This policy explains how we process your personal data and what rights you have.
1. Controller and contact
The controller responsible for processing your personal data is:
IT Surmann LLC
1209 Mountain Road Pl NE, Ste N
Albuquerque, NM 87110, USA
thomas (at) it-surmann (dot) com
If you have questions about data protection or wish to exercise your rights, you can contact us using these details.
2. Processing of personal data
Hosting, security and backups
Our application and database are hosted by netcup on servers in Austria. We process technical access data, including IP address, timestamp, requested URL, browser information and error messages, to provide the service, resolve errors and prevent abuse. Our legitimate interest is to operate a secure and reliable service (Article 6(1)(f) GDPR). Logs are deleted after seven days. In the event of a specific security incident, we retain the necessary entries until the incident has been resolved.
We store backups with Amazon Web Services (AWS) in Ireland (eu-west-1) for a maximum of 60 days. This processing is based on our legitimate interest in restoring data after failures (Article 6(1)(f) GDPR). We have a data processing agreement with netcup.
Session cookie
The website uses a session cookie to assign requests to a session. We use the session to recognise automated requests and support the reliable operation of the website. The cookie contains a session identifier; the assessment is stored on our server. The legal basis for processing personal data in this context is our legitimate interest in the reliable operation of the website (Article 6(1)(f) GDPR). The cookie expires when you close your browser. You can disable cookies in your browser settings, but this may affect how the website works.
Contact and email communication
If you contact us by email, we process your email address, your message and the information it contains to handle and respond to your request. Without a valid email address, we cannot reply by email.
For requests concerning a contract or steps before entering into a contract, the legal basis is Article 6(1)(b) GDPR. We handle other requests based on our legitimate interest in responding to enquiries (Article 6(1)(f) GDPR). We delete correspondence six months after the enquiry has been resolved, unless statutory retention obligations require otherwise.
Our email mailbox is provided by Namecheap, Inc. through its Private Email service on servers in the United States. Processing is governed by a data processing agreement. Transfers to the United States are covered by the EU Standard Contractual Clauses under Article 46(2)(c) GDPR. You can view these clauses in Namecheap’s Data Processing Addendum.
Website analytics with Plausible
We use the self-hosted Plausible Community Edition on our server at netcup in Austria to analyse website usage and improve our service.
We collect page views, referring websites, timestamps, browser, operating system, device type and approximate location derived from the IP address. Plausible does not use cookies or local storage. The IP address and browser identifier are processed to generate a website-specific identifier that changes daily, but they are not stored in their original form in the analytics database. The random value used to generate the identifier is replaced daily, and the previous value is deleted. Analytics data is not sent to Plausible’s developer.
We do not send names, email addresses or user account identifiers to Plausible. We delete event and session data within 12 months. Where personal data is processed, the legal basis is our legitimate interest in analysing and improving our service while minimising the use of personal data (Article 6(1)(f) GDPR). Technical server logs are covered under "Hosting, security and backups".
3. Your data protection rights
Subject to the applicable legal requirements, you have the following rights:
- Access to your personal data and a copy of it (Article 15 GDPR).
- Correction of inaccurate data and completion of incomplete data (Article 16 GDPR).
- Deletion of your data (Article 17 GDPR).
- Restriction of processing (Article 18 GDPR).
- Receipt of the data you provided in a commonly used, machine-readable format and transmission to another controller, where processing is automated and based on your consent or a contract (Article 20 GDPR).
Right to object (Article 21 GDPR): Where we process your data based on legitimate interests, you may object at any time on grounds relating to your particular situation. We will then stop processing the data unless we demonstrate compelling legitimate grounds that override your interests and rights, or need the data to establish, exercise or defend legal claims. You may object to processing for direct marketing at any time without giving a reason. We will then stop processing your data for that purpose.
You may withdraw your consent at any time with effect for the future. Withdrawal does not affect the lawfulness of processing carried out before you withdrew your consent.
To exercise your rights, you can contact us using the details in Section 1.
If you believe that the processing of your data violates the GDPR, you may lodge a complaint with a data protection supervisory authority, particularly in the EU Member State of your habitual residence, place of work or the alleged infringement (Article 77 GDPR).