Privacy policy
What this site processes, and what it does not.
Controller
Gelhaus Solutions, proprietor Enno Gelhaus, Eichenwald 3, 49624 Löningen, Germany. Email: egelhaus@ennogelhaus.de
The short version
For visitors who are not signed in, this site stores nothing on your device: no cookies, no localStorage entries, nothing left behind to clear. No fonts from someone else's server, no embedded video, no tracking pixels, no ad networks, and no analytics company.
One thing is counted: which pages get read. That is done by software we run ourselves, on our own infrastructure, and it is described under Visit measurement below. It is the only reason your browser contacts a host other than this one.
There is no consent banner because Sec. 25 TDDDG requires consent for storing or reading information on your device, and this site does neither. That is a property of how it is built rather than a statement of intent: pages are rendered to files in advance and served without a session, and the counting script is a copy served from this site with the identifier it would otherwise store on your device removed.
Server log files
When a page is requested, the reverse proxy in front of this site and the web server itself record technical data: IP address, time of the request, the URL requested, the HTTP status code, the amount of data transferred, the referrer and the user agent.
The purpose is operating the service, diagnosing faults and defending against attacks. The legal basis is Art. 6(1)(f) GDPR; the legitimate interest is keeping the service working and secure. This data is not combined with other sources and is not used to build profiles. The log files are kept for at most 30 days and then deleted.
This site is informational. There is no registration here, no ordering process and no payment handling.
Visit measurement
Which pages are read, and roughly where readers arrive from. The software is Rybbit, running on our own infrastructure at web-anal.egelhaus.de. No analytics provider is involved, nothing is sent to one, and nothing leaves that infrastructure.
This covers these marketing pages only. It is not in any product, it is not in the hosted services, and it forms no part of what we process on a customer's behalf — each service says what it processes in its own annex to the data processing agreement.
A page view records the path you opened and its query string, the referring URL where there is one, the page title, your screen size and browser language, and the browser, operating system and device type derived from the user agent. Clicking a link that leads off this site records that too. As with any request, your IP address reaches that server; it is used there to derive the country, the region and the city with approximate coordinates, and a server-side session identifier; the address itself is not stored, and it is neither published nor passed on. Visit data is kept for 24 months and then deleted.
What does not happen: nothing is written to or read from your device, no identifier follows you from one visit to the next, nothing is joined up across the two sites, and no profile is built. This is worth stating precisely, because it is not the software's default. The published Rybbit script writes a persistent visitor ID into your browser's localStorage on every page load; the copy served here has that removed before it is deployed, which is the reason this page can still say there is nothing to consent to. The changed script, and the tool that makes it from Rybbit's own, are published under the GNU AGPL at github.com/Gelhaus-Solutions/rybbit-script.
The legal basis is Art. 6(1)(f) GDPR. The legitimate interest is knowing which pages are read and which are not, in order to decide what to keep and what to rewrite. You can object at any time under Art. 21 GDPR, and an informal email is enough. If you would rather not write to anyone, setting disable-rybbit in this site's localStorage — localStorage.setItem('disable-rybbit', '1') in your browser console — stops the counting in that browser.
Status pages
Gelhaus Solutions runs the status page at status.postiz.com on its own server at IONOS in Germany. Visiting it is measured with the same self-hosted Rybbit setup described above, with no identifier and nothing stored on your device. If you subscribe to updates, your email address is stored to send them and is deleted when you unsubscribe, which every message lets you do. Legal basis for the subscription is your consent, Art. 6(1)(a) GDPR, which you can withdraw at any time; for the measurement it is Art. 6(1)(f) as above. Server logs with IP addresses are kept for at most 14 days for security.
Getting in touch
Writing by email, using the channels listed, or using the form on the contact page transmits whatever that message contains: the name and address you give, the subject, the message itself and the time it arrived. It is processed in order to deal with the enquiry and to enter into or perform a contract (Art. 6(1)(b) or (f) GDPR) and kept for as long as that requires, or for as long as a statutory retention period applies.
A message sent through the form is stored on this server as well as being forwarded by email. The address it was sent from is stored with it, and the form counts how many messages one address sends in an hour, in order to detect and limit abuse of it (Art. 6(1)(f) GDPR). Stored messages are deleted after 180 days unless the enquiry is still open or a statutory retention period applies. Writing by email instead avoids the copy on this server altogether.
Vulnerability reports
Anyone reporting a vulnerability transmits whatever personal information they choose to include. It is processed in order to handle and coordinate the report and, where wanted and agreed, to credit the reporter in a published advisory. The legal basis is Art. 6(1)(f) GDPR.
Self-hosted applications
Applications from the GHub line that you run on your own infrastructure process data on your systems, under your control. We are not the controller for that processing and have no access to it. Where a hosted version on GPlatform is used, a separate agreement covers it.
Hosting and email
The site runs on our own infrastructure in Germany. There is no data processing agreement with an external hosting provider for delivering these pages.
Email is separate. The mailboxes for this domain run on our own mail server, on a virtual server we rent from IONOS SE, Elgendorfer Straße 57, 56410 Montabaur, Germany. IONOS provides the machine and the network and processes the mail only as our hosting provider; it does not operate the mailboxes. This server hands anything sent through the contact form to our mail server for delivery, and anything written directly to the address above arrives there too.
Your rights
You have the right of access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20), and a right to object to processing based on legitimate interests (Art. 21 GDPR). An informal email to the address above is enough.
You also have the right to lodge a complaint with a supervisory authority. The competent authority here is Die Landesbeauftragte für den Datenschutz Niedersachsen, Prinzenstraße 5, 30159 Hannover.