Skip to content
H&BSoftware Studios
Legal

Privacy policy

Controller

The controller within the meaning of the General Data Protection Regulation (GDPR) is:

H&B Software Studios UG (haftungsbeschränkt)
Ludwig-Kenter-Straße 57
57078 Siegen, Germany
Email:contact@hb-studios.de

For any privacy-related matter you can reach us directly atprivacy@hb-studios.de. We have not appointed a data protection officer, as the legal requirements for doing so do not apply to us.

The essentials at a glance

  • This website sets no cookies — neither for tracking nor for any other purpose. No cookie banner is therefore required.
  • No third-party services are embedded: no external CDNs, fonts, maps or analytics providers. All resources are served from our own servers.
  • The website and its analytics run onour own infrastructure in Germany — without an external hosting provider.
  • The only disclosure to a service provider: we use Fastmail foremail (including contact form enquiries) — details below.

Hosting and server log files

We operate this website on our own servers in Germany. When you visit the website, our server automatically processes the following data in server log files:

  • IP address of the requesting device
  • Date and time of access
  • Requested page or file and HTTP status code
  • Amount of data transferred
  • Previously visited page (referrer), where transmitted
  • Browser type and operating system (user agent)

This processing serves to ensure reliable operation, analyse errors and defend against attacks. The legal basis is our legitimate interest in the security and stability of the website (Art. 6 (1) (f) GDPR). Log files are deleted after 7 days at the latest. Where data must be retained as evidence following a security incident, it is excluded from deletion until the incident has been fully resolved.

To defend against attacks we use automated abuse detection, which analyses the log files for attack patterns and temporarily blocks conspicuous IP addresses (Art. 6 (1) (f) GDPR).

Analytics (Plausible)

For reach measurement we use the open-source software Plausible Analytics (Community Edition) — self-hosted on our own infrastructure in Germany. No data is passed to third parties.

Plausible works without cookies and stores nothing on your device; Section 25 of the German TDDDG therefore does not apply. Your IP address and user agent are processed only transiently to derive a short-lived pseudonym using a random value that changes daily — the IP address itself is not stored. Recognising you across several days or devices is thereby ruled out; no user profiles are created.

Only aggregated statistics are evaluated:

  • Pages visited and origin of the visit (referrer)
  • Browser type, operating system and device category
  • Country of origin (derived from the IP address without storing it)

The legal basis is our legitimate interest in understanding how our website is used and improving it (Art. 6 (1) (f) GDPR). If you prefer not to be counted, set the localStorage entryplausible_ignore to "true" in your browser — our analytics script is then disabled for your browser.

Contact form and email contact

If you use our contact form or write to us by email, we process the details you provide (name, company, email address, optionally a phone number, and your message) solely to handle and respond to your enquiry.

The legal basis is Art. 6 (1) (b) GDPR where your enquiry is aimed at entering into or preparing a contract, otherwise the consent you give when submitting the form (Art. 6 (1) (a) GDPR) or our legitimate interest in answering enquiries (Art. 6 (1) (f) GDPR).

Form data is not stored on our server; it is passed on directly by email to our mailbox. To protect against automated abuse we limit the number of requests per IP address; for this purpose the IP address is held briefly (for a maximum of 10 minutes) in memory and is logged only in the event of irregularities (e.g. spam attempts).

We delete enquiries and the related correspondence6 months after the matter has been concluded, unless statutory retention obligations apply (for instance where the enquiry leads to a business relationship) and you have not consented to longer storage.

Email service provider (third-country transfer)

For our email traffic — including enquiries submitted via the contact form — we use the Fastmail service (Fastmail Pty Ltd, Melbourne, Australia). Processing takes place on servers in the United States; this constitutes a transfer to a third country within the meaning of Art. 44 et seq. GDPR.

Appropriate safeguards are provided by the Standard Contractual Clauses adopted by the EU Commission (Art. 46 (2) (c) GDPR), which form part of Fastmail's Data Protection Agreement (available atfastmail.com/policies/dpa). Content you send us by email or via the form is encrypted in transit.

Data security

We take technical and organisational measures in accordance with Art. 32 GDPR to protect your data against loss, manipulation and unauthorised access, and we improve these measures continuously. They include, among others:

  • TLS encryption of all connections throughout (HTTPS)
  • Minimal, hardened systems with strict network access rules
  • Prompt security updates for all components
  • Regular backups with integrity checks
  • Access to systems and data restricted to authorised persons

Your rights

As a data subject you have the following rights:

  • Access to the data stored about you (Art. 15 GDPR)
  • Rectification of inaccurate data (Art. 16 GDPR)
  • Erasure of your data (Art. 17 GDPR)
  • Restriction of processing (Art. 18 GDPR)
  • Data portability (Art. 20 GDPR)
  • Withdrawal of consent you have given, with effect for the future (Art. 7 (3) GDPR)

You also have the right to object, on grounds relating to your particular situation, at any time to the processing of data concerning you that is carried out on the basis of Art. 6 (1) (f) GDPR (Art. 21 GDPR).

To exercise your rights, an informal email toprivacy@hb-studios.de is sufficient.

Right to lodge a complaint

If you believe that the processing of your data infringes data protection law, you have the right to lodge a complaint with a supervisory authority (Art. 77 GDPR) — for instance at your place of residence or with the authority responsible for our registered office: Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen, Kavalleriestraße 2–4, 40213 Düsseldorf, Germany,ldi.nrw.de.

No automated decision-making

No automated decision-making, including profiling (Art. 22 GDPR), takes place.

Data processing for customers

For customers of H&B Workspace we offer a data processing agreement (DPA) in accordance with Art. 28 GDPR. Data processing within the product is governed by the contractual documents and described there separately.

Version and changes

This privacy policy is dated 5 July 2026. We will amend it whenever our services or the legal requirements change; the current version is always available on this page.