Privacy Policy

1 Controller and scope

This privacy policy explains how personal data is processed when you visit null-one.dev, when you contact us and in the course of our own customer and business relationships for IT development and consulting. Personal data is any information relating to an identified or identifiable natural person.

The controller is Osieka / Röber GbR, trading as Null One Dev, represented by its partners Franziska Osieka and Carl Röber, Kantstr. 152, 10623 Berlin, Germany. Email for data protection matters: c.roeber@null-one.dev

Where we process personal data on behalf of our clients and on their instructions, the respective client is, as a rule, the controller for that processing. Section 10 explains our role in this case. For stand-alone applications or additional services, we provide supplementary privacy information where necessary.

2 Website operation and contacting us

When you access our website, technically necessary connection data is processed so that the requested content can be delivered and the systems protected. The log data actually recorded comprises the IP address, the date and time of the request, the requested host and path including any query parameters, the HTTP method and the HTTP status code, the browser identifier (user agent, which usually reveals the browser and operating system), the server region that handled the request and the cache status. The hosting provider also derives an approximate location from the IP address.

Processing for provision, error analysis and abuse prevention is based on Art. 6(1)(f) GDPR. Our legitimate interests are reliable and secure website operation and the investigation of attacks. The recipient is our hosting provider Vercel Inc., 440 N Barranca Ave #4133, Covina, CA 91723, USA. Vercel provides a Data Processing Addendum (data processing agreement) for the processing of personal data on behalf of its customers. The transfer to the USA complies with data protection law: Vercel Inc. is certified under the EU-U.S. Data Privacy Framework, so an adequacy decision of the European Commission applies (see Section 3).

Connection data is required for the transmission. We delete or anonymise server logs after one hour: Vercel automatically deletes the runtime logs available in our account after this period, and we do not export or store them separately. Logs that Vercel keeps under its own responsibility to operate and protect its platform are, according to Vercel, retained only for as long as this requires; Vercel does not state a specific period. In the event of a specific security incident, we store the extracts required for it separately until the investigation or any necessary legal action has been concluded. This does not affect other logs. Section 3 contains information on transfers outside the EEA.

When you contact us, we process your contact details and the content of your message. The website form collects your name, email address and message. Required fields are indicated in the form. Without a way to contact you back and sufficient information, we will generally be unable to answer your enquiry; additional information that is not needed is voluntary. Please do not send passwords, access keys or special categories of personal data, such as health data, via the general form.

Through our online withdrawal function, we process your name, your email address, the details of the contract concerned, your notice of withdrawal and the date and time of receipt in order to process the withdrawal and to acknowledge its receipt. The legal bases are Art. 6(1)(b) and (c) GDPR.

Where the matter concerns a contract with you or, at your request, steps prior to entering into one, the legal basis is Art. 6(1)(b) GDPR. For general enquiries and for contact persons of a company, we base the processing on Art. 6(1)(f) GDPR; our legitimate interest lies in appropriate communication and the maintenance of business relationships. As a rule, separate consent is not required for this.

We use Web3Forms for the technical processing of forms. According to the provider's documentation, the operator is Web3Creative, operating from India. Provider details: Web3Creative, Kerala, India; the provider does not publish a full postal address; contact: support@web3forms.com. The form content and the metadata required for transmission and protection are transferred. The legal basis we rely on towards you remains the one that applies to your enquiry. In this respect, the service acts as a processor.

Web3Forms automatically deletes entries stored via Web3Forms no later than three years after receipt. The three-year period stated below applies to copies in our email mailbox. Our email provider is Microsoft 365, which we obtain through GoDaddy. Our contractual partner is GoDaddy.com, LLC, 100 S. Mill Ave, Suite 1600, Tempe, AZ 85281, USA, which acts as our processor on the basis of its data processing addendum; the service itself is operated by Microsoft. Mailbox data is stored in data centres in Germany and processed by Microsoft within the EU under its EU Data Boundary. Once an enquiry has been concluded without a subsequent contract, we delete content that is no longer required after three years. We handle correspondence subject to retention obligations and specifically required evidence in accordance with Section 8.

The website is accessible in encrypted form via HTTPS. Transport encryption protects data in transit on the respective transmission path; it does not automatically mean end-to-end encryption of all emails and subsequent processing steps.

3 Recipients and transfers to other countries

Internally, only persons who need the data for their tasks have access to it. External service providers receive data insofar as this is necessary for the purpose described and legally permissible. The providers actually used for hosting (Vercel), form processing (Web3Forms), email (Microsoft 365), audience measurement (Umami) and project tools (GitHub) are named in the respective sections. Where they act on our behalf, processing takes place on the basis of a contract pursuant to Art. 28 GDPR and in accordance with our instructions.

