Privacy policy

Controller

HarborBit, owner Marcel Kestner, Weichselweg 38, 21391 Reppenstedt, Germany

Email: info@harborbit.de

We have not appointed a data protection officer because the conditions for a mandatory appointment under Art. 37 GDPR and Section 38 of the German Federal Data Protection Act (BDSG) are not met. Please send any data protection questions to info@harborbit.de.

Key points at a glance

• No cookies, nothing on your device: Our website sets no cookies and stores nothing in your browser’s storage, including local storage and session storage.
• No third-party content: When you open a page, our website loads nothing from other servers – no external fonts, no analytics or advertising services and no embedded videos or maps.
• Audience measurement as totals only: We count page views on our own server, without IP addresses, without browser identifiers and without identifiers derived from them.
• Project enquiries: We use what you send us through the contact form only to reply to you; we delete the entry after 12 months.
• No advertising: We do not sell data, do not use it for advertising and do not make automated decisions about people.

Visiting the website: server log files

When you open a page, your browser sends technical information to our server. Our upstream web server logs the following for each request: IP address, date and time, requested address, HTTP status code, amount of data transferred, referring page (referrer), browser identifier (user agent) with browser and operating system details, and the other request headers, such as the preferred language. We also log technical messages from our application (such as errors); these contain no IP addresses and no email addresses, but may contain the requested address.

Purpose: Delivering the website, detecting and defending against attacks and misuse, troubleshooting.

Legal basis: Art. 6 (1) (f) GDPR. Our legitimate interest is secure and uninterrupted operation. We do not analyse the log files for statistics or advertising and do not combine them with other data. Only the people who maintain our server have access.

Retention: We automatically delete access logs and technical messages from the application after 7 days at the latest. Entries relating to a specific attack are kept until the incident has been resolved.

Recipients: our hosting provider as processor (section “Hosting and backups”) and, in the event of detected attacks, CrowdSec (section “Automated attack defence”).

Necessity: Without this information, your browser cannot retrieve our pages.

Automated attack defence

The security software CrowdSec automatically analyses our server logs (web server and mail server) on our own server. If it detects a typical attack pattern – for example mass requests for non-existent or protected addresses, or repeated failed logins on the mail server – our server automatically blocks the IP address concerned for 4 hours. Ordinary page views do not trigger a block.

For each block, our server transmits the IP address, the time, the name of the detected attack pattern and an identifier of our server to CrowdSec, 20 rue Maurice Arnoux, 92120 Montrouge, France. CrowdSec compiles a list of attacking IP addresses from the reports of many servers, which we also use for our defence, and processes the data for this purpose as an independent controller. Details: CrowdSec privacy policy.

Purpose: Protecting our website and our mail server against attacks.

Legal basis: Art. 6 (1) (f) GDPR. Our legitimate interest, and that of the other operators of the block list, is the security of our systems (Recital 49 GDPR).

Retention: The block ends after 4 hours. We keep the record of the block on our server only for as long as we need it to defend against repeated attacks and to investigate an incident.

Audience measurement without identifiers

We count on our own server how often our pages are viewed. For this, we only evaluate information that your browser sends with every request anyway: the requested address, the referring page and the browser identifier. We use the browser identifier only to filter out automated requests; it is not stored.

For the count we store neither your IP address nor your browser identifier nor any identifier derived from them, not even a hash. We set no cookies for this, store nothing on your device and run no script in your browser for it. Individual visitors cannot be recognised in the counts.

Purpose: We want to know which pages are used and how visitors find us, so that we can improve our offering and our marketing channels.

Legal basis: Art. 6 (1) (f) GDPR for the brief processing when a page is requested. Our legitimate interest is measuring the use of our offering. The stored counts contain no personal data.

We delete the counts after 25 months. Only daily counts with these attributes are stored:

• page viewed,
• domain of the referring page, for example “google.com”, without the rest of the address,
• campaign parameters from the requested address (utm_source, utm_medium, utm_campaign),
• day of the visit.

Hourly totals for the operations report

For our daily operations report, we additionally count per hour and per page how many page views and how many entries there were. An entry is a visit that does not come from a page on harborbit.de. Only page views from a browser are counted, no automated requests. We recognise whether a request comes from a browser and whether it is an entry from headers your browser sends with every request (request type, browser identifier, referring page); we evaluate them only at the moment of the request and do not store them.

Only these totals are stored, without IP address, browser identifier or referring page. We set no cookies for this. We delete the totals after 14 days.

Legal basis: Art. 6 (1) (f) GDPR for the brief processing when a page is requested; our legitimate interest is the reliable operation of the website. The stored totals contain no personal data.

Measuring enquiries

So that we know how many visits lead to a project enquiry, we record on our server when an enquiry was sent and how many service areas were selected. We do not store IP addresses, browser identifiers or identifiers derived from them for this. We evaluate this data only as totals.

Legal basis: Art. 6 (1) (f) GDPR. Our legitimate interest is measuring and improving the effectiveness of our website. The measurement takes place exclusively on our server, without access to your device and without disclosure to third parties.

Retention: 25 months, then automatic deletion.

Sending emails and contacting us by email

We send and receive our emails via our own mail server on servers of Hostinger International Ltd., 61 Lordou Vironos Street, 6023 Larnaca, Cyprus. The provider processes the data in the European Union as our processor (Art. 28 GDPR).

If you write to us, we process your email address, your name if you provide it, and the content of your message in order to reply to you.

