Privacy policy

The controller responsible for data processing on this website is:

Jan Lennart Sander
BASE BUILD
Kreutzigerstraße 24
10247 Berlin
Germany

Phone: +49 151 54011611
Email: studio@base-build.io

This website is hosted via the Cloudflare Pages service of Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107, USA, and delivered through Cloudflare’s global network of data centres. When you visit the website, Cloudflare automatically processes information that your browser transmits: your IP address, the date and time of access, the page requested, the referrer URL, browser type and version, and operating system. These data are required to deliver the website and keep it technically secure. The legal basis is my legitimate interest in providing the website securely and reliably (Art. 6(1)(f) GDPR).

I do not analyse these server log data myself, do not combine them with other data sources and do not use them to identify individual visitors. According to Cloudflare, it stores them only for as long as necessary for the purposes stated; Cloudflare does not specify a fixed period.

Cloudflare acts as my processor; the data processing agreement under Art. 28 GDPR (Cloudflare Customer Data Processing Addendum) forms part of my contract with Cloudflare. Cloudflare, Inc. is certified under the EU-US Data Privacy Framework; transfers to the USA are therefore covered by an adequacy decision of the European Commission (Art. 45 GDPR). Should this certification lapse, the contract provides for the EU Standard Contractual Clauses (Art. 46(2)(c) GDPR). Further information can be found in Cloudflare’s privacy policy at www.cloudflare.com/privacypolicy/.

Cloudflare’s Network Error Logging feature is active for this website. Your browser is instructed, for up to seven days, to send a technical error report to Cloudflare (a.nel.cloudflare.com) if a network error occurs while loading the website, provided your browser supports this feature. Such a report contains, among other things, the address requested and the type and time of the error. According to Cloudflare, your IP address is only used to roughly determine the network operator, country and region, and is not stored. The legal basis is my legitimate interest in error-free delivery of the website (Art. 6(1)(f) GDPR).

All components of this website are stored on and delivered by the website itself: the fonts Roboto Flex, Manrope, Playfair Display and Geist Mono, the scripts for animation and scrolling, the 3D graphics of the two games, and all images and videos.

No content is loaded from third parties. In particular, no connection is made to Google Fonts or to any external content delivery network.

This website does not set any cookies. No analytics, advertising or tracking services are integrated, such as Google Analytics, the Meta Pixel or similar.

If you play one of the two little games, the website saves your best time in your browser’s storage (local storage) so that it can be shown to you next time. This entry is only created by playing, contains no personal information, never leaves your device and is not linked to any other data. No consent is required for this under Section 25(2) No. 2 of the German Telecommunications Digital Services Data Protection Act (TDDDG), as storage is strictly necessary for the function you have expressly used. You can delete the entry at any time by clearing the stored site data for this website in your browser.

If you switch the language at the top of the first screen (English or German), the website also saves your choice in your browser’s local storage, so that the site appears in your language on your next visit. To reload the page after switching, it additionally sets a short marker in session storage, which it deletes again straight after reloading. These entries likewise contain no personal information, never leave your device and are permitted without consent under Section 25(2) No. 2 TDDDG, as they are strictly necessary for the function you have chosen. You can delete them in the same way.

Your browser also remembers technical instructions from my server: the requirement for an encrypted connection (HSTS) and the error reporting setting described in section 02. This website does not use a cookie banner.

If you send me an enquiry via the form, I process your name, email address and message and, if you provide them, your phone number, your company and the topics you select (Website, Software, Other), as well as the fact that you have consented to the processing. To protect against automatically sent enquiries (spam), the form also transmits two technical details: the content of a field that is invisible to humans and is meant to stay empty, and the time between loading the page and submitting the form.

The processing serves to handle your enquiry and any follow-up questions. The legal basis is your consent, which you give via the checkbox in the form (Art. 6(1)(a) GDPR). Where your enquiry is aimed at concluding a contract with me, I also process the data to take steps prior to entering into a contract (Art. 6(1)(b) GDPR). You can withdraw your consent at any time with effect for the future, for example by email to studio@base-build.io; this does not affect the lawfulness of processing carried out before the withdrawal.

After you submit the form, your details are transferred in encrypted form to a server function of this website at Cloudflare (see section 02). This function does not store the data but passes them on to Cloudflare’s email service (see section 06), which delivers them as an email to my mailbox studio@base-build.io. Your email address is entered as the reply-to address so that I can answer you directly. My mailbox is operated by IONOS SE, Elgendorfer Str. 57, 56410 Montabaur, Germany, which acts as my processor (Art. 28 GDPR).