For invoicing and payment, our bank and our tax advisers may process the data required in each case. Authorities receive data where there is a legal obligation, on the basis of Art. 6(1)(c) GDPR in conjunction with the relevant provision. Legal advisers and recipients required for the enforcement or defence of claims receive data on the basis of Art. 6(1)(f) GDPR; our interest is the protection of our rights. Recipients acting on their own professional responsibility are not processors merely because we have engaged them.

We describe transfers of data to recipients outside the European Union or the European Economic Area for each service. These may also include access by service providers from such countries. For every transfer that actually takes place, we state the recipient country and either the relevant adequacy decision pursuant to Art. 45 GDPR or the appropriate safeguards pursuant to Art. 46 GDPR, as well as the means by which to obtain a copy of these safeguards.

Hosting – Vercel Inc., USA. This concerns the connection and log data described in Section 2, for delivering and protecting the website. The transfer is based on the European Commission's adequacy decision on the EU-U.S. Data Privacy Framework (Implementing Decision (EU) 2023/1795 of 10 July 2023). Vercel Inc. is listed as actively certified in the official list of participants at www.dataprivacyframework.gov.

Form processing – Web3Creative (Web3Forms), India. This concerns the form content (contact form: name, email address, message; withdrawal form: name, email address, contract details, notice of withdrawal and time) as well as technical metadata such as IP address, time and referrer. The purpose is to receive the entries, check them for spam, store them and forward them to us by email. There is no adequacy decision for India. The transfer is therefore based on the European Commission's standard contractual clauses (Implementing Decision (EU) 2021/914), Module 2 (controller to processor), which are incorporated into the Web3Forms data processing agreement. As supplementary measures, the provider names transport encryption (TLS) and encryption of stored data. Web3Forms uses sub-processors in other countries: Amazon Web Services (hosting, database, email delivery; regions as configured by the provider), Cloudflare (global network), Hetzner (Germany/Finland) and, for spam protection, CleanTalk and Akismet (Automattic), based in the USA. The two spam services receive the IP address and the email address of the sender.

Audience measurement – Umami Software, Inc., USA (only with consent). The data concerned and the purpose are described in Section 4. Umami Software, Inc. is not certified under the EU-U.S. Data Privacy Framework. The transfer is based on the standard contractual clauses, Module 2 (controller to processor), which are incorporated into Umami's data processing agreement. Umami operates servers in the USA and the EU and uses sub-processors mainly in the USA, including Amazon Web Services, ClickHouse, Cloudflare and Vercel.

Email – Microsoft 365, obtained through GoDaddy. This concerns the content and metadata of the emails we send and receive, including messages forwarded from our website forms. Mailbox data is stored in Germany; under its EU Data Boundary, Microsoft stores and processes customer data within the EU and the EFTA region and transfers it to other countries only in the limited exceptional cases documented by Microsoft. Microsoft Corporation is actively certified under the EU-U.S. Data Privacy Framework. Our contractual partner GoDaddy.com, LLC (USA) is likewise covered by the EU-U.S. Data Privacy Framework through the certification of GoDaddy Operating Company, LLC; transfers to GoDaddy are therefore based on the European Commission's adequacy decision.

Project tool – GitHub, Inc., USA. For source code management as well as automated checks and builds, we use GitHub, provided by GitHub, Inc., 88 Colin P. Kelly Jr. St., San Francisco, CA 94107, USA. This concerns the project content stored there as well as the names, usernames and email addresses of the persons involved in commits, issues and pull requests. The transfer is based on the adequacy decision on the EU-U.S. Data Privacy Framework, under which GitHub is actively certified.

The data processing agreements of Web3Forms (web3forms.com/dpa) and Umami (umami.is/dpa), including the provisions on the standard contractual clauses, are publicly available. You can request a copy of the safeguards applicable to your data via our data protection contact; redactions necessary to protect the rights of others remain possible.

4 Cookies, local storage and audience measurement

When storing information on your terminal equipment or accessing information already stored there, we comply with Section 25 of the German Telecommunications Digital Services Data Protection Act (TDDDG). This provision also applies to comparable technologies such as local browser storage. Consent is not required where the statutory conditions for an exemption are met, in particular where the storage or access is strictly necessary for a digital service you have expressly requested. Any subsequent processing of personal data additionally requires a legal basis under the GDPR.

