal data:
State Commissioner for Data Protection Lower Saxony
Prinzenstraße 5
30159 Hannover
Germany
Phone: +49 511 120-4500
Email: poststelle@lfd.niedersachsen.de
Website: www.lfd.niedersachsen.de
11. Changes to This Privacy Policy
We reserve the right to update this privacy policy to reflect changes in legal requirements or changes to our services and data processing. This applies only to statements regarding data processing. If user consent is required or if parts of the privacy policy contain regulations on the contractual relationship with users, changes will only be made with user consent.
Last updated: November 5, 2026