Privacy

Data controller

Deadweight Labs UG (haftungsbeschränkt)

privacy@deadweightlabs.com

When you visit the website

Our web server processes your IP address, date and time, the requested address, response status, amount of data transferred, and browser and operating-system details. Your browser may also send the previous page as a referrer. This information is used to deliver the website, diagnose errors and protect it against abuse.

The legal basis is Article 6(1)(f) GDPR. Our legitimate interest is the secure and reliable operation of the website. Connection data is technically necessary to deliver the page.

The website runs on servers we administer. Access logs rotate daily; the current configuration retains up to 52 older log files. Extracts relating to a security incident may be needed for as long as its investigation or the establishment of legal claims requires.

Storage in your browser

The public website uses no tracking cookies, advertising networks or analytics tools. Fonts, graphics and scripts are served by our own website. We do not embed third-party videos or social-media content.

To update public project counters, the page stores a version identifier in browser session storage (sessionStorage). It identifies the public dataset, not a person. It normally remains until you close that tab. We do not use it to recognize visitors or build profiles.

When you email us

When you contact us by email, we process your email address, your message and any name or attachments you provide. General enquiries reach our team; privacy, legal and security matters use the corresponding contact addresses. The people handling your enquiry have access to it.

Article 6(1)(b) GDPR applies to enquiries about entering into or performing a contract. We handle other enquiries under Article 6(1)(f) GDPR and our legitimate interest in responding to incoming requests. You choose which information to send; we need a reply address to answer by email.

Retention depends on the enquiry. Correspondence is needed for handling it and, where relevant, documenting the matter. Statutory retention obligations and the protection of legal claims may require longer retention.

The separate employee area

The employee area at team.deadweightlabs.com is a separate part of the site that you choose to visit. Sign-in uses our account service at id.nurrobin.de. Visiting the public website alone does not start a sign-in.

Sign-in checks an account ID, profile information and access roles. The employee area receives technical authentication tokens; you enter your password at the account service. The portal keeps tokens in server memory and uses an essential session cookie containing a random identifier, protected from JavaScript access.

A pending login expires after ten minutes and a portal session after eight hours at most. Signing out or restarting the portal ends the local session sooner. Access permissions are rechecked periodically during use. Account details and sign-in methods are managed by the account service and exist independently of an individual portal session.

This processing provides protected access to internal tools and is based on our legitimate interest under Article 6(1)(f) GDPR; where necessary for an employment relationship, section 26(1) BDSG applies. The session cookie is necessary for the sign-in you requested, under section 25(2)(2) TDDDG. Linked tools, including the vault, check their own access permissions.

Links to other services

Links to GitHub and other external services are ordinary links. Your browser connects to the provider when you open them; that provider’s privacy information applies there. Public project counters are retrieved on the server, so your browser does not need to connect to GitHub to display them.

Your rights

Subject to the applicable legal conditions, you may request access to your personal data, correction, erasure or restriction of processing. You also have a right to data portability where its conditions apply. You may withdraw any consent you have given with effect for the future.

Right to object: where processing relies on Article 6(1)(f) GDPR, you may object under Article 21 GDPR on grounds relating to your particular situation. We will then assess whether compelling legitimate grounds for continued processing exist.

You may complain to a data protection supervisory authority, particularly where you live, work or believe an infringement occurred. The Bavarian State Office for Data Protection Supervision oversees private companies based in Bavaria. This website does not carry out automated decision-making, including profiling, within the meaning of Article 22 GDPR.