Our website does not set any cookies, and neither does our hosting provider when the pages are accessed. The following information is stored in or read from your browser:

• Key

  theme

  Storage location

  Local Storage

  Provider

  us

  Purpose

  Remembers the display mode you have chosen with the toggle (light or dark). Only set when you use the toggle, and read when a page is loaded.

  Data stored

  light or dark

  Duration

  until you delete the website data in your browser

• Key

  react-router-scroll-positions

  Storage location

  Session Storage

  Provider

  us

  Purpose

  Restores the previous scroll position when you navigate back and forward.

  Data stored

  random identifiers of the history entries with scroll positions

  Duration

  until the browser tab is closed

• Key

  react-router-manifest-version

  Storage location

  Session Storage

  Provider

  us

  Purpose

  Only if a new version of the website is published during your visit: triggers a one-time reload of the page.

  Data stored

  version identifier of the website

  Duration

  until the browser tab is closed

• Key

  analytics-consent

  Storage location

  Local Storage

  Provider

  us

  Purpose

  Stores your decision on audience measurement so that the banner does not reappear on every visit. A decision older than 12 months is no longer taken into account; the banner then asks again.

  Data stored

  your decision (accepted or rejected) and when you made it

  Duration

  until you make a new decision or delete the website data in your browser

• Key

  umami.disabled

  Storage location

  Local Storage

  Provider

  us (set), Umami (reads)

  Purpose

  Only set if you withdraw consent you have given, and removed again if you consent again. The Umami script checks this entry before every transmission and then no longer sends any data.

  Data stored

  1

  Duration

  until you consent again or delete the website data in your browser

These entries are stored only in your browser and are not transmitted to us. Storage and access take place without consent pursuant to Section 25(2) No. 2 TDDDG because they are strictly necessary for the website functions you use; analytics-consent and umami.disabled serve to record your decision on audience measurement and to give effect to a withdrawal. The Umami script itself only reads umami.disabled if it has been loaded after you gave your consent (see below).

Audience measurement with Umami Cloud. With your consent, we use the web analytics service Umami Cloud provided by Umami Software, Inc., 28 Geary St, Suite 650 #243, San Francisco, CA, USA. The measurement script is only loaded after you have agreed in the consent banner; without your consent, no measurement takes place. The script is loaded from cloud.umami.is and, on every page view, transmits to gateway.umami.is the address (URL) and title of the page viewed, the referring page (referrer), your screen resolution and browser language and, for technical reasons, your IP address and browser identifier (user agent). From this, Umami determines the browser, operating system, device type and approximate location (country, region, city). According to Umami's published source code, the IP address is not stored but is combined with the browser identifier, an identifier of our website and a regularly changing value into a pseudonymous session identifier. Umami does not set cookies. We do not transmit custom events or user identifiers, and we do not combine the data with other data or across other websites.

The purpose is the statistical analysis of the use of our website in order to improve its content and presentation. The legal basis for accessing your terminal equipment is Section 25(1) TDDDG and, for the subsequent processing, Art. 6(1)(a) GDPR, in each case on the basis of your consent. Umami processes the data as our processor; see Section 3 for recipients and the transfer to the USA. Under our plan, the collected data is deleted after six months. You can withdraw your consent at any time with effect for the future by reopening the banner via the “Privacy settings” link in the page footer and selecting “Reject”. Measurement then ends immediately, and the page is reloaded so that no measurement script keeps running.

5 External content and social networks

External services linked on our website are only opened when you click on them. The links themselves do not load any embedded content from the target platform. When you access the external service, its operator processes data under its own responsibility. The privacy information provided there explains this processing.

6 Right to object

Where we process your personal data on the basis of Art. 6(1)(f) GDPR, you may object at any time on grounds relating to your particular situation. This also applies to profiling based on that provision. We will then no longer process the data unless we demonstrate compelling legitimate grounds which override your interests, rights and freedoms, or the processing serves the establishment, exercise or defence of legal claims.

You may object at any time, without giving reasons, to the processing of your personal data for direct marketing. This also applies to profiling to the extent that it is related to such direct marketing. We will then no longer process your data for these purposes. You can send your objection informally to the contact stated in Section 1.

7 Your other rights

Subject to the statutory requirements, you have the right of access to and a copy of your personal data pursuant to Art. 15 GDPR, the right to rectification and completion pursuant to Art. 16 GDPR, the right to erasure pursuant to Art. 17 GDPR and the right to restriction of processing pursuant to Art. 18 GDPR. Erasure may be excluded in particular where further processing is necessary to comply with legal obligations or for legal claims.

