Privacy Policy

1 — Overview

We take the protection of your personal data seriously. This Privacy Policy explains what happens to your data when you visit this website.

In short: this website sets no cookies and runs no tracking scripts in your browser. We do not profile visitors, and we do not share your data with third parties for marketing purposes. For audience measurement we analyse aggregated server log data only. Beyond that, we process only what you choose to send us by email or tell us by phone.

2 — Controller

The controller responsible for data processing on this website within the meaning of the General Data Protection Regulation (GDPR) is:

TWELVE DEGREES BELOW UG (haftungsbeschränkt)

c/o IP-Management #11692
Ludwig-Erhard-Straße 18
20459 Hamburg
Germany
Email: hello@twelvebelow.app
Phone: +49 156 79828617

We have not appointed a Data Protection Officer, as we are not legally required to do so.

3 — Hosting and Server Log Files

This website is hosted by:

Netlify, Inc., 512 2nd Street, Suite 200, San Francisco, CA 94107, USA

Our domain is registered with IONOS SE, Elgendorfer Str. 57, 56410 Montabaur, Germany.

When you access this website, our hosting provider’s servers automatically record information that your browser transmits. This includes:

• ·Browser type and version
• ·Operating system used
• ·Referrer URL (the page you visited previously)
• ·Date and time of the server request
• ·IP address

This data is not merged with other data sources and is not used to identify you personally. It is processed solely to deliver the website reliably and to detect and defend against technical faults and attacks. Netlify delivers our website through a global content delivery network, which means the content is served from the server location closest to you.

Legal basis: Art. 6(1)(f) GDPR — our legitimate interest in the secure, stable and functional provision of our website.

Retention: Retention is governed by the retention periods of our hosting provider Netlify, see netlify.com/privacy.

Audience measurement: We use Netlify Web Analytics to understand how our website is used, in aggregate form. The analysis is carried out entirely on the server side, based on the server log files described above. No script runs in your browser, no cookies are set, and no information is stored on or read from your device. The metrics measured are pageviews, approximate visitor locations, pages visited, referring websites and resources that could not be found. IP addresses are used to determine the number of distinct visitors; they are not combined into user profiles and are not used to identify individuals.

Legal basis: Art. 6(1)(f) GDPR — our legitimate interest in a privacy-preserving, aggregated understanding of how our website is used. No consent under § 25 TDDDG is required, since no information is stored on or retrieved from your device. You may object to this processing under Art. 21 GDPR (see section 10).

Transfer to third countries: Netlify is based in the United States, and data may be processed there or in other countries in which Netlify operates servers. For these transfers Netlify relies on the EU Standard Contractual Clauses adopted by the European Commission pursuant to Art. 46(2)(c) GDPR (Implementing Decision (EU) 2021/914). Netlify may engage sub-processors to deliver the service and is contractually required to place equivalent data protection obligations on them. Further information is available at netlify.com/privacy.

We have concluded a data processing agreement (Art. 28 GDPR) with Netlify.

4 — Cookies

This website does not set any cookies. We do not use analytics, tracking, advertising or profiling cookies, and we do not embed third-party content that sets such cookies. For this reason, no consent banner is required.

5 — Contacting Us

If you write to us at hello@twelvebelow.app, we process the data contained in your message — your email address, your name if you provide it, and the content of your enquiry — in order to handle your request.

If you contact us by telephone, we process your phone number and the content of the call for the same purposes and on the same legal bases. We do not record calls.

Legal basis: Art. 6(1)(b) GDPR where your enquiry relates to a contract or pre-contractual measures; otherwise Art. 6(1)(f) GDPR, our legitimate interest in responding to enquiries addressed to us.

Retention: We delete enquiries once they have been fully dealt with, unless statutory retention periods require us to keep them longer. Business correspondence may be subject to retention periods of up to ten years under German commercial and tax law.

Our business email is operated using Google Workspace, provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. A data processing agreement is in place. Data may be transferred to servers outside the European Union; for such transfers Google relies on the EU Standard Contractual Clauses and its certification under the EU–US Data Privacy Framework.

6 — Postal Address and Mail Handling

We use the services of IMPRESSUM-PRIVATSCHUTZ GmbH, Ludwig-Erhard-Str. 18, 20459 Hamburg, Germany, to receive and handle our post. This provider supplies a secure and reliable postal address for our project, used among other places in our Legal Notice and in this Privacy Policy. In handling our post, the provider processes the sender and recipient names and addresses shown on letters sent to us.

Legal basis: Art. 6(1)(f) GDPR — our legitimate interest in a reliable business address for correspondence.

We have concluded a data processing agreement with Impressum-Privatschutz. Further information about data protection at IMPRESSUM-PRIVATSCHUTZ GmbH is available at impressum-privatschutz.de/datenschutzerklaerung.

7 — Data Transfers to Third Countries

Personal data may be transferred to the United States in connection with the hosting of this website (section 3) and the operation of our business email (section 5). These transfers are safeguarded by the EU Standard Contractual Clauses and, where applicable, by the recipients’ certification under the EU–US Data Privacy Framework. We do not transfer personal data to any other third countries.

Please note that, despite these safeguards, US authorities may under certain circumstances have access rights to data stored in the United States, and the level of protection may not correspond in every respect to that within the European Union.

8 — No Automated Decision-Making

We do not use automated decision-making, including profiling, within the meaning of Art. 22 GDPR.

9 — Your Rights

Under the GDPR you have the following rights in relation to your personal data:

• ·Right of access (Art. 15 GDPR): to obtain confirmation as to whether we process your data and to receive a copy of it
• ·Right to rectification (Art. 16 GDPR): to have inaccurate data corrected
• ·Right to erasure (Art. 17 GDPR): to have your data deleted, provided no legal retention obligation applies
• ·Right to restriction of processing (Art. 18 GDPR)
• ·Right to data portability (Art. 20 GDPR): to receive your data in a structured, commonly used, machine-readable format
• ·Right to withdraw consent (Art. 7(3) GDPR): where processing is based on your consent, you may withdraw it at any time with effect for the future
• ·Right to lodge a complaint (Art. 77 GDPR): with a data protection supervisory authority

To exercise any of these rights, simply email us at hello@twelvebelow.app.

The supervisory authority responsible for us is:

Der Hamburgische Beauftragte für Datenschutz und Informationsfreiheit
Ludwig-Erhard-Str. 22, 20459 Hamburg, Germany
datenschutz-hamburg.de

10 — Right to Object under Art. 21 GDPR

You have the right to object at any time, on grounds relating to your particular situation, to the processing of personal data concerning you which is carried out on the basis of Art. 6(1)(f) GDPR.

If you object, we will no longer process your personal data unless we can demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms, or unless the processing serves to establish, exercise or defend legal claims.

To object, simply email us at hello@twelvebelow.app.

11 — Children

This website is not directed at children. We do not knowingly collect personal data from children under 16. If you believe a child has sent us personal data, please contact us and we will delete it.

12 — Data Security

All connections to this website are encrypted using TLS/SSL, recognisable by the “https://” prefix and the lock icon in your browser’s address bar. We apply appropriate technical and organisational measures to protect your data against unauthorised access, loss and misuse.

13 — Changes to This Privacy Policy

We may update this Privacy Policy to reflect changes to our website or to legal requirements. The version published on this page always applies. The date at the top shows when it was last revised.