Privacy Policy

1.Controller

The controller responsible for data processing on this website is:

Email

[email protected]

2.Your rights

You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and to object to processing (Art. 21). You may withdraw any consent given at any time with effect for the future.

You also have the right to lodge a complaint with a data protection supervisory authority. Competent authority: Bayerisches Landesamt für Datenschutzaufsicht (BayLDA), Promenade 27, 91522 Ansbach.

3.Hosting and server log files

This website is hosted by an external provider: Amazon Web Services, provided by Amazon Web Services EMEA SARL, in a data centre in the Frankfurt region (eu-central-1), Germany. The service used there is [PLACEHOLDER: exact hosting service designation]. When you access the site, the server automatically records log files (IP address, date/time, page requested, browser type, operating system). The legal basis is our legitimate interest in secure, stable operation (Art. 6(1)(f) GDPR). A data processing agreement (Art. 28 GDPR) is in place with the provider.

If a fault occurs on the server while a page is being produced, we record an error report in addition to the server log files. No involvement from your browser is needed for this; what such a report contains is described under "Error monitoring with Sentry".

4.Cookies

Without your consent this website sets two cookies. The first is called NEXT_LOCALE and stores the language you chose, so the site greets you in the same language on your next visit. It is technically necessary to operate the website and is therefore set without consent under § 25(2) TDDDG. It holds no identifier that could be used to recognise a person.

A second cookie stores your answer to the cookie notice. It is called dw_analytics_consent, holds nothing but the value "granted" or "denied", expires after 180 days, and is likewise permitted without consent under § 25(2) TDDDG: its only purpose is to remember your decision so we do not ask again.

Analytics cookies are set only after you consent (see "Web analytics with PostHog"). If you decline, or do not answer, no analytics tool is loaded and no such cookie is set. We set no marketing or advertising cookies. Our error monitoring sets no cookie either and stores nothing on your device (see "Error monitoring with Sentry"). Social media plugins and embedded third-party content that would open a connection on page load are not included either.

5.Web analytics with PostHog

To understand which pages get read and where visitors drop off, we use PostHog. The provider is PostHog, Inc.; data is processed on servers in the European Union (eu.i.posthog.com). We collect the pages viewed, how far down a page you read and how long you stay on it, an approximate location derived from the truncated IP address, device and browser information, and basic loading speed measurements.

This processing rests solely on your consent (Art. 6(1)(a) GDPR, § 25(1) TDDDG). Before you consent, PostHog is not loaded at all: no connection is opened, no cookie is set and no event is sent. Session recording is disabled.

Once you consent, PostHog sets cookies of its own (names beginning with ph_) holding a random device identifier and the current session. PostHog's automatic capture of every click and form interaction ("autocapture") and its heatmaps are switched off. What we record instead is a small, fixed list of interactions we have placed by hand: which section of a longer page you reach, which filter you choose, which of our buttons opens a contact or access request form, and whether sending such a form succeeded. In each case we record only that it happened, never what you type: search terms are removed from the addresses we transmit, and form contents are never handed to analytics at all. What you write to us in the contact form is processed solely as described under "Contact form".

You may withdraw your consent at any time with effect for the future. The "Cookie settings" link in the footer of every page brings the notice back, so withdrawing is as easy as consenting (Art. 7(3) GDPR). Capture stops immediately, without you having to reload the page. A data processing agreement under Art. 28 GDPR is in place with PostHog.

6.Error monitoring with Sentry

So that we notice and fix faults on this website, we record the errors that occur while it is being used. Such an error report holds the error message, the technical path through the program code (stack trace), the address of the page you were on, the version of your browser and of your operating system, and the technical steps immediately preceding the fault within that page.

We do this with Sentry, software we run ourselves: the error reports are processed on a server we operate in a data centre in Frankfurt am Main (eu-central-1), the same location this website runs in. Sentry is therefore not a third-party service and not a processor; nothing is transmitted to the maker of the software. No transfer to a third country takes place.

Session recordings, keystrokes and form contents are not recorded. Error reports from your browser reach us through this website's own address and are passed on from there to our Sentry installation, so no IP address is stored with the error report. That your IP address reaches our server anyway when you open this website is described under "Hosting and server log files".

Error monitoring sets no cookie. It stores nothing on your device and reads nothing from it, so it needs no consent under § 25(1) TDDDG and runs without a cookie notice.

The legal basis is our legitimate interest in a secure and functioning website (Art. 6(1)(f) GDPR), the same basis as for the server log files. You may object to this processing (Art. 21 GDPR, see "Your rights"). We delete error reports after [PLACEHOLDER: error report retention period].

7.Contact form

When you write to us through the contact form we process your name, email address and message in order to answer you. The legal basis is Art. 6(1)(b) or (f) GDPR. The message is delivered to us as email and is not stored in a database belonging to this website; it is deleted once it is no longer needed and no retention obligation applies.

8.Access requests and newsletter

You can send us an access request with your email address, or subscribe to our newsletter "The Ledger". Both use double opt-in: after you submit, you receive a confirmation email, and only when you click it are you added to the list. Until then we store no more than what is needed to send that one confirmation.

The legal basis is your consent (Art. 6(1)(a) GDPR). You may withdraw it at any time with effect for the future: through the unsubscribe link in every email, or informally to the address above. We use Brevo to send and manage these lists (see "Recipients and processors"). If you open one of these emails or click a link in it, Brevo may record that, so that we can see which content gets read. This measurement rests on the same consent and ends when you unsubscribe.

9.Job applications

Applications for our open roles reach us by email; there is no application form on this website. We process the documents you send solely to run the application process (Art. 6(1)(b) GDPR, § 26 BDSG) and delete them no later than six months after it concludes, unless you have agreed to us keeping them longer.

10.Recipients and processors

To operate this website we use carefully selected providers: a hosting provider (Amazon Web Services, provided by Amazon Web Services EMEA SARL, in a data centre in the Frankfurt region (eu-central-1), Germany), PostHog, Inc. for web analytics (only after consent, processed in the EU), and Brevo (operated by Brevo GmbH, Berlin) to send confirmation and notification emails and to manage access requests and the newsletter. The editorial content of this site (blog, job postings) is maintained in a content management system we operate ourselves, and we run our error monitoring ourselves as well; both of them run at the same hosting provider. No further service provider stands behind either of them.

Data processing agreements pursuant to Art. 28 GDPR are in place with all of them. Transfers to third countries only take place where appropriate safeguards under Art. 44 et seq. GDPR exist.

11.Retention

We process personal data only for as long as necessary for the respective purposes or as required by statutory retention periods.