Pursuant to Art. 20 GDPR, you can receive the data you have provided in a structured, commonly used and machine-readable format and, where technically feasible, have it transmitted to another controller, provided that the processing is based on consent or a contract and is carried out by automated means.

You can withdraw any consent you have given at any time with effect for the future, without affecting the lawfulness of the processing carried out on the basis of that consent before its withdrawal. You can withdraw consent via the contact provided and, for the relevant online services, via the withdrawal function offered there.

Pursuant to Art. 77 GDPR, you can lodge a complaint with a data protection supervisory authority, in particular in the Member State of your habitual residence, your place of work or the place of the alleged infringement. The authority responsible for our place of business is the Berlin Commissioner for Data Protection and Freedom of Information (Berliner Beauftragte für Datenschutz und Informationsfreiheit), Alt-Moabit 59–61, 10555 Berlin.

To exercise your rights, a message to our data protection contact is sufficient. If we have reasonable doubts about your identity, we may request the additional information necessary to confirm it. We generally respond within one month of receipt. Where requests are complex or numerous, this period may be extended by up to two further months under the statutory conditions; we will inform you of any such extension and the reasons for it within the first month. Handling your request is generally free of charge; statutory exceptions remain unaffected.

8 Storage period and erasure

We store personal data only for as long as it is necessary for the stated purpose or as there is a legal obligation to continue storing it. The specific periods or the criteria used to determine them are stated for the individual processing operations. Consent data is not stored indefinitely merely because consent has not yet been withdrawn.

Insofar as statutory retention obligations apply to us, we generally retain accounting vouchers for eight years, commercial and business letters for six years, and books, inventories and the financial statement documents specified by law for ten years. As a rule, the periods begin at the end of the calendar year in which the event specified by law occurred. The legal basis is Art. 6(1)(c) GDPR in conjunction with, in particular, Section 147 of the German Fiscal Code (AO) and, where applicable, Section 257 of the German Commercial Code (HGB). Statutory extensions, for example in the case of pending tax proceedings, must still be observed.

For evidence specifically required to enforce or defend claims, further storage may be based on Art. 6(1)(f) GDPR. Our legitimate interest lies in protecting our legal position. We limit this to the necessary documents and to the period during which claims may actually be raised or proceedings are ongoing. The general retention periods do not justify blanket archiving of all project files, access credentials and log files.

9 IT projects, consulting and business relationships

To initiate, perform, document and invoice our development and consulting services, we process the necessary master and contact data, business communications, quotation and contract data, project arrangements, proof of services rendered and invoicing and payment information. We use GitHub for source code management as well as automated checks and builds (see Section 3).

Where our contractual partners are natural persons, the necessary processing is based on Art. 6(1)(b) GDPR. For contact persons of our business customers and suppliers, Art. 6(1)(f) GDPR applies; our legitimate interest is orderly cooperation and contract performance. Invoicing and retention required by law are based on Art. 6(1)(c) GDPR in conjunction with the relevant provisions. Processing based on consent takes place only for a separately specified voluntary purpose.

We need the information marked as required for quotations and orders in order to provide the respective service; without it, it may not be possible to prepare or perform a contract. Information that is not required is voluntary. We delete project and communication data three years after the end of the calendar year in which the project or support was completed; this corresponds to the standard limitation period under Sections 195 and 199 of the German Civil Code (BGB). Only data subject to separate retention obligations or required for specific claims remains stored in accordance with Section 8.

10 Processing of customer data on behalf of clients

In development, integration and support assignments, we may need to access personal data for whose processing our client is the controller. Insofar as we process this data exclusively on the client's documented instructions, we act as a processor. The agreed scope of services and the data processing agreement pursuant to Art. 28 GDPR are decisive. This website statement does not constitute consent by the data subjects to processing by the client.

In this role, the client determines the purposes, the legal bases and the information provided to the data subjects. We support the client in fulfilling its obligations. If we receive a request concerning such data, we forward it to the responsible client for handling, insofar as we can identify the client from the information provided. By contrast, we process our own business contact data in accordance with the other sections of this policy.

11 Source of the data and supplementary information

We receive most information directly from you. In the course of business cooperation, we may receive professional contact details, your role and project-related information from your employer or our client. Where we do not collect data directly from you and an information obligation under Art. 14 GDPR applies, we inform you within the statutory periods: generally within one month at the latest; where the data is used to communicate with you, at the latest at the time of the first communication; and where disclosure is envisaged, at the latest when the data is first disclosed. Statutory exceptions remain unaffected.