Privacy notice

1. Controller

Telephone: +49 2151 8939406
Email: joshua.baums@informatik-baums.de

2. Hosting, server logs and WebAnalytics

This website is hosted by IONOS SE, Elgendorfer Straße 57, 56410 Montabaur, Germany. IONOS processes technical request data on my behalf. According to IONOS, these include referrer, requested page or file, browser type and version, operating system, device type, access time and an immediately anonymised IP address. Visitor data are retained for eight weeks. The legal basis is GDPR Article 6(1)(f); my legitimate interest is a secure, stable and usable website.

IONOS WebAnalytics is enabled by default for web hosting. According to IONOS, statistical analysis uses log data or a pixel without cookies, and IP addresses are anonymised immediately after transmission. I receive no information that allows me to identify individual visitors. Analysis supports technical improvement under GDPR Article 6(1)(f).

Sources: IONOS hosting data processing and IONOS WebAnalytics (German).

3. Password-protected development environment

While this website is operated as a development environment, HTTP Basic Authentication restricts access to unpublished material. The web server checks the credentials provided. The basis is GDPR Article 6(1)(f), with the legitimate interest of protecting unpublished content and functionality. Access may appear in the logs described in section 2.

4. Contact by form or email

If you contact me, I process information you provide, especially your name, email address, optional organisation and project details and message, to handle the inquiry and communicate further. Required form fields are marked. Do not submit passwords, credentials or special categories of personal data.

For a potential or existing contract, the basis is GDPR Article 6(1)(b). Otherwise it is Article 6(1)(f), based on my legitimate interest in handling business communication appropriately.

IONOS SE, Elgendorfer Straße 57, 56410 Montabaur, provides business email reception and management, processing messages, addresses and technical transmission data. Information is emailed to Informatik Baums, not stored in a website database. Communication is deleted after the inquiry is resolved unless legal retention duties, contractual requirements or legitimate evidence and legal-defence interests require continued retention.

5. Essential session and abuse prevention

After successful technical handoff of a form inquiry, an automatic acknowledgement is sent to the supplied address. It contains neither a copy of your message nor advertising. Depending on the inquiry, the basis is GDPR Article 6(1)(b) or (f); the legitimate interest is traceable communication. An acknowledgement does not prove final inbox delivery or personal review.

The contact form sets an essential session cookie. A CSRF token protects against unauthorised requests. The cookie is HTTP-only, transmitted only over an encrypted connection and lasts until the browser session ends. The basis is GDPR Article 6(1)(f); device storage is necessary for the requested form function under section 25(2)(2) TDDDG.

After input and session validation, before the security check and transmission, the system reserves one submission per connection for 60 seconds. It stores a SHA-256 value derived from the IP address and a timestamp, not the IP address itself. Failed security checks or transmission attempts also consume this waiting period. An hourly job removes reservations at least 24 hours old, normally within about 25 hours. Maintenance errors are logged and require operational review. The basis is GDPR Article 6(1)(f), protecting against spam and automated abuse.

Acknowledgements are limited to one per recipient within 24 hours and one overall per minute. A secret-key-derived pseudonym of the normalised email address and a timestamp are stored, not the address. Suppressed or failed attempts can trigger the same limit. Reservations are removed hourly after at least 24 hours, normally within about 25 hours. The basis is GDPR Article 6(1)(f), preventing abuse and unwanted emails. Technical failures are logged without message contents or recipient addresses.

6. No public Radar functions

Radar and the terminology workshop are not part of the public company website. Their functions, including feedback, are blocked. Public pages do not set Radar feedback cookies.

7. Cloudflare Turnstile

The contact form uses Cloudflare Turnstile from Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107, USA. It loads only on contact pages. Cloudflare processes technical signals such as IP address, TLS fingerprint, user agent, sitekey and requesting origin to distinguish automated from human input. The browser-generated token is verified with Cloudflare on the server.

The basis is GDPR Article 6(1)(f), protecting the form and systems against abuse. Device storage or access, where used, is necessary for the requested secure form under section 25(2)(2) TDDDG. Cloudflare acts as a processor for website protection and, according to its own information, as a controller for improving bot detection.

Processing in the USA is possible. Cloudflare states that it relies on EU-US Data Privacy Framework certification and, alternatively, EU standard contractual clauses with supplementary measures. See the Turnstile Privacy Addendum and Cloudflare privacy policy.

8. Other cookies and external services

The custom integration sets no marketing, social-media or analytics cookies. Optional advertising measurement described below uses local browser storage after consent. Hosting statistics in section 2 are separate from optional website analytics. Fonts, images, styles and scripts are served locally except Turnstile on contact pages. There are no embedded maps, videos or social-media plugins. Advertising measurement is described separately below.

Optional website analytics with Matomo

With prior consent, I use a Matomo installation on my IONOS hosting in Germany to assess page usage and improve the website. Nothing is sent to Matomo without consent, and the website remains fully usable if consent is declined. The legal bases are GDPR Article 6(1)(a) and, where device information is read, section 25(1) TDDDG.

