Privacy policy

Controller

The controller under the General Data Protection Regulation (GDPR) is Sorin-Ionut Curescu, trading as en3sis, Nürnberg, Germany. The full postal address is in the imprint. For any privacy question or request, write to us through the contact form. No data protection officer is required or appointed.

Visiting aktenzeit.de

• Hosting. The website and its database run on a server of Hetzner Online GmbH, Gunzenhausen, in a data centre in Germany. To deliver a page, the server processes your IP address, browser user agent, the requested URL and the time of the request (Art. 6(1)(f) GDPR, interest in delivering and securing the site). IP addresses are not written to a permanent log.
• Content delivery and protection. All requests pass through the network of Cloudflare, Inc., San Francisco, USA, which protects the site against attacks and delivers it faster. Cloudflare processes connection data such as your IP address for this purpose (Art. 6(1)(f) GDPR).
• Cookies and browser storage. The site loads no advertising, analytics or tracking scripts. It sets one cookie, and only when you choose a language in the language menu: lang stores that choice (de, en or es) for one year so the start page opens in your language. It contains nothing else and is strictly necessary for the function you asked for (section 25(2) no. 2 TDDDG). Fonts are served from this domain. The browser keeps the scroll position of pages you visited in its session storage so the back button works as expected. This is strictly necessary for that function (section 25(2) no. 2 TDDDG) and is never sent to a server.

Reporting a waiting time

• Report data. The office, the application type, the date you applied and, if you add them, the dates of further steps, the decision and its outcome. We do not ask for names, file numbers or nationality. These details are published as aggregated figures and as anonymous single reports (month of application and duration). Legal basis is Art. 6(1)(f) GDPR, our interest and the interest of other applicants in reliable information about waiting times.
• Abuse protection. With each report we store a hash of your IP address, calculated with a key that changes every day. The IP address itself is not stored. It is used only to limit the number of reports per connection (Art. 6(1)(f) GDPR).
• Source. We store the page or campaign that brought you to the form (referrer or campaign tag) to understand which channels lead to reports.
• Private link. Your report can only be changed through its private link. Anyone who has the link can see and change the report, so keep it to yourself.

Emails

If you give your email address, we use it to send you the private link, reminders to add new steps, a notice when your application has been open for three months, and a message when people from your comparison group report a decision. At most one email a week. The legal basis is your consent (Art. 6(1)(a) GDPR), which you can withdraw at any time with the unsubscribe link in every email or by writing to us through the contact form. We store which type of email was sent when, so that you do not receive more than one per week.

Emails are sent through Resend (Plus Five Five, Inc., San Francisco, USA), which processes your email address and the content of the email.

Contact form and email to us

When you use the contact form or write to the email address in the imprint, we process your email address, your name if you give it and your message, to answer you (Art. 6(1)(f) GDPR; for listing enquiries Art. 6(1)(b) GDPR). Contact form messages are sent to us through Resend. Email to our address is forwarded by Cloudflare Email Routing to a Gmail inbox of Google Ireland Limited, where we read and answer it. We delete messages once the matter is settled, unless the law requires us to keep them longer.

Recipients

• Hetzner Online GmbH (hosting), Cloudflare, Inc. (content delivery, protection and email forwarding), Resend (email delivery) and Google Ireland Limited (our email inbox), acting as processors under data processing agreements (Art. 28 GDPR).
• Authorities, where there is a legal obligation to disclose.

Cloudflare, Resend and Google are located in or process data in the United States. Transfers are based on the European Commission's adequacy decision for the EU-US Data Privacy Framework (Art. 45 GDPR) where the recipient is certified, and otherwise on the Commission's standard contractual clauses (Art. 46(2)(c) GDPR). Personal data is never sold and never used for advertising.

Retention

• Reports: as long as the website runs, or until you ask for deletion.
• Email address: until you unsubscribe or ask for deletion. After unsubscribing, the address is no longer used for any email.
• Hashed IP addresses: stored with the report. Because the key changes daily, they cannot be linked across days.
• Email correspondence: as long as needed to answer you, and tax-relevant records for the periods required by German law.

Deletion

To have your report and email address deleted, send the private link of your report to us through the contact form. Data is deleted without undue delay and at the latest within one month.

Your rights

You have the right to access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18) and data portability (Art. 20), and to withdraw consent at any time (Art. 7(3)). Write to us through the contact form. Requests are answered within one month.

You also have the right to lodge a complaint with a supervisory authority (Art. 77 GDPR). The authority responsible for us is the Bavarian State Office for Data Protection Supervision (Bayerisches Landesamt für Datenschutzaufsicht, BayLDA).

Right to object

Where processing is based on legitimate interests (Art. 6(1)(f) GDPR), you have the right to object to it at any time on grounds relating to your particular situation (Art. 21(1) GDPR). To object, write to us through the contact form.

Security

Data is encrypted in transit, the database is not reachable from the internet, and administrative access is limited to a private network.

Children

Aktenzeit is not directed at children under 16.

Changes

This policy is updated when processing changes or the law requires it. The current version is always on this page, with its date at the top.