I keep your details for three months after your enquiry has been concluded if it does not lead to a project, and delete them at the latest when you withdraw your consent. If a project does result, I store the data for the duration of the business relationship and beyond that where statutory retention obligations require it.

To deliver form enquiries, I use the email service (Email Service) of Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107, USA, the same provider that hosts this website (see section 02). Cloudflare delivers your form details as an email to my mailbox and automatically checks the message for malware, phishing and spam. Cloudflare does not store the content of the email permanently. For delivery, Cloudflare logs technical metadata, in particular the sender and recipient addresses, the subject line (which contains your name), time, delivery status and technical check results including a spam rating, and retains these log data for up to 31 days.

Cloudflare also acts as my processor for this; the same data processing agreement and the same safeguards for transfers to the USA apply as for hosting (EU-US Data Privacy Framework, alternatively the EU Standard Contractual Clauses; see section 02).

If you contact me by email or phone, I process your details to handle your request (Art. 6(1)(b) GDPR, or for general enquiries Art. 6(1)(f) GDPR; my legitimate interest is responding to your enquiry). Emails to me are stored in my mailbox at IONOS SE (see section 05). I delete your details as soon as they are no longer needed to handle your request and no statutory retention obligations prevent this.

On this website I also link to WhatsApp in several places, for example with “Let’s Connect”, “Prefer WhatsApp?” and in the footer. Only when you click one of these links does WhatsApp or the page wa.me open, and only then is data transferred to WhatsApp; before that, your browser makes no connection to WhatsApp. If the form cannot be sent for some reason, I offer you the option to “Send via WhatsApp”; this link already contains your form details (name, company, topics, message, email address and phone number) as prepared text. Clicking it takes you to WhatsApp, even if you do not then send the message. The provider for users in Europe is WhatsApp Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland. If you write to me via WhatsApp, WhatsApp processes in particular your phone number, your profile name and communication metadata; according to WhatsApp, message content is end-to-end encrypted. Data may also be transferred to companies of the Meta group in the USA, which state that they are certified under the EU-US Data Privacy Framework. I use your messages only to answer your enquiry. The legal basis is Art. 6(1)(b) GDPR, or for general enquiries Art. 6(1)(f) GDPR (my legitimate interest is responding to your enquiry). If you would rather not use WhatsApp, you can reach me just as well via the form, by email or by phone. Further information can be found in WhatsApp’s privacy notice at www.whatsapp.com/legal/privacy-policy-eea.

The following parties receive personal data when you use this website:

• Cloudflare, Inc., USA: hosting and delivery of the website, form function and delivery of form enquiries by email, error reports (processor; EU-US Data Privacy Framework, alternatively EU Standard Contractual Clauses)
• IONOS SE, Germany: email mailbox (processor)
• WhatsApp Ireland Limited, Ireland, and companies of the Meta group in the USA: only if you click a WhatsApp link

For security reasons, this website uses SSL/TLS encryption. Data you submit via the form cannot be read by third parties; the encrypted connection ends at my host Cloudflare, which processes the data as my processor. You can recognise an encrypted connection by the padlock symbol in your browser and by “https://” in the address bar.

You are under no legal or contractual obligation to provide me with personal data. Without your name, email address, message and consent, however, I cannot process your form enquiry. No automated decision-making, including profiling (Art. 22 GDPR), takes place.

You have the following rights with regard to your personal data:

• Right of access (Art. 15 GDPR)
• Right to rectification (Art. 16 GDPR)
• Right to erasure (Art. 17 GDPR)
• Right to restriction of processing (Art. 18 GDPR)
• Right to data portability (Art. 20 GDPR)
• Right to withdraw consent with effect for the future (Art. 7(3) GDPR)

Right to object: Where I process data on the basis of Art. 6(1)(f) GDPR, you have the right to object to the processing at any time on grounds relating to your particular situation (Art. 21 GDPR).

An informal message to studio@base-build.io is enough to exercise these rights.

You have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR). The authority responsible for me is:

Berliner Beauftragte für Datenschutz und Informationsfreiheit (Berlin Commissioner for Data Protection and Freedom of Information)
Alt-Moabit 59–61
10555 Berlin
Germany
Email: mailbox@datenschutz-berlin.de

I will update this policy if I develop the website further or if legal requirements change. The version published on this website at any given time applies.