Privacy Policy

In the following, we would like to inform you about how we process your data.

Data Controller and Data Protection Officer

Data Controller:
Systemscape GmbH
Bergmannstr. 12
80339 München
E-Mail: #bXVuaWNoLWVtYmVkZGVkQHN5c3RlbXNjYXBlLmRl

Data Protection Officer:
Joel Schulz-Andres
c/o Systemscape GmbH
Bergmannstr. 12
80339 München
E-Mail: #bXVuaWNoLWVtYmVkZGVkQHN5c3RlbXNjYXBlLmRl

Hosting and Content Delivery Network (CDN)

Our host Cloudflare (Cloudflare Germany GmbH, Rosental 7, c/o Mindspace, 80331 Munich, Germany) collects the following data transmitted by your browser in so-called log files:

• IP address
• The address of the previously visited website (Referer Request Header)
• Date and time of the request
• Time zone difference to Greenwich Mean Time
• Content of the request
• HTTP status code
• Transferred amount of data
• Website from which the request comes
• Information about browser and operating system

This is necessary to display our website, ensure stability and security, and increase delivery speed through the Content Delivery Network (CDN). This corresponds to our legitimate interest pursuant to Art. 6(1)(f) GDPR. A CDN is a network of globally distributed servers that can optimally deliver content to website users.

No tracking occurs and we have no direct access to this data. The log files are deleted after a maximum of 25 hours.

The processing by Cloudflare corresponds to our legitimate interest pursuant to Art. 6(1)(f) GDPR in not having to maintain server infrastructure and a Content Delivery Network on our own premises.

You have the right to object to the processing. Whether the objection is successful must be determined as part of a balancing of interests.

The data will be deleted as soon as the purpose for processing ceases to apply. Personal data is stored by Cloudflare only as long as necessary for the described purposes.

The processing of the data specified in this section is neither legally nor contractually required. The functionality of the website cannot be guaranteed without the processing.

Cloudflare has implemented compliance measures for international data transfers. These apply to all worldwide activities where Cloudflare processes personal data of natural persons in the EU. These measures are based on the EU Standard Contractual Clauses (SCCs) and participation in the EU-US Data Privacy Framework. For more information, visit: https://www.cloudflare.com/cloudflare_customer_SCCs.pdf

Analytics

For web analytics, we use Pirsch Analytics. The provider is Emvi Software GmbH, Nickelstraße 1b, 33378 Rheda-Wiedenbrück, Germany. The data is processed on servers in Germany; no data transfer to third countries takes place. The analytics script and the measurement requests are served via a Cloudflare Worker operated by us.

Pirsch Analytics is a cookie-free web analytics software that was developed according to the Privacy by Design principle. To analyze visitor flows, Pirsch Analytics uses a hashing algorithm to generate a 16-digit number as the visitor ID when the page request is received. The input values are the IP address, the user agent, the date and a salt. The visitor's IP address is not persisted in whole or in part, and is anonymized completely and non-reversibly by the hash. The inclusion of the date and the use of one salt per website ensures that website visitors cannot be recognized for more than 24 hours and cannot be tracked across multiple websites. A rough localization (country/city) is performed via a locally integrated database.

The processing is based on our legitimate interest pursuant to Art. 6(1)(f) GDPR in a statistical evaluation of the use of our website. For more information on data protection at Pirsch Analytics, see: https://pirsch.io/privacy

You have the right to object to the processing. You can switch the measurement off with the button below. The objection is stored locally in your browser and therefore applies only to this browser on this device. It is lost if you clear the site data, and has to be declared again in other browsers or on other devices.

Map Display with OpenStreetMap

On our ecosystem page, we use an interactive map that loads map tiles from the German OpenStreetMap tile server (tile.openstreetmap.de). This server is operated by FOSSGIS e.V. (a registered association based in Germany). When loading the map tiles, your IP address is transmitted to the servers of FOSSGIS e.V. No data transfer to third countries takes place.