Mail server logs: For delivery, troubleshooting and abuse protection, our mail server logs for each connection the IP address of the delivering server or mail program, date and time, sender and recipient address and the result of the delivery or login. After repeated failed logins or typical attack patterns, our server automatically blocks the IP address concerned for a few hours. The legal basis is Art. 6 (1) (f) GDPR; our legitimate interest is secure mail operation (Art. 32 GDPR). We delete the logs after 7 days.

Legal basis: Art. 6 (1) (b) GDPR if your message concerns a contract or its initiation; otherwise Art. 6 (1) (f) GDPR, our legitimate interest being to answer your enquiry.

Retention: Messages relating to a contract for 6 years from the end of the calendar year (commercial and business letters, Section 147 (1) nos. 2 and 3, (3) and (4) of the German Fiscal Code); we delete other enquiries 12 months after the last message.

Project enquiries via our contact form

If you write to us using the form on the Start a project page, we process your name, your email address and your message and, if you provide them, your company, the selected service areas and the preferred start. From the page on which you fill in the form, we take the language so that we can reply to you in that language. Name, email address and message are mandatory.

We store the enquiry in our database and forward it by email to our mailbox. If forwarding fails or an unusual number of enquiries arrive, we receive an internal notification at most once per hour with a reference number, but without name, email address or message.

Abuse protection: To prevent anyone from using the form automatically to send mass messages, we create a check value (hash) from your IP address and a secret key that is regenerated daily, store it with the enquiry and accept at most five enquiries per check value per hour and at most 50 per day in total. We do not store the IP address itself. We delete the key after three days at the latest; after that, the check value can no longer be linked to an IP address.

Purpose: Answering your enquiry and discussing a possible project with you.

Legal basis: Art. 6 (1) (b) GDPR, because we take pre-contractual steps at your request; if your message is not aimed at a contract, Art. 6 (1) (f) GDPR, our legitimate interest being to answer your enquiry. For abuse protection, Art. 6 (1) (f) GDPR; our legitimate interest is protection against spam and overload.

Retention: We automatically delete the entry in our database 12 months after receipt. If a contract is concluded, we keep the correspondence as commercial and business letters for 6 years from the end of the calendar year (Section 147 (1) nos. 2 and 3, (3) and (4) of the German Fiscal Code); otherwise the period from the section “Sending emails and contacting us by email” applies to the forwarded email.

Recipients: our hosting provider as processor (our website and mail server run on its servers).

Necessity: Without your name, email address and message we cannot answer your enquiry. All other information is voluntary.

Hosting and backups

Our website, our mail server and our database run on servers of Hostinger International Ltd., 61 Lordou Vironos Street, 6023 Larnaca, Cyprus in a data centre in the European Union. The provider processes the data as our processor (Art. 28 GDPR).

We back up our databases daily. We delete each backup after 14 days. Deleted data may therefore persist in backups for up to 14 days. We only use backups to restore operation after an outage; afterwards we again delete all data whose retention period has expired.

Legal basis: Art. 6 (1) (f) GDPR. Our legitimate interest is the availability of our service and protection against data loss (Art. 32 GDPR).

Recipients at a glance

We only share personal data with these recipients:

• our hosting provider as processor (our website and mail server run on its servers),
• CrowdSec (Montrouge, France) for IP addresses that triggered a detected attack (section “Automated attack defence”),
• a tax advisor, if we engage one for bookkeeping; they are bound by professional secrecy and act as an independent controller,
• tax authorities, insofar as we are legally obliged to disclose data.

Transfers to countries outside the EU

We do not transfer personal data to countries outside the EU and the European Economic Area. Our website, mail server and database run in a data centre in the EU.

No automated decision-making

We do not make decisions based solely on automated processing that produce legal effects concerning you or similarly significantly affect you (Art. 22 GDPR).

Your rights

You have the right of access (Art. 15 GDPR), rectification (Art. 16 GDPR), erasure (Art. 17 GDPR), restriction of processing (Art. 18 GDPR), data portability (Art. 20 GDPR) and objection (Art. 21 GDPR, next section). You can also lodge a complaint with a supervisory authority (Art. 77 GDPR).

An informal message to info@harborbit.de is sufficient. So that we do not disclose data to unauthorised persons, we only ask for the details we need to identify you, for example the reference number of your enquiry. We reply within one month (Art. 12 (3) GDPR).

We do not base any processing on consent within the meaning of the GDPR.

Your right to object

Where we process data on the basis of Art. 6 (1) (f) GDPR, you can object at any time on grounds relating to your particular situation (Art. 21 (1) GDPR).

This concerns server log files, automated attack defence, mail server logs, audience measurement, hourly totals for the operations report, measuring enquiries, abuse protection and backups. We will then no longer process the data unless we can demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms, or the processing serves the establishment, exercise or defence of legal claims.

An informal objection to info@harborbit.de is sufficient.

Complaints to a supervisory authority

You can lodge a complaint with any data protection supervisory authority, in particular in the member state of your habitual residence, your place of work or the place of the alleged infringement (Art. 77 GDPR).

The authority responsible for us is the State Commissioner for Data Protection of Lower Saxony (Landesbeauftragte für den Datenschutz Niedersachsen), Prinzenstraße 5, 30159 Hannover, Germany, phone +49 511 120-4500, email poststelle@lfd.niedersachsen.de. You can also submit a complaint online there (in German).

Changes to this policy

If our processing changes, we update this policy beforehand. The version on this page applies; the date of the current version is shown at the top.