Privacy Policy

1. Controller

The controller within the meaning of the General Data Protection Regulation (GDPR) is:

2. Hosting

This website is hosted on a DigitalOcean droplet located in the Frankfurt am Main (EU) region. Static pages are served by a Caddy web server. When you access the website, connection data (IP address, date/time, requested URL, referrer, browser identifier) is logged in server log files. This data is used exclusively to ensure stable operation and to detect misuse, and is deleted after no more than 30 days.

Legal basis: Art. 6 (1)(f) GDPR (legitimate interest in secure and stable operation).

DigitalOcean, LLC, 101 Avenue of the Americas, New York, NY 10013, USA. The server infrastructure is physically located in Frankfurt, EU. DigitalOcean is certified under the EU–US Data Privacy Framework. More information: digitalocean.com/legal/privacy-policy.

3. Fonts

This website uses only self-hosted fonts (Inter, included via @fontsource-variable/inter). No external font services such as the Google Fonts CDN are used. Therefore, when the fonts are loaded, no connections to third-party servers are established and no personal data (e.g. IP address) is transmitted to third parties.

4. Analytics

Where an analytics tool is used on this website, it operates exclusively in a cookieless manner (no tracking cookies, no persistent user identification). Only aggregated, anonymised page-view statistics are collected. A cookie consent banner is therefore not required. The analytics data does not allow any individual to be identified.

5. Contact form

When you send us an enquiry via the contact form, your details from the form — including the contact data you provide — are stored by us for the purpose of processing your enquiry and in case of follow-up questions. We do not pass this data on without your consent.

Purpose and legal basis

The purpose of processing is to handle your contact enquiry and to initiate a contractual relationship. The legal basis is Art. 6 (1)(b) GDPR (performance of a contract or pre-contractual measures) and Art. 6 (1)(f) GDPR (legitimate interest in responding to business enquiries).

Email delivery: Mailjet

Data submitted via the contact form is forwarded for notification purposes to the transactional email service Mailjet (Mailjet SAS, 13–13 bis rue de l'Aubrac, 75012 Paris, France; part of the Sinch Group). We have concluded a Data Processing Agreement with Mailjet. Servers are located in the European Union. More information: mailjet.com/legal/privacy-policy.

Spam protection

Spam protection is provided exclusively by technical measures on our own server: a hidden honeypot field and server-side rate limiting. No third-party CAPTCHA services are used; no personal data is processed by external services for this purpose. Legal basis: Art. 6 (1)(f) GDPR (legitimate interest in protection against spam and abuse).

Retention period

Data entered in the contact form is stored for as long as necessary to process the enquiry and for any resulting business relationship. If the enquiry does not result in a contract, the data is deleted after no more than three years, provided no statutory retention obligations require otherwise.

6. Your rights as a data subject

Under the GDPR you have the following rights:

• →Access (Art. 15 GDPR): You have the right to obtain information about the personal data we hold about you.
• →Rectification (Art. 16 GDPR): You may request correction of inaccurate or completion of incomplete data.
• →Erasure (Art. 17 GDPR): You may request deletion of your personal data, provided no statutory retention obligations apply.
• →Restriction (Art. 18 GDPR): You may request that processing be restricted.
• →Data portability (Art. 20 GDPR): You have the right to receive your data in a structured, machine-readable format.
• →Objection (Art. 21 GDPR): You may object at any time to processing of your data that is based on Art. 6 (1)(f) GDPR.
• →Withdrawal of consent (Art. 7 (3) GDPR): You may withdraw consent you have given at any time with effect for the future.

To exercise your rights, please contact us by email: info@blockcurators.com.

7. Right to lodge a complaint with a supervisory authority

Without prejudice to any other administrative or judicial remedy, you have the right to lodge a complaint with a data protection supervisory authority if you believe that the processing of your personal data infringes the GDPR. The competent supervisory authority for Bavaria is: