Notera. Digital Presence Studio · Ulm

Privacy

This English text is a convenience translation. The binding version is the German one.

What this page does with your data — and what it does not. Information under Art. 13 and 14 of the General Data Protection Regulation (GDPR).

These notes apply to visits to this site and to enquiries. If you become a client, you will receive separate privacy information for our work together along with our proposal.

The most important part first

  • No cookies. This page sets none, and so there is no banner for you to click away. The only exception is the sign-up for clients (section 07).
  • No tracking, no analytics services. No Google Analytics, no pixel, no third-party tool. We only count how the site is used, as numbers from our own server logs (section 02). We do not analyse who you are — only how many people come, when and from where.
  • Nothing is loaded from elsewhere. Fonts, images, scripts — everything sits on our own server. Opening this page creates no connection to Google, to a CDN or to anyone else. The only exception: Stripe's payment field on the payment page of the sign-up (section 07).
  • What you enter on this website stays in Europe. Within the EU — and, for our mailbox in Switzerland, in a country whose data protection the European Commission has recognised as equivalent (section 06). Nothing goes from the public pages to the USA or any other third country; only clients who grant their direct debit mandate pass their payment details to Stripe (section 07).
  1. 01Controller

    Julian Schneider und Nico Rueß GbR
    c/o Autorenglück #84562, Albert-Einstein-Str. 47, 02977 Hoyerswerda, Germany
    hello@notera.studio

    We are not required to appoint a data protection officer: the threshold of § 38 BDSG is not reached, and our work does not consist of large-scale monitoring or the processing of special categories of data. For questions about data protection, please write directly to the address above.

    Full provider details are in the Imprint.

  2. 02Opening the page

    When you open this page, our server records the request in a server log. This is standard for websites and necessary to run the site securely: to find errors and to detect and fend off attacks. What is stored:

    • your IP address
    • the date and time of the request
    • the address requested and whether it was delivered
    • the page visited before, if your browser sends it
    • browser, operating system and other technical details your browser sends on its own, such as the language setting

    Identifiers of individual ad clicks, such as Google’s “gclid”, are made unrecognisable before they are stored. The logs are automatically deleted after seven days at the latest.

    From these logs we derive visitor statistics consisting only of numbers: how many visits and page views there were and when, which pages were read, which website visitors came from, what kind of device they used and how many enquiries arrived through the form. A visit ends after 30 minutes without a request. Requests from programs — search engines, AI services and others — are counted separately; whether a program rightly claims to be a search engine, we check by its address. The analysis runs on our own server, with our own software; no provider is involved and nothing leaves this server.

    Your IP address is only held in memory for this, to group requests from the same device into one visit. Only totals are stored — no names, no identifiers, no profile and nothing that leads back to you.

    In addition, we keep a version of the log without IP addresses for at most two years, so that we can still analyse later when and how the site was used. It contains no IP addresses, cookies or login data; ad click identifiers are made unrecognisable there too.

    If you have switched on “Do Not Track” or “Global Privacy Control” in your browser, you are not counted — this counts as an objection to the visitor statistics (section 08).

    For this we set no cookies and store nothing on your device, apart from the entry described in section 04. That is why this site does not ask you for permission — there is nothing we would need it for.

    This page sits on a server of our own, which we rent and run ourselves. It stands in Germany. We share it with nobody, no third-party service runs alongside on it, and nobody but us has access to the system. There is no website builder, no third-party analytics tool and no provider in the background that your data would be passed on to.

    The data centre is Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany. It provides the machine and the power, not the software — a data processing agreement under Art. 28 GDPR is in place. The servers stand exclusively in Germany; no transfer to a third country takes place.

    Legal basis: Art. 6(1)(f) GDPR — legitimate interest in the secure operation of the site and in visitor statistics that do not identify anyone

  3. 03Fonts

    The three fonts on this page sit on our own server. They are not loaded from Google Fonts. Opening the page therefore creates no connection to fonts.googleapis.com or fonts.gstatic.com, and your IP address is not transmitted to Google.

