Privacy Policy
Last updated: 1 September 2026
1. Controller
Oliver Duda
Maarstrasse 125 a
54292 Trier
Germany
Email: oliver@duda.team
No data protection officer has been appointed. Privacy enquiries may be sent to the email address stated above.
2. Legal bases
Personal data is processed where necessary to provide the website and platform, take steps prior to entering into a contract, perform a contract, comply with legal obligations, pursue legitimate interests or act on the basis of consent. The relevant legal bases include Article 6(1)(a), (b), (c) and (f) GDPR and, for access to terminal equipment, Section 25 TDDDG.
3. Hosting and server logs
The website is hosted by DigitalOcean, LLC, 105 Edgeview Drive, Suite 425, Broomfield, Colorado 80021, USA, in a data centre located in Frankfurt am Main, Germany. When the website is accessed, technically necessary connection data is processed, including the IP address, time, requested address, referrer, browser, operating system and HTTP status. This ensures secure and stable operation, error analysis and protection against misuse. The legal basis is Article 6(1)(f) GDPR.
Where data is transferred to the United States or another third country, an adequacy decision, including the EU-US Data Privacy Framework, or EU Standard Contractual Clauses and supplementary safeguards may apply, depending on the recipient and processing. Further information: DigitalOcean Privacy Policy.
4. Cookies and consent
Technically necessary cookies and comparable storage technologies are used for login, sessions, security, language settings, the shopping cart and consent management. Where required for a service expressly requested by the user, Section 25(2) TDDDG applies; subsequent processing is based on Article 6(1)(b) or (f) GDPR, depending on the purpose. Non-essential technologies are used only after consent in accordance with Section 25(1) TDDDG and Article 6(1)(a) GDPR. Consent can be withdrawn through the cookie settings.
5. Cookiebot
Cookiebot CMP by Usercentrics A/S, Havnegade 39, 1058 Copenhagen, Denmark, is used to manage and document consent. Data processed may include a pseudonymous consent identifier, consent status, time and technical device and browser information. The legal bases are Article 6(1)(c) and (f) GDPR and Section 25(2) TDDDG. Further information: Cookiebot Privacy Policy.
6. Registration and customer portal
During registration and use, data processed may include the user’s name, email address, postal address, organisation or club information, optional VAT identification number, roles, permissions, contract and licence information, plans, add-ons, quotas, usage levels and security and login data. Passwords are not stored in plain text. For two-factor authentication, the technical data required for setup and verification is processed. The legal basis is Article 6(1)(b) GDPR and, for security measures, Article 6(1)(f) GDPR.
7. Contracts, orders and billing
SNEXUS is used to select, order and manage plans and additional services. Customer, contract, order, invoice and transaction data is processed. The legal bases are Article 6(1)(b) and (c) GDPR. No external payment service provider is currently enabled for real payments. This policy will be updated before a payment provider is activated.
8. Contact and support
When a contact or support request is submitted, contact details, topic, subject, message content, time, processing status and correspondence are processed. Contract-related requests are based on Article 6(1)(b) GDPR; other requests are based on Article 6(1)(f) GDPR.
9. Email delivery via Mailgun
Mailgun, a Sinch Email service operated in the EU region, is used for registration, security, contract, support and system emails. Recipient address, sender, subject, content, time sent, delivery status, IP address and technical log data are processed. The legal bases are Article 6(1)(b) and (f) GDPR.
Open and click tracking is disabled. Mailgun Technologies, Inc. is part of the Sinch Group. For possible third-country transfers, the provider refers to the EU-US Data Privacy Framework and Standard Contractual Clauses. Further information: Mailgun Privacy Policy.
10. Status page
The footer links to status.va.alfyon.com. A connection to the status page is established only when this link is selected; the usual technical connection data is then transmitted.
11. Recipients and retention periods
Data is disclosed only to parties that require it for the purposes described above, particularly hosting, email and consent-management service providers and legally authorised bodies. Processors are engaged in accordance with Article 28 GDPR. Data is deleted when its purpose no longer applies and no statutory retention, evidence or limitation periods require continued storage. Contract and invoice data is retained in accordance with commercial and tax-law requirements.
12. Data subject rights
Subject to the statutory requirements, data subjects have rights of access (Article 15 GDPR), rectification (Article 16), erasure (Article 17), restriction of processing (Article 18), data portability (Article 20) and objection (Article 21). Consent may be withdrawn at any time with effect for the future. Contact: oliver@duda.team.
13. Right to lodge a complaint
Data subjects have the right to lodge a complaint with a data protection supervisory authority. For the controller’s registered location, the competent authority is in particular the State Commissioner for Data Protection and Freedom of Information of Rhineland-Palatinate: www.datenschutz.rlp.de.
14. Minors and security
The service is not directed at minors. Minors should not create their own accounts or submit data without the involvement of a person with parental responsibility. Appropriate technical and organisational measures are used to protect personal data.
15. Changes to this policy
This Privacy Policy will be updated when functions, service providers or legal requirements change.