Privacy policy.

1. Data controller

The controller within the meaning of the General Data Protection Regulation (GDPR / DSGVO) and other national data protection laws is:

Steven Obst
Halfsquare, IT services
Schnellerstraße 91 A
12439 Berlin, Germany
Email: kontakt@halfsquare.de

Further mandatory information is in the imprint.

A statutory data protection officer is not required for an operation of this size. Please direct data protection questions to the controller directly.

2. Data we process on this website

2.1 Server log files

When you load any page, our hosting provider Vercel Inc. collects technical data: IP address, date and time, requested URL, transferred byte count, browser identifier, operating system, referrer. This data is retained for 30 days and used exclusively to operate the site, analyse errors and defend against attacks. Legal basis: Art. 6(1)(f) GDPR (legitimate interest in operation and security).

2.2 Contact form

When you submit the contact form, we process your name, email address, topic, and message to handle your enquiry and any follow-ups. Transmission is encrypted. Data is delivered via our email service Resend (see section 3). We retain your enquiry until handling is complete, at most six months after, unless a statutory retention obligation requires longer. Legal basis: Art. 6(1)(b) GDPR (pre-contractual measure) and Art. 6(1)(a) GDPR (consent via the checkbox).

2.3 Audience measurement with Plausible Analytics

We use Plausible Analytics, operated by Plausible Insights OÜ in Estonia (EU). Plausible sets no cookies and stores no personal data. The visitor's IP address is used exclusively to compute a daily-rotating salted hash that cannot be reversed and expires after 24 hours. There is no cross-site tracking, no fingerprinting, no profiling. Aggregated data (page views, time on page, country at country level) is non-personal.

Legal basis: Art. 6(1)(f) GDPR (legitimate interest in statistical audience measurement).

§ 25(1) TTDSG does not apply because no information is stored on or retrieved from your terminal equipment. We use no cookies, no local storage, no pixels. The consent obligation under § 25 TTDSG therefore does not engage. This assessment follows the orienting guidance from German supervisory authorities on cookieless audience measurement. If the legal situation or supervisory practice changes, we will switch Plausible behind an explicit consent layer.

2.4 Appointment booking via Cal.com (planned)

Once Cal.com Inc. is integrated, Cal.com will process the data you submit (name, email, chosen time slot) to make the booking. A data-processing agreement is in place and EU hosting is used where available.

3. Data processors and external services

3.1 GitHub, Inc.

Source-code hosting for this website. Location: USA, with Standard Contractual Clauses pursuant to GDPR Art. 46 and supplementary technical measures. Processed data: source code, no user data.

3.2 Vercel Inc.

Build and production hosting. Data centre region: Frankfurt am Main (EU). The US parent company is covered by Standard Contractual Clauses pursuant to GDPR Art. 46. Processed data: server log files (see 2.1).

3.3 Resend

Email delivery for messages submitted via the contact form. AVV / DPA in place. Processed data: name, email address, topic, message body.

3.4 Plausible Insights OÜ

Audience measurement. Hosted in Estonia (EU). See section 2.3 for full details. DPA in place, no cookies.

4. Fonts and media

This website uses no Google Fonts and no external font CDNs. The font used (Inter) is served locally from our hosting (Vercel, EU region). No connection to Google or other font vendors is initiated when you open the page.

5. Cookies and similar technologies

We use only the strictly necessary storage of UI preferences in your browser's localStorage (for example, the dismiss state of our notice banner). No personal data is stored and no data is transmitted to third parties. Consent under § 25(2)(2) TTDSG is not required.

6. Your rights

You have, at any time, the right to:

• Access to your stored data (Art. 15 GDPR)
• Rectification of inaccurate data (Art. 16 GDPR)
• Erasure of your data (Art. 17 GDPR)
• Restriction of processing (Art. 18 GDPR)
• Data portability (Art. 20 GDPR)
• Object to processing based on Art. 6(1)(f) GDPR (Art. 21 GDPR)
• Withdraw a granted consent with effect for the future (Art. 7(3) GDPR)

Email us at kontakt@halfsquare.de.

7. Right to lodge a complaint

You have the right to lodge a complaint with a data protection supervisory authority. The competent authority for us is:

Berliner Beauftragte für Datenschutz und Informationsfreiheit
Friedrichstr. 219, 10969 Berlin, Germany
datenschutz-berlin.de

8. Updates to this policy

This privacy policy is currently in force. As our website and services evolve, or if legal or regulatory requirements change, we may need to amend it. The current version is always available at this URL.