  4. 04Your device

    This page stores at most one entry in your browser's storage — and only if you change the language yourself:

    • notera.sprache — remembers for the length of this session whether you set the page to German or English by hand, so it does not jump back on your next click. The entry disappears as soon as you close the tab or the browser.

    It is not a cookie: the entry is not sent with any request and never reaches our server. It contains only a language code ("de" or "en") and no personal data. Because it only comes into being when you choose the language explicitly, and does nothing but carry out that choice, it is strictly necessary for the service you asked for (§ 25 (2) no. 2 TDDDG). No consent is needed for it.

    Everything else the page decides without storing anything on your device: the motif of the opening scene is chosen at random on every visit. Whether the scene runs at all depends on whether you reload or arrive from another page of this website — which your browser tells us anyway. The load time shown is measured on every visit from your browser's own timing data and is not stored anywhere.

    Earlier versions of this page created further entries (notera.auftritt, notera.ladezeit, notera.szene). The page removes them itself on your next visit.

    On the sign-up pages — for clients only — two things are added, both described in section 07: a cookie of our own that identifies you for 24 hours after you open your personal link, and cookies set by Stripe on the payment page.

  5. 05The form

    When you submit the enquiry form, your details travel encrypted to our own server in Germany. There they are turned into an email to our mailbox straight away and then discarded. They are not stored: not in a file, not in a database, and the content appears in no log. There is no form service and no provider in between.

    Transmitted are: message, name, email address, optionally company and phone number, the nature of your enquiry and the page you are writing from — and, if you arrived via one of our clients' referral links, its code, so that we know who recommended us. From the moment of delivery your enquiry sits in our mailbox as an ordinary email — for which section 06 applies. We use the details solely to answer your enquiry and delete them once it is settled and no statutory retention period stands in the way.

    Recipients: our brokers. For on-site appointments we work with independent brokers who arrange Notera's services; they are not employed by us. If we ask one of them to show you the demo of your website, they see in their access to our broker portal the name, location and address of your business, your name as contact person, our note on your request and the demo. They do not receive your phone number or email address. Each broker only sees the businesses assigned to them.

    To keep machines from misusing the form, our server checks three things: whether a field was filled in that should stay empty, how long the form was open, and how many enquiries recently came from the same IP address. For the last point your IP address sits briefly in our server's memory and is discarded after 24 hours; it is not joined with your enquiry. We do not use a captcha — it would pull third-party scripts onto this page.

    We do not ask for consent for this, which is why the form has no tick box: you write to us because you want something from us, and to answer you we need your details.

    Legal basis: Art. 6(1)(b) GDPR — steps prior to a contract at your request · for enquiries not related to a contract and for the prevention of misuse Art. 6(1)(f) GDPR — legitimate interest in answering enquiries and protecting the form · passing on to a broker for an on-site appointment: Art. 6(1)(b) GDPR, otherwise Art. 6(1)(f) GDPR

  6. 06Email

    If you write to us directly, we process your message and sender address in order to answer it. Our mailbox is held by Migadu-Mail GmbH, Rohnen 587, CH-9414 Schachen, Switzerland (commercial register CHE-334.933.960) — for the public pages of this website, this is the only service outside our own server; for payment during sign-up, Stripe is added (section 07).

    Switzerland is not a third country with an unclear level of protection: the European Commission has certified it with an adequacy decision confirming a level of data protection equivalent to that of the EU. A data processing agreement under Art. 28 GDPR is in place. Your emails do not go to the USA. The same applies here: only to answer you, passed on only to one of our brokers as described in section 05, deleted once settled.

    Legal basis: Art. 6 (1) (b) GDPR — steps prior to entering into a contract · otherwise Art. 6 (1) (f) GDPR

  7. 07Payment

    If you become a client, you conclude the contract on the sign-up pages. When you open the personal link we send you, we set a cookie of our own (notera_abschluss): it identifies you for 24 hours as entitled to complete this sign-up and applies only to these pages.

