This is an English translation of the German privacy notice. The German text is the source version. This does not limit any mandatory information or transparency rights under applicable data-protection law.

Privacy Policy

§ 1 Controller

The controller within the meaning of the General Data Protection Regulation (GDPR) is:

Thomas Dimashki
Thomas Dimashki Digital Services
c/o Autorenglück #74480
Albert-Einstein-Straße 47
02977 Hoyerswerda
Deutschland

Email: contact@selixweb.io

§ 2 Data Protection Contact

For questions about data protection or to exercise your data subject rights, please contact: contact@selixweb.io

§ 3 Hosting and Infrastructure

3.1 Supabase (Authentication, Database)

We use the services of Supabase Pte. Ltd., Singapore, for user authentication and data storage. Account and application data are primarily stored in Germany.

Purpose: User authentication, data storage
Legal basis: Art. 6(1)(b) GDPR (performance of a contract)
Data categories: Account data (email address, name), authentication data (login timestamps, tokens), application data (usage-related data in the course of performing the contract)
Recipient: Supabase Pte. Ltd.
Transfer to a third country: Despite primary storage in Germany, Supabase and service providers engaged by Supabase may also process data in third countries, for example in the course of support. Standard Contractual Clauses (SCCs) pursuant to Art. 46(2)(c) GDPR are used for these data transfers.
Retention period: For the duration of the contractual relationship; after the contract ends, deletion in accordance with our retention policy (see § 12)

3.2 Cloudflare (CDN, DNS, Turnstile)

We use the services of Cloudflare Inc., USA, for content delivery, DNS resolution, DDoS protection and bot protection (Cloudflare Turnstile).

Purpose: Content delivery, DDoS protection, bot protection
Legal basis: Art. 6(1)(f) GDPR (legitimate interest in the security and performance of our website)
Data categories: IP addresses, HTTP headers, request data (transient processing)
Recipient: Cloudflare Inc.
Transfer to a third country: USA — on the basis of Standard Contractual Clauses (SCCs) and the EU-US Data Privacy Framework
Retention period: Transient processing; log data is stored for a maximum of 24 hours

3.3 Contact and Expression of Interest

When you contact us via our contact form, by email or via the expression of interest form (Letter of Intent), the data you submit is processed and stored for the purpose of handling your enquiry.

Purpose: Handling of contact enquiries and expressions of interest, steps at the request of the data subject prior to entering into a contract
Legal basis: Art. 6(1)(b) GDPR (steps taken at the request of the data subject prior to entering into a contract) or, for general enquiries, Art. 6(1)(f) GDPR (legitimate interest in responding to contact enquiries)
Data categories: Name, email address, telephone number (if provided), message content; for expressions of interest additionally: company data, desired plan, billing period
Retention period: 6 months after handling of the enquiry is completed (see § 12); where the enquiry leads to a contractual relationship, for the duration of the contract plus statutory retention periods

3.4 Registration and Account Creation

When you register for a customer account, we collect the data required to create the account. Authentication is handled via Supabase (see 3.1).

Purpose: Account creation, authentication, provision of the customer dashboard
Legal basis: Art. 6(1)(b) GDPR (performance of a contract)
Data categories: Email address, name, password (hashed), login timestamps, IP address at login
Retention period: For the duration of the contractual relationship; account data is permanently removed 30 days after account deletion (see § 12)

3.5 Hostman (Web Hosting)

To host our web application, we use Hostman (HOSTMAN LTD). The hosting servers we use are located in Germany.

Purpose: Provision and secure operation of the web application
Legal basis: Art. 6(1)(f) GDPR (legitimate interest in the availability and security of our website)
Data categories: IP addresses, HTTP headers and request data transmitted when the web application is accessed
Recipient: HOSTMAN LTD
Retention period: According to the respective processing purpose and the retention and deletion criteria described in § 12

3.6 Amazon Web Services (File Storage)

To store files, we use Amazon Web Services (AWS). The files are stored in Germany.

Purpose: Storage of files uploaded during onboarding and of expression of interest and contract documents
Legal basis: Art. 6(1)(b) GDPR (steps at the request of the data subject prior to entering into a contract, and performance of a contract)
Data categories: Uploaded files and documents, including the personal data they contain
Recipient: Amazon Web Services EMEA SARL
Transfer to a third country: Despite storage in Germany, access from the USA cannot be ruled out — on the basis of the EU-US Data Privacy Framework and Standard Contractual Clauses (SCCs)
Retention period: According to the respective processing purpose and the retention and deletion criteria described in § 12

§ 4 Payment Processing

4.1 Stripe

To process payments for our subscription services, we use the payment service provider Stripe Inc., USA.

Purpose: Processing payments for subscription services
Legal basis: Art. 6(1)(b) GDPR (performance of a contract)
Data categories: Payment data (credit card number or bank account details — these are processed exclusively by Stripe), billing address, transaction history
Recipient: Stripe Inc.
Transfer to a third country: USA — on the basis of Standard Contractual Clauses (SCCs) and the EU-US Data Privacy Framework
Retention period: Transaction data is stored pursuant to § 147 AO for the duration of the tax-law retention periods (8–10 years, see § 12)

§ 5 Web Analytics

5.1 Umami (EU)

We use Umami Cloud, a privacy-friendly web analytics service of Umami Software, Inc., USA. The analytics data is stored in the European Union.

Purpose: Collection of anonymised website usage statistics without personal identification
Legal basis: Art. 6(1)(f) GDPR (legitimate interest in analysing website usage)
Data categories: Anonymised page views, referrers, device types. In our configuration, Umami sets no analytics cookies and stores no directly identifying user identifiers. Technical connection data may be processed temporarily on the server side when a page is accessed. No cross-site tracking takes place.
Recipient: Umami Software, Inc.
Transfer to a third country: Despite storage in the EU, access from the USA cannot be ruled out — on the basis of Standard Contractual Clauses (SCCs)
Retention period: 24 months
Note: Umami is loaded without prior consent, as no data requiring consent is processed.

