Skip to content
H&B Software Studios
Legal

Privacy policy

Controller

The controller within the meaning of the General Data Protection Regulation (GDPR) is:

H&B Software Studios UG (haftungsbeschränkt)
Ludwig-Kenter-Straße 57
57078 Siegen, Germany
Email: contact@hb-studios.de

For any privacy-related matter you can reach us directly at privacy@hb-studios.de. We have not appointed a data protection officer, as the legal requirements for doing so do not apply to us.

The essentials at a glance

  • This website sets no cookies — neither for tracking nor for any other purpose. No cookie banner is therefore required.
  • No third-party services are embedded: no external CDNs, fonts, maps or analytics providers. All resources are served from our own servers.
  • The website and its analytics run on our own infrastructure in Germany — without an external hosting provider.
  • The only disclosure to a service provider: we use Fastmail for email (including contact form enquiries) — details below.

Hosting and server log files

We operate this website on our own servers in Germany. When you visit the website, our server automatically processes the following data in server log files:

  • IP address of the requesting device
  • Date and time of access
  • Requested page or file and HTTP status code
  • Amount of data transferred
  • Previously visited page (referrer), where transmitted
  • Browser type and operating system (user agent)

This processing serves to ensure reliable operation, analyse errors and defend against attacks. The legal basis is our legitimate interest in the security and stability of the website (Art. 6 (1) (f) GDPR). Log files are deleted after 7 days at the latest. Where data must be retained as evidence following a security incident, it is excluded from deletion until the incident has been fully resolved.

To defend against attacks we use automated abuse detection, which analyses the log files for attack patterns and temporarily blocks conspicuous IP addresses (Art. 6 (1) (f) GDPR).

Analytics (Plausible)

For reach measurement we use the open-source software Plausible Analytics (Community Edition) — self-hosted on our own infrastructure in Germany. No data is passed to third parties.

Plausible works without cookies and stores nothing on your device; Section 25 of the German TDDDG therefore does not apply. Your IP address and user agent are processed only transiently to derive a short-lived pseudonym using a random value that changes daily — the IP address itself is not stored. Recognising you across several days or devices is thereby ruled out; no user profiles are created.

Only aggregated statistics are evaluated:

  • Pages visited and origin of the visit (referrer)
  • Browser type, operating system and device category
  • Country of origin (derived from the IP address without storing it)

The legal basis is our legitimate interest in understanding how our website is used and improving it (Art. 6 (1) (f) GDPR). If you prefer not to be counted, set the localStorage entry plausible_ignore to "true" in your browser — our analytics script is then disabled for your browser.

Contact form and email contact

If you use our contact form or write to us by email, we process the details you provide (name, company, email address, optionally a phone number, and your message) to handle and respond to your enquiry, as well as — as described under “Information about our services” — to send you further information about our own, similar services.

The legal basis is Art. 6 (1) (b) GDPR where your enquiry is aimed at entering into or preparing a contract, otherwise the consent you give when submitting the form (Art. 6 (1) (a) GDPR) or our legitimate interest in answering enquiries (Art. 6 (1) (f) GDPR).

Form data is not stored on our server; it is passed on directly by email to our mailbox. To protect against automated abuse we limit the number of requests per IP address; for this purpose the IP address is held briefly (for a maximum of 10 minutes) in memory and is logged only in the event of irregularities (e.g. spam attempts).

We delete enquiries and the related correspondence 6 months after the matter has been concluded, unless statutory retention obligations apply (for instance where the enquiry leads to a business relationship) and you have not consented to longer storage.

H&B Workspace trial access

If you request a free trial via our form, we process the details you provide (name, company, email address, optionally a phone number, and the email addresses of the trial users you name) to provide the trial environment, manage the waiting list and send the related notifications (e.g. activation link, reminder before the trial ends, as well as — as described under “Information about our services” — pricing and offer information). Please only name additional trial users with their agreement.

The legal basis is Art. 6 (1) (b) GDPR (pre-contractual measures taken at your request). Protection against automated abuse (limiting requests per IP address) works as described for the contact form.

We store the process data (request, waiting list, trial status) on our own servers in Germany and delete it 6 months after the process has been concluded. For the trial users you name we create accounts in the trial environment; the trial environment itself also runs exclusively on our infrastructure in Germany. After the trial ends, the trial accounts are deactivated; we keep the trial content available for export for 14 days and then delete it completely (see § 9 of our terms of service).

Information about our services

If you give us your email address via the contact form or the trial request form, we also use it — within the context of that enquiry or trial — to send you further information about our own, similar services, such as pricing information, offers, or a note that your trial is ending soon and how things can continue. Under German law (§ 7 (3) UWG), this is permitted without separate consent, because the address was collected in connection with an enquiry or service with us and the information relates exclusively to our own, similar services. The legal basis is our legitimate interest in direct marketing (Art. 6 (1) (f) GDPR, Recital 47 GDPR) in conjunction with § 7 (3) UWG.

You can object to this use of your email address at any time, without giving reasons and free of charge — for example via the unsubscribe link in the respective email, or informally at contact@hb-studios.de. Your actual enquiry or trial access is not affected by this.

Email service provider (third-country transfer)

For our email traffic — including enquiries submitted via the contact form — we use the Fastmail service (Fastmail Pty Ltd, Melbourne, Australia). Processing takes place on servers in the United States; this constitutes a transfer to a third country within the meaning of Art. 44 et seq. GDPR.

Appropriate safeguards are provided by the Standard Contractual Clauses adopted by the EU Commission (Art. 46 (2) (c) GDPR), which form part of Fastmail’s Data Protection Agreement (available at fastmail.com/policies/dpa). Content you send us by email or via the form is encrypted in transit.

Data security

We take technical and organisational measures in accordance with Art. 32 GDPR to protect your data against loss, manipulation and unauthorised access, and we improve these measures continuously. They include, among others:

  • TLS encryption of all connections throughout (HTTPS)
  • Minimal, hardened systems with strict network access rules
  • Prompt security updates for all components
  • Regular backups with integrity checks
  • Access to systems and data restricted to authorised persons

Your rights

As a data subject you have the following rights:

  • Access to the data stored about you (Art. 15 GDPR)
  • Rectification of inaccurate data (Art. 16 GDPR)
  • Erasure of your data (Art. 17 GDPR)
  • Restriction of processing (Art. 18 GDPR)
  • Data portability (Art. 20 GDPR)
  • Withdrawal of consent you have given, with effect for the future (Art. 7 (3) GDPR)

You also have the right to object, on grounds relating to your particular situation, at any time to the processing of data concerning you that is carried out on the basis of Art. 6 (1) (f) GDPR (Art. 21 GDPR).

To exercise your rights, an informal email to privacy@hb-studios.de is sufficient.

Right to lodge a complaint

If you believe that the processing of your data infringes data protection law, you have the right to lodge a complaint with a supervisory authority (Art. 77 GDPR) — for instance at your place of residence or with the authority responsible for our registered office: Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen, Kavalleriestraße 2–4, 40213 Düsseldorf, Germany, ldi.nrw.de.

No automated decision-making

No automated decision-making, including profiling (Art. 22 GDPR), takes place.

Data processing for customers

For customers of H&B Workspace we offer a data processing agreement (DPA) in accordance with Art. 28 GDPR. Data processing within the product is governed by the contractual documents and described there separately.

Version and changes

This privacy policy is dated 21 July 2026. We will amend it whenever our services or the legal requirements change; the current version is always available on this page.