The use is based on our legitimate interest pursuant to Art. 6(1)(f) GDPR in providing an appealing presentation of locations on our website. Further information on the data protection of FOSSGIS e.V. can be found at: https://www.fossgis.de/datenschutzerkl%C3%A4rung

Your Rights as a Data Subject

As a data subject, you have the right to information, the right to rectification or erasure, the right to restriction of processing, and the right to object to the processing of your data. If you have given us consent, you can revoke it at any time with effect for the future.

Please send your objection or revocation informally to the above address of the Data Controller via (E-)Mail.

Furthermore, you have the right to data portability. You also have the right to lodge a complaint with a supervisory authority about the processing.

Legal Note

In principle, a data processing agreement must be concluded with the host. The Bavarian State Office for Data Protection Supervision has made an exception for hosting purely static websites.

In cases where the website serves self-presentation purposes, e.g., for associations or small businesses, no personal data flows to the operator, and no tracking takes place, there is no commissioned data processing. It further states: "The fact that IP addresses, i.e., personal data, must necessarily be processed even when hosting static websites does not lead to the assumption of commissioned data processing. This would not be appropriate. The (short-term) storage of IP addresses is rather to be attributed to the telecommunications access mediation of the website host according to the TKG and primarily serves the host's security purposes. https://www.lda.bayern.de/media/veroeffentlichungen/FAQ_Hosting_keine_Auftragsverarbeitung.pdf

We assume that this exception applies to Cloudflare Pages.

---

Privacy Policy for the Newsletter

Newsletter Information

When you subscribe to our newsletter, your information from the registration form is sent to the data controller. Registration for the newsletter uses a double opt-in procedure, which means that after registration you will receive an email to confirm your registration. This confirmation is required to prevent registration with a foreign email address. At the time of newsletter registration, the IP address and the time of registration are stored to prevent possible misuse. Your data will not be passed on to third parties unless there is a legal obligation to do so. The data is used exclusively for sending the newsletter. The subscription can be terminated at any time, and consent to store the data can be withdrawn. For this purpose, there is a corresponding unsubscribe link in every newsletter. The legal basis for data processing after newsletter registration is based on your consent according to Art. 6(1)(a) GDPR and for sending newsletters in the context of selling goods or services on § 7(3) UWG.

Use of Buttondown

Purpose and Description: We use Buttondown to send our newsletter. The service provider is Buttondown, LLC, 406 W Franklin St. #201, Richmond, VA 23221, USA. Buttondown is used to organize newsletter sending and its analysis. The data provided for the newsletter is stored on Buttondown servers in the USA. Emails sent via Buttondown contain a tracking pixel that connects to Buttondown's servers when opened, so it can be determined whether an email has been opened. Furthermore, we record which links in the newsletter are clicked. Opens and clicks can be attributed to individual subscribers. In addition, UTM parameters (utm_source, utm_medium, utm_campaign and utm_content) are appended to the links in the newsletter. These identify the newsletter and the respective issue so that visits to our website can be attributed to the newsletter; they do not identify individual subscribers. The analysis is part of how the newsletter is sent and cannot be switched off for individual subscribers. If you do not want it, you can unsubscribe from the newsletter. An unsubscribe link is included in every newsletter.

Legal Basis: The legal basis for processing the data is Art. 6(1)(a) GDPR.

Recipients: The recipient of the data is Buttondown, LLC.

Transfer to Third Countries: The data is transferred to and processed in the USA. The transfer is based on the European Commission's Standard Contractual Clauses (Implementing Decision (EU) 2021/914, Module 2, controller to processor), which form part of the data processing agreement concluded with Buttondown. In addition, we base the transfer on your explicit consent under Art. 49(1)(a) GDPR.

Storage Duration: The data stored with us for newsletter subscription is stored until unsubscription from the newsletter and deleted after unsubscription from both our servers and Buttondown's servers. Data stored with us for other reasons remains unaffected.

Withdrawal: You can withdraw your consent to data processing at any time for the future. The lawfulness of data processing carried out until withdrawal remains unaffected.