5.2 Google Analytics 4 (GA4)

We use Google Analytics 4, a web analytics service of Google LLC, USA.

Purpose: Website usage analysis, conversion tracking
Legal basis: Art. 6(1)(a) GDPR (consent via a consent management platform)
Data categories: Page views, session data, IP address (automatically anonymised server-side)
Recipient: Google LLC
Transfer to a third country: USA — on the basis of Standard Contractual Clauses (SCCs) and the EU-US Data Privacy Framework
Retention period: 26 months
Note: Google Analytics is loaded only after consent has been given via our consent management platform (CCM19). Without consent, GA4 does not collect any data.

6.1 CCM19

We use the consent management platform CCM19 of Papoo Software & Media GmbH, Germany, to manage cookie consents pursuant to § 25 TDDDG.

Purpose: Management and documentation of cookie consents pursuant to § 25 TDDDG
Legal basis: Art. 6(1)(c) GDPR in conjunction with the obligations to demonstrate consent, in particular Art. 7(1) GDPR; storing information in, or accessing information stored in, terminal equipment is additionally subject to the requirements of § 25 TDDDG.
Data categories: Consent decisions, consent ID, timestamps
Recipient: Papoo Software & Media GmbH
Transfer to a third country: None (hosted in Germany)
Retention period: For as long as the respective consent remains valid

§ 7 Cookies and Storage Technologies

7.1 Necessary Cookies (Essential)

The following cookies are technically necessary to operate the website and are set without consent:

Cookie	Purpose	Retention period
Session cookies	Maintaining the user session	End of session
CSRF token	Protection against cross-site request forgery	End of session
CCM19 consent cookie	Storing your consent decisions	12 months

The following cookies are set only after consent has been given via CCM19:

Cookie	Provider	Purpose	Retention period
`_ga`	Google LLC	Distinguishing users in GA4	2 years
`_ga_*`	Google LLC	Storing session state in GA4	2 years

7.3 Umami

Umami sets no cookies and stores no data on the user's device.

§ 8 Transactional Emails

8.1 Migadu

To send transactional emails (confirmations, notifications), we use the email service Migadu, Switzerland.

Purpose: Sending transactional emails (order confirmations, account notifications)
Legal basis: Art. 6(1)(b) GDPR (performance of a contract)
Data categories: Email addresses, email content
Recipient: Migadu
Transfer to a third country: Switzerland — adequacy decision of the European Commission pursuant to Art. 45(1) GDPR; hosting in the EU
Retention period: In accordance with our email retention policy

§ 9 Transfers to Third Countries

Where a transfer is based on Standard Contractual Clauses pursuant to Art. 46(2)(c) GDPR, information on the safeguards used and, where legally permissible, a copy of the relevant Standard Contractual Clauses can be requested at contact@selixweb.io. Where a transfer is based on an adequacy decision under Art. 45 GDPR, this is stated for the respective processing.

§ 10 Data Subject Rights

You have the following rights with regard to your personal data:

Right of access (Art. 15 GDPR)
Right to rectification (Art. 16 GDPR)
Right to erasure (Art. 17 GDPR)
Right to restriction of processing (Art. 18 GDPR)
Right to data portability (Art. 20 GDPR)
Right to object (Art. 21 GDPR)
Right to withdraw consent given, with effect for the future (Art. 7(3) GDPR)

To exercise your rights, please contact: contact@selixweb.io

Where we process personal data on the basis of our legitimate interest (Art. 6(1)(f) GDPR), you have the right to object to such processing at any time on grounds relating to your particular situation. We will then no longer process your personal data unless we can demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms, or the processing serves the establishment, exercise or defence of legal claims.

Please send your objection to: contact@selixweb.io

§ 11 Right to Lodge a Complaint with a Supervisory Authority

Under Art. 77 GDPR, you have the right to lodge a complaint with a data protection supervisory authority, in particular in the Member State of your habitual residence, your place of work or the place of the alleged infringement. The supervisory authority competent for us is the Sächsische Datenschutz- und Transparenzbeauftragte (SDTB).

§ 12 Retention Periods and Deletion

We store personal data only for as long as is necessary for the respective processing purposes or as statutory retention periods apply. The following periods apply in detail:

Data category	Retention period	Legal basis
Contact enquiries	6 months after handling is completed	Art. 6(1)(f) GDPR
Account data after deletion	30 days	Art. 6(1)(f) GDPR
Invoices and accounting records	8 years	§ 147 Abs. 1 Nr. 4, Abs. 3 AO
Annual financial statements	10 years	§ 147 Abs. 1 Nr. 1, Abs. 3 AO
Business correspondence	6 years	§ 147 Abs. 1 Nr. 2–3, Abs. 3 AO
Server logs	7 days	Art. 6(1)(f) GDPR
GA4 analytics data	26 months	Art. 6(1)(a) GDPR
Umami analytics data	24 months	Art. 6(1)(f) GDPR

After the respective retention period expires, the data is routinely deleted unless it is still required for the performance of the contract or for compliance with statutory retention obligations.

§ 13 Automated Decision-Making

No automated decision-making, including profiling, within the meaning of Art. 22 GDPR takes place.

§ 14 Necessity of Providing Personal Data

The provision of certain personal data is required to conclude and perform a contract with us (e.g. email address, payment data). Without this data, we cannot conclude the contract or provide the contractually owed services. The specific data required is indicated by the respective input fields during registration and contract conclusion.