Privacy Policy

The controller within the meaning of the General Data Protection Regulation (GDPR) is:

Carlo Nölle

Bonner Straße 18

50677 Cologne

Germany

Email: hello@codeattack.io

Phone: +49 221 42364393

No data protection officer has been appointed, as the requirements under Art. 37 GDPR are not met.

We only process personal data to the extent necessary for the provision of our website and services. Processing is carried out exclusively for the following purposes:

– Provision and delivery of the website (hosting)

– Responding to contact inquiries

– Statistical analysis of website usage (without personal reference)

We do not sell data to third parties and do not engage in profiling.

The processing of personal data is based on the following legal grounds:

– Art. 6(1)(b) GDPR: Performance of a contract or pre-contractual measures (e.g., contact inquiries regarding our services)

– Art. 6(1)(f) GDPR: Legitimate interest (e.g., technically necessary operation of the website, abuse prevention)

We do not currently obtain consent (Art. 6(1)(a) GDPR), as we do not use any services that require consent.

Our website is hosted by Vercel Inc. (340 S Lemon Ave #4133, Walnut, CA 91789, USA).

When you visit our website, the hosting provider, acting as our processor, automatically processes technical data transmitted by your browser and writes it to server logs. This includes:

– IP address (not truncated) and approximate location derived from it

– Date and time of access

– Requested URL / page visited

– Referrer URL (previously visited page)

– Browser type and version

– Operating system

This processing is technically necessary to deliver the website. The legal basis is Art. 6(1)(f) GDPR (legitimate interest in the operation and security of the website).

We have a data processing agreement (Data Processing Addendum) with Vercel. Vercel is a US-based company. Data transfers to the USA are carried out on the basis of Standard Contractual Clauses (SCCs) pursuant to Art. 46(2)(c) GDPR and, where Vercel is certified, the EU-US Data Privacy Framework. More information: https://vercel.com/legal/privacy-policy

The content of the website (texts, pages, blog posts) is stored in a PostgreSQL database at Neon (Neon, Inc., USA; database region Frankfurt, EU). Images and logos are stored in S3-compatible object storage at Cloudflare R2 (Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107, USA; bucket in the EU jurisdiction) and delivered through our website. No personal data of website visitors is stored in either of these systems.

The hosting provider collects and stores information in so-called server log files that your browser automatically transmits. The data mentioned above under "Hosting" is stored for at most 30 days, depending on the hosting provider's plan and serves exclusively to ensure trouble-free operation.

We do not merge this data with other data sources.

When you use our contact form, the following data is collected and processed:

– Name (required)

– Email address (required)

– Company (optional)

– What the inquiry is about, a choice from our offers (optional)

– Message (required)

This data is sent to us by email and stored in our CRM system (Twenty, self-hosted in Germany) for the purpose of processing your inquiry. The email is sent through Amazon Simple Email Service (Amazon Web Services EMEA SARL, 38 Avenue John F. Kennedy, L-1855 Luxembourg; region Frankfurt, EU), acting as our processor. We have a data processing agreement with AWS; any transfer to the USA is based on the Standard Contractual Clauses pursuant to Art. 46(2)(c) GDPR and the EU-US Data Privacy Framework. Beyond that, no data is shared with third parties.

The legal basis is Art. 6(1)(b) GDPR (pre-contractual measures) and Art. 6(1)(f) GDPR (legitimate interest in responding to inquiries).

The data will be deleted once the inquiry has been fully processed and no statutory retention obligations apply.

To protect the form against automated abuse, we use Cloudflare Turnstile. See section 12 for details.

When you contact us by email, your email address and the content of the message are processed for the purpose of handling your inquiry. The legal basis is Art. 6(1)(b) GDPR or Art. 6(1)(f) GDPR.

We use Umami, a privacy-friendly open-source analytics tool that runs on our own infrastructure (self-hosted in Germany).

Umami does not collect any personal data. Specifically:

– No cookies are set

– No IP addresses are stored

– No cross-device tracking takes place

– No fingerprints are created

– No data is shared with third parties

Umami collects exclusively aggregated, anonymous usage statistics such as page views, session duration, and country of origin (based on the IP address, which is not stored).

Since no personal data is processed, neither consent nor a cookie banner is required for the use of Umami.

This website does not use cookies. No tracking cookies, analytics cookies, or marketing cookies are set. A cookie banner is therefore not required.

We use the Geist Sans and Geist Mono typefaces. These fonts are served locally with the website (self-hosted via next/font). No connections to external font servers (e.g., Google Fonts) are established. No data is transferred to third parties in this context.

As a data subject, you are entitled to the following rights under the GDPR:

– Right of access (Art. 15 GDPR): You may request information about the personal data we process.

– Right to rectification (Art. 16 GDPR): You may request the correction of inaccurate data.

– Right to erasure (Art. 17 GDPR): You may request the deletion of your data, provided no statutory retention obligations apply.

– Right to restriction of processing (Art. 18 GDPR): You may request the restriction of processing of your data.

– Right to data portability (Art. 20 GDPR): You may request that we provide your data in a machine-readable format.

– Right to object (Art. 21 GDPR): You may object to the processing of your data at any time, provided the processing is based on a legitimate interest.

To exercise your rights, contact us at: hello@codeattack.io

You also have the right to lodge a complaint with a data protection supervisory authority. The authority responsible for us is:

Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen

Postfach 20 04 44

40102 Düsseldorf

https://www.ldi.nrw.de

To protect our contact form against automated abuse (spam, bots), we use the service Cloudflare Turnstile. The provider is Cloudflare Inc., 101 Townsend St., San Francisco, CA 94107, USA.

When you submit the contact form, a connection is made to Cloudflare's servers. The following technical data is transmitted:

– IP address

– Browser type and version

– Operating system

– Referrer URL

– Time of interaction

The purpose of this processing is to distinguish between human users and automated requests (bot detection). Cloudflare Turnstile does not set persistent cookies and does not create cross-platform user profiles.

The legal basis is Art. 6(1)(f) GDPR (legitimate interest in protecting our systems against abuse).

Cloudflare is a US-based company. Data transfers to the USA are carried out on the basis of Standard Contractual Clauses (SCCs) pursuant to Art. 46(2)(c) GDPR.

More information about Cloudflare's privacy practices: https://www.cloudflare.com/privacypolicy/

This privacy policy is currently valid as of October 2026. Due to further development of our website or changes in legal or regulatory requirements, it may become necessary to update this privacy policy.