    To collect our invoices by SEPA direct debit, we work with Stripe: Stripe Payments Europe, Limited, 1 Grand Canal Street Lower, Grand Canal Dock, Dublin, D02 H210, Ireland. When you grant your direct debit mandate, you enter the account holder and IBAN directly into an input field provided by Stripe; in addition, we pass your name, email address and postal address to Stripe. Stripe creates the mandate and collects our invoices. We ourselves only receive the last four digits of your IBAN, the mandate reference and whether a payment has arrived; we do not store your full IBAN.

    To keep the payment secure and prevent fraud, the payment page of the sign-up loads a script from Stripe (js.stripe.com). It transmits technical information about your device and your IP address to Stripe and sets cookies for this. This is strictly necessary for the payment (Section 25 (2) no. 2 TDDDG). The script is not loaded on any other page of notera.studio.

    Stripe also processes data in the USA (Stripe, Inc.). Stripe is certified under the EU-US Data Privacy Framework, for which the European Commission has found an adequate level of data protection; the EU Commission's standard contractual clauses apply in addition. Stripe is itself responsible for fraud prevention and its own legal obligations, such as anti-money-laundering checks. More: stripe.com/privacy.

    We keep invoice and payment data for as long as the law requires — usually ten years.

    Legal basis: Art. 6 (1) (b) GDPR — performance of the contract · for fraud prevention Art. 6 (1) (f) GDPR — legitimate interest in secure payments · for retention Art. 6 (1) (c) GDPR in conjunction with Section 147 AO, Section 257 HGB

  8. 08Your rights

    You have the following rights in relation to us at any time:

    • Access to whether and which data we process about you (Art. 15)
    • Rectification of incorrect details (Art. 16)
    • Erasure (Art. 17)
    • Restriction of processing (Art. 18)
    • Data portability in a common format (Art. 20)

    An informal email is enough. We answer within one month; it costs you nothing.

    Your right to object under Art. 21 GDPR

    Where we process your data on the basis of a legitimate interest (Art. 6(1)(f) GDPR) — for example the server logs in section 02 and protecting the form against misuse in section 05 — you may object to this processing at any time on grounds relating to your particular situation.

    We will then no longer process your data unless we can demonstrate compelling legitimate grounds that override your interests, rights and freedoms, or the processing serves the establishment, exercise or defence of legal claims.

    You can also object to the visitor statistics in section 02 without an email: switch on “Do Not Track” or “Global Privacy Control” in your browser. We do not count requests carrying either signal (Art. 21(5) GDPR).

    An informal email to hello@notera.studio is enough to object.

  9. 09Complaint

    If you believe that we are not processing your data lawfully, you can complain to a supervisory authority (Art. 77 GDPR). The authority responsible for us is the one at the place where we work:

    Der Landesbeauftragte für den Datenschutz und die Informationsfreiheit Baden-Württemberg (State Commissioner for Data Protection and Freedom of Information, Baden-Württemberg)
    Heilbronner Straße 35, 70191 Stuttgart, Germany
    poststelle@lfdi.bwl.de

    You may equally turn to the supervisory authority of your place of residence, your place of work, or the place where you believe the infringement took place.

  10. 10Limits

    So that there is no doubt — on this page there is:

    • no sale of your data and no passing on to third parties — except to one of our brokers, as described in section 05, and, if you pay by direct debit as a client, to Stripe (section 07)
    • no transfer to a third country without a recognised level of data protection — enquiries and emails stay in Europe (section 06); payment via Stripe is covered by the adequacy decision for the EU-US Data Privacy Framework (section 07)
    • no automated decision-making and no profiling within the meaning of Art. 22 GDPR
    • no advertising, no newsletter, no further use of your address

    There is no obligation to give us data. Without a message and a return address, however, we cannot answer you.

Back to the site