1. Controller and scope

The controller for personal data processed on needbuilt.de is:

Felix Köhler
Needbuilt - Software & Apps
Sole proprietor
Sydneystraße 18
22297 Hamburg
Germany

Email: hello@needbuilt.de
Privacy enquiries: privacy@needbuilt.de

This policy covers visits to the public website and contact with me. The apps and watch faces presented here have additional privacy information for installation and use. Information about a product purchase is provided with the relevant offer and purchase process.

2. Providing and protecting the website

Cloudflare is used to deliver the website. Technical connection and access data is processed, particularly your IP address, access time, requested address, browser and device information, and error and security information.

This processing enables content delivery, troubleshooting and protection against attacks and misuse. The legal basis is Article 6(1)(f) GDPR. My legitimate interest is to provide a reliable and secure website.

Recipients include Cloudflare as the infrastructure and security provider and the subprocessors needed for the relevant services. Cloudflare, Inc. is located at 101 Townsend Street, San Francisco, CA 94107, USA. International processing is described in section 6.

Transmitting necessary connection data is required to retrieve the website. Technical data is processed for as long as required for delivery, troubleshooting and protection. Retention of error and security records depends on the technical purpose, investigation of specific incidents and legal duties. Once the purpose no longer applies, the data is deleted or processed without identifying individuals. Information needed for specific legal claims may be retained until the matter is concluded or the relevant periods expire.

3. Contact by email and phone

When you email me, I process the information it contains, particularly your sender address, any name you provide, your message, attachments and technical email information. During a phone call I process the information you provide and, where transmitted, your telephone number. I use this information to handle and answer your enquiry. Product-related enquiries may be assigned to the relevant project of mine.

For contractual enquiries and steps taken at your request before entering into a contract, the legal basis is Article 6(1)(b) GDPR. Other enquiries are handled under Article 6(1)(f) GDPR; my legitimate interest is communicating with interested people and handling feedback.

Zoho Mail in the European mail environment is used to receive, store and answer emails. Zoho and the companies involved in providing the mail service receive the necessary data. Telecommunications providers are involved in transmitting phone connections. International processing by cloud and mail providers is described in section 6.

Ordinary enquiries are deleted once fully handled and no longer needed for follow-up. Messages subject to legal retention duties or needed for specific legal claims are retained for that purpose until the relevant period expires or the necessary legal matter is concluded. The applicable legal bases are Article 6(1)(c) or (f) GDPR. Provider deletion may involve technical cleanup and backup cycles; backup copies serve recovery purposes and are distinct from ongoing handling.

Contacting me is voluntary. Without suitable contact details I may be unable to reply. Please provide only the information needed for your enquiry.

4. Contact form

The contact form processes your name, email address, selected product and a message of up to 5,000 characters. The details are checked on the server and sent to my mailbox through Zoho Mail. The purposes, legal bases and mailbox retention rules described in section 3 also apply to these enquiries. Providing the details is voluntary; they are required to process and reply to your enquiry.

Cloudflare Turnstile is loaded when you open the form to protect it against automated messages. Cloudflare processes your IP address and technical browser and connection information for this purpose. The server checks the validity, origin and single use of the verification token. This protection serves the security purposes described in section 2. Further information: Cloudflare Turnstile.

Pseudonymised verification data and a random request identifier are processed in a Cloudflare D1 database in the EU to limit abuse and prevent duplicate sending. Names, email addresses and message contents are not stored in that database. Verification records expire after no more than seven days; expired records are deleted the next time the form endpoint is accessed. Your browser controls its own form autofill features.

5. Display preferences and statistical analysis

Fonts and product media are served by this website. Language, light or dark mode, motion preferences and desktop and window positions are held in the memory of the open page. The website uses no cookies or persistent localStorage or sessionStorage entries for these preferences.

Cloudflare Web Analytics is configured with the European-traffic exclusion setting to assess reach and loading performance statistically. Under this setting, the measurement script is not injected for connections routed through the European data-centre locations excluded by Cloudflare. This technical classification follows Cloudflare's connection routing and does not verify your place of residence.

Where measurement takes place, it covers page views, visits as counted by Cloudflare, pages and referrers, country, browser and device categories, and technical loading and performance values. Cloudflare describes this service as using no cookies, persistent browser storage or fingerprinting to recognise visitors. Cloudflare states that the IP address processed to transmit the data is discarded at the nearest data centre and is not stored in central RUM databases or RUM logs.

To the extent personal data is processed, I rely on Article 6(1)(f) GDPR for this statistical assessment. My legitimate interest is to assess and improve website availability and technical quality using data-minimised reports. No advertising profiles are created and measurement values are not linked to contact enquiries or app accounts.

The service documentation makes Web Analytics reports available for the previous six months. This reporting window is not a promise that all infrastructure or email data is deleted after a uniform six-month period. Aggregated access reports may be reviewed in the protected administration area by period, page, device category and country. That administrative retrieval creates no additional measurement in your browser; its reports contain no visitor lists with names, email addresses or IP addresses.

Further information: Cloudflare Web Analytics and data collection and European exclusion.

6. Providers and international processing

Providers used for hosting, security and email, and the companies needed to provide their services, process data to the extent required. Their privacy information additionally explains their own processing and subprocessors.

Cloudflare operates international infrastructure; processing outside the European Economic Area, particularly in the United States, is possible. Cloudflare describes the EU-US Data Privacy Framework for relevant transfers to certified US entities. For other relevant transfers or as a contractual fallback, Cloudflare describes EU Standard Contractual Clauses and necessary supplementary safeguards. See Cloudflare's privacy policy, Data Processing Addendum and subprocessors.

Mail data in the Zoho environment used here is stored in the European data centre. Zoho states that authorised staff in India may access data, particularly to provide technical support. Zoho describes Standard Contractual Clauses between the entities involved and supplementary safeguards for such transfers. Details are provided in Zoho's privacy policy, information about regions and access, and service-specific subprocessor directory.

You may request further information about the safeguards applicable in a specific case, or a copy, at privacy@needbuilt.de.

7. Products and external links

needbuilt.de presents apps, watch faces and other projects of mine. The general public product presentation currently processes no orders or payments. Product installation, use, test access and purchases have their own applicable information.

Following an external link, for example to an app store, opens that provider's website. The provider processes data under its own privacy information. A purchase or licensing service used solely within an app does not automatically become part of this website.

8. Your rights

Subject to the legal conditions, you may request access, rectification, erasure and restriction of processing. You also have a right to data portability where its conditions are met.

Right to object: Where processing is based on Article 6(1)(f) GDPR, you may object on grounds relating to your particular situation.

You may withdraw any consent you have given at any time with future effect. Withdrawal does not affect the lawfulness of earlier processing. To exercise your rights, contact privacy@needbuilt.de.

You may complain to a data protection supervisory authority, particularly at your habitual residence, workplace or the place of the alleged infringement. The authority for Hamburg is the Hamburg Commissioner for Data Protection and Freedom of Information.

This website does not make solely automated decisions with legal or similarly significant effects, including corresponding profiling, within the meaning of Article 22 GDPR.