Privacy policy.

1. Data controller

The controller within the meaning of the General Data Protection Regulation (GDPR / DSGVO) and other national data protection laws is:

Steven Obst
Half Square, IT services
Schnellerstraße 91 A
12439 Berlin, Germany
Email: contact@halfsquare.de

Further mandatory information is in the imprint.

A statutory data protection officer is not required for an operation of this size. Please direct data protection questions to the controller directly.

2. Data we process on this website

2.1 Server log files

When you load any page, our hosting provider Vercel Inc. collects technical data: IP address, date and time, requested URL, transferred byte count, browser identifier, operating system, referrer. This data is retained for 30 days and used exclusively to operate the site, analyse errors and defend against attacks. Legal basis: Art. 6(1)(f) GDPR (legitimate interest in operation and security).

2.2 Contact form

When you submit the contact form, we process your name, email address, topic, and message to handle your enquiry and any follow-ups. Transmission is encrypted. Data is delivered via our email service Resend (see section 3). We retain your enquiry until handling is complete, at most six months after, unless a statutory retention obligation requires longer. Legal basis: Art. 6(1)(b) GDPR (pre-contractual measure) and Art. 6(1)(a) GDPR (consent via the checkbox).

2.3 Audience measurement with Umami

We use Umami Cloud, a service of Umami Software, Inc., 28 Geary St, Suite 650 #243, San Francisco, USA. Measurement data is stored in the EU region of Umami Cloud. Umami sets no cookies, stores no IP addresses and builds no cross-site profiles. It records aggregated data such as pages viewed, time on page, referring website, browser and device type, and country. We also count, without identifying anyone, how often the booking, email or phone links are clicked and the contact form is sent.

Legal basis: Art. 6(1)(f) GDPR (legitimate interest in statistical audience measurement and in improving our offering).

§ 25(1) TDDDG does not apply because Umami neither stores information on nor retrieves it from your device for measurement. This assessment follows the guidance of German supervisory authorities on cookieless audience measurement. If the legal situation or supervisory practice changes, we will only load Umami after explicit consent.

2.4 Appointment booking via Cal.com

For online appointment booking we use Cal.com Inc. Cal.com processes the data you submit (name, email, chosen time slot) to make the booking. A data-processing agreement is in place and EU hosting is used where available.

3. Data processors and external services

3.1 GitHub, Inc.

Source-code hosting for this website. Location: USA, with Standard Contractual Clauses pursuant to GDPR Art. 46 and supplementary technical measures. Processed data: source code, no user data.

3.2 Vercel Inc.

Build and production hosting. Data centre region: Frankfurt am Main (EU). The US parent company is covered by Standard Contractual Clauses pursuant to GDPR Art. 46. Processed data: server log files (see 2.1).

3.3 Resend

Email delivery for messages submitted via the contact form. AVV / DPA in place. Processed data: name, email address, topic, message body.

3.4 Umami Software, Inc.

Audience measurement (see section 2.3). Measurement data stored in the EU region. Provider based in the USA. Umami's data processing agreement with the EU Standard Contractual Clauses pursuant to Art. 46 GDPR applies.

4. Fonts and media

This website uses no Google Fonts and no external font CDNs. The font used (Inter) is served locally from our hosting (Vercel, EU region). No connection to Google or other font vendors is initiated when you open the page.

5. Cookies and similar technologies

We use only the strictly necessary storage of UI preferences in your browser's localStorage (for example, the dismiss state of our notice banner). No personal data is stored and no data is transmitted to third parties. Consent under § 25(2)(2) TDDDG is not required.

6. Your rights

You have, at any time, the right to:

• Access to your stored data (Art. 15 GDPR)
• Rectification of inaccurate data (Art. 16 GDPR)
• Erasure of your data (Art. 17 GDPR)
• Restriction of processing (Art. 18 GDPR)
• Data portability (Art. 20 GDPR)
• Object to processing based on Art. 6(1)(f) GDPR (Art. 21 GDPR)
• Withdraw a granted consent with effect for the future (Art. 7(3) GDPR)

Email us at contact@halfsquare.de.

7. Right to lodge a complaint

You have the right to lodge a complaint with a data protection supervisory authority. The competent authority for us is:

Berliner Beauftragte für Datenschutz und Informationsfreiheit
Friedrichstr. 219, 10969 Berlin, Germany
datenschutz-berlin.de

8. Updates to this policy

This privacy policy is currently in force. As our website and services evolve, or if legal or regulatory requirements change, we may need to amend it. The current version is always available at this URL.