As of October 2026

Privacy policy

This English version is provided for convenience. Only the German version is legally binding.

This policy describes which personal data are processed when you visit this website. The website is purely informational: there are no forms, no user accounts, no cookies, no tracking and no analytics or advertising services. Fonts and all scripts are delivered together with the website; your browser loads nothing from third parties.

1. Controller

We have not designated a data protection officer, as there is no legal obligation to do so.

2. Hosting and server log files

Hosting and email are run for us by Kinsoft GmbH, Auf der Lai 18, 54317 Gusterath, Germany, as our service provider; it processes the data on our behalf. The website sits in Kinsoft GmbH’s account with Vercel Inc., 440 N Barranca Avenue #4133, Covina, CA 91723, USA.

When a page is accessed, Vercel processes technically necessary connection data: IP address, date and time of access, the address requested, referrer, browser type and operating system. These data are needed to deliver the website and to protect it against misuse and attacks. We choose the language of the website based on your browser’s language setting; we do not store this information ourselves.

The legal basis is Art. 6(1)(f) GDPR. Our legitimate interest lies in providing the website securely and reliably. Vercel processes the connection data as a further processor engaged by Kinsoft GmbH, under Vercel’s Data Processing Addendum, which applies to Kinsoft GmbH’s Vercel account. Where Vercel processes personal usage data and metadata of its own services, Vercel is itself the controller for that data and processes it under its own privacy notice.

Providing these data is neither a statutory nor a contractual requirement. Without them, however, the website cannot be displayed to you.

The connection data are stored only for as long as is necessary to deliver the website and keep it secure, and are then deleted; Vercel does not specify a fixed period. We do not use them for analytics or advertising.

3. Transfer to the USA

Vercel may process data in the USA. Vercel is certified under the EU-U.S. Data Privacy Framework. The transfer is based on the European Commission’s adequacy decision of 10 July 2023 (Art. 45 GDPR). In addition, Vercel’s Data Processing Addendum provides for the EU standard contractual clauses pursuant to Art. 46(2)(c) GDPR. For details, please see Vercel’s privacy policy.

4. Contact by email

If you send us an email, we process your address, your name (if provided) and the content of the message in order to respond to your enquiry. The legal basis is Art. 6(1)(b) GDPR where your enquiry relates to a contract, otherwise Art. 6(1)(f) GDPR (legitimate interest in responding to enquiries). Providing this information is voluntary; without your email address, however, we cannot reply to you. We delete the messages once they have been dealt with, unless statutory retention periods prevent this.

Our mailbox is run for us by Kinsoft GmbH in its Google Workspace. Google Workspace is provided by Google Cloud EMEA Limited, 70 Sir John Rogerson’s Quay, Dublin 2, Ireland. Google processes the emails as a further processor engaged by Kinsoft GmbH, under Google’s Cloud Data Processing Addendum.

Google’s sub-processors include Google LLC in the USA, so data may also be transferred to the USA. Google LLC is certified under the EU-U.S. Data Privacy Framework. The transfer is based on the European Commission’s adequacy decision of 10 July 2023 (Art. 45 GDPR).

5. Links to other websites

Where we link to websites of other providers, data are only transferred to the respective provider once you click such a link. Its privacy policy then applies.

6. Your rights

You have the following rights vis-à-vis us:

• access to the personal data stored about you (Art. 15 GDPR),
• rectification of inaccurate data (Art. 16 GDPR),
• erasure (Art. 17 GDPR) and restriction of processing (Art. 18 GDPR),
• data portability, where the conditions of Art. 20 GDPR are met.

To exercise these rights, an informal email to hello@codeandcapital.de is sufficient.

7. Right to object (Art. 21 GDPR)

Where we process your data on the basis of Art. 6(1)(f) GDPR, you have the right to object to this processing at any time on grounds relating to your particular situation. We will then no longer process the data unless we can demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms, or the processing serves the establishment, exercise or defence of legal claims. An informal email to hello@codeandcapital.de is sufficient.

8. Right to lodge a complaint

You have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR), in particular in the Member State of your habitual residence, your place of work or the place of the alleged infringement. The authority competent for us is the Landesbeauftragte für den Datenschutz und die Informationsfreiheit Rheinland-Pfalz (State Commissioner for Data Protection and Freedom of Information of Rhineland-Palatinate), Hintere Bleiche 34, 55116 Mainz, Germany, www.datenschutz.rlp.de.

9. No automated decision-making

We do not make automated decisions and do not carry out profiling.

10. Changes

We will update this policy when the website or the legal situation changes. The version published here applies.