Only the page path from a defined list of public pages is sent. URL parameters, fragments, previous pages, form contents and email addresses are not sent. IP addresses are truncated by two bytes before storage. Browser, operating-system and language information and the request time may enter statistics. No additional device attributes are read for fingerprinting, no analytics cookies are set and no persistent visitor identifier is assigned. Matomo may group nearby requests using truncated IP and technical request data; this is not necessarily fully anonymous.

Matomo does not record clicks, downloads, form submissions, mouse movements, session contents or advertising conversions. Do Not Track and Global Privacy Control are respected. IONOS is the hosting processor; these statistics are not sent to Matomo as a vendor or to advertising networks.

Individual visit records are deleted from age 90 days, aggregated reports after 24 months. The weekly deletion job may add up to seven days. Reporting and due maintenance run regularly on the hosting.

Withdraw consent prospectively via Analytics settings in the footer. Earlier processing remains unaffected. Choice, timestamp and consent version are saved locally without a visitor identifier for up to 180 days, under section 25(2)(2) TDDDG and GDPR Article 6(1)(f), to respect the privacy choice. After expiry or cleared storage, consent is requested again and Matomo stays off without new consent. If storage is blocked, the choice lasts only for the current page. No Matomo tracking occurs without JavaScript.

Optional measurement of ChatGPT ads

Independently of Matomo, Ad measurement settings in the footer lets you consent to attribution of a technically submitted project inquiry to a ChatGPT ad. The form works without consent. The bases are GDPR Article 6(1)(a) and section 25(1) TDDDG. Matomo consent does not activate this function.

Only after consent does the website store the OpenAI ad-click identifier (oppref) locally for up to 30 days. After successful technical handoff of a form message, an image pixel sends lead_created, a random event identifier to avoid double counting and the click identifier if available to OpenAI. The recipient also receives IP address, browser information and time. No message contents, names, email addresses, phone numbers or applicant data are sent, and no OpenAI script for automatic contact matching is loaded. A conversion confirms technical submission, not a contract or revenue.

According to the Ad Tools DPA, the EEA recipient is OpenAI Ireland Limited. OpenAI generally acts as an independent controller for measuring, attributing and improving advertising services. Further processing in the USA and other third countries is possible; OpenAI commits to a valid transfer mechanism for onward transfers without adequate protection. OpenAI retention depends on its processing purposes and legal requirements, which this website does not control. See Conversion Terms, Ad Tools DPA and OpenAI privacy policy.

Consent version, choice and timestamp are saved locally for up to 180 days. Click and previously reported event identifiers are removed after 30 days on the next page visit. Withdrawal stops future transmissions and removes these attribution data from the browser; earlier lawful processing remains unaffected. Do Not Track and Global Privacy Control also prevent measurement. Without JavaScript, accessible browser storage or consent, no advertising measurement occurs.

9. Your rights

Subject to legal conditions, you have rights of access under GDPR Article 15, rectification under Article 16, deletion under Article 17, restriction under Article 18 and portability under Article 20. For processing based on Article 6(1)(f), you may object under Article 21 on grounds relating to your particular situation. You may withdraw consent at any time with future effect. No automated decision-making, including profiling, takes place.

You may complain to a supervisory authority, particularly the State Commissioner for Data Protection and Freedom of Information North Rhine-Westphalia, Kavalleriestraße 2-4, 40213 Düsseldorf, Germany, poststelle@ldi.nrw.de, www.ldi.nrw.de.

10. Applications, student placements and collaboration

The controller and contact are in section 1. For applications, I process contact details, qualifications, professional information, availability and voluntarily supplied documents to assess suitability and communicate. Section 26(1) BDSG applies to decisions about employment, including relevant placements. GDPR Article 6(1)(b) applies to independent collaboration and other pre-contractual inquiries.

Providing information is voluntary, but without necessary contact and suitability details an inquiry may not be assessable. A photo, date of birth and special categories of data are not required initially. Joshua Baums reviews applications personally, without automated selection or AI assessment.

Email uses IONOS as in section 4. Other recipients receive documents only when needed for agreed processing or legally required; additional recipients are disclosed beforehand where applicable. No additional third-country transfer is planned for this application process. Ordinary email is not end-to-end encrypted throughout. Ask for an appropriate channel before sending sensitive documents.

If no employment or placement results, documents are deleted within six months of the process ending unless a specific legal dispute requires longer retention. Limited retention to defend claims is based on GDPR Article 6(1)(f). If a contract results, only information necessary to perform it or meet legal duties is processed further. Collaboration inquiries follow section 4 retention rules. No longer-term applicant pool is maintained without separate, voluntary, revocable consent. The rights in section 9 also apply; contact the address in section 1.

11. Version and changes

Source notice dated 28 October 2026; English translation prepared 29 October 2026. This notice is updated when the website or services change.