data-cybernetics logo
Contact

Privacy Policy

Last updated: April 15, 2026

Privacy Policy of data cybernetics ssc GmbH

The protection of your personal data is very important to us. In this privacy policy, you will find all information about the processing of your personal data when visiting our website or using our contact form.

1. Controller

We, data cybernetics ssc GmbH (in the following “we” or “us”), are the controller and therefore responsible for the data processing activities described in this privacy policy:

data cybernetics ssc GmbH, a company registered at the Local Court of Augsburg (Amtsgericht Augsburg) with HRB 36687,

with a registered address at Vordere Mühlgasse 189, 86899 Landsberg am Lech, Germany.

If you have any questions regarding the processing of personal data or if you want to exercise your rights pursuant to section 7 of this privacy policy, please contact us via e-mail at

privacy@data-cybernetics.com.

2. Personal Data we Process & Legal Basis for Processing

2.1 Visiting our Website

Our website is delivered as a static site from Amazon S3 via the Amazon CloudFront content delivery network. When you visit our website, the CloudFront edge location closest to you and our hosting provider automatically process technical data — in particular your IP address, the date and time of the request, the page accessed, the HTTP status code, the referring URL, and information about your browser and operating system. This data is used to deliver the website, ensure its security, detect abuse, and troubleshoot technical issues. CloudFront access logging is not enabled for our distribution; no long-term server log file of visitor requests is created on our side.

Legal basis: our legitimate interest in the secure and stable operation of our website, Art. 6 (1) (f) GDPR (General Data Protection Regulation, “GDPR”).

In addition, we use a privacy-friendly, self-hosted web analytics service to understand how our website is used (see section 2.3).

2.2 Contact Form

If you contact us via the contact form on our website, we process the information you provide — namely your name, email address, company (optional), and the content of your message — in order to respond to your inquiry and, if applicable, to take pre-contractual steps.

The technical data flow is as follows: the form is submitted over HTTPS to our API endpoint at contactus.data-cybernetics.com, which is operated on Amazon Web Services (AWS API Gateway and AWS Lambda in the eu-central-1 region, Frankfurt, Germany). The AWS Lambda function forwards the submission to an internal Slack channel so that our team can respond. If your inquiry leads to a business relationship, the relevant correspondence and documents (e.g. offers, quotes, contracts) may additionally be stored on our document management system (NextCloud operated by rackSPEED GmbH, see section 5.4.5), and the email conversation will take place via our business email infrastructure (Google Workspace, see section 5.4.4).

Legal basis: Art. 6 (1) (b) GDPR for inquiries that relate to a (potential) contractual relationship, and our legitimate interest in responding to inquiries, Art. 6 (1) (f) GDPR.

2.3 Web Analytics (Umami)

We use Umami, a privacy-focused, open-source web analytics service, to understand how our website is used (pages visited, referrers, approximate geographic region, device type). Umami is operated by us on our own infrastructure (a Kubernetes cluster hosted with Hetzner Online GmbH in Falkenstein, Germany — see section 5.4.3) and is reachable at umami.data-cybernetics.net. Umami does not set cookies, does not engage in cross-site tracking, and does not retain personal identifiers in its aggregated statistics. The software is configured so that visitors’ IP addresses are anonymised (hashed) immediately after processing. No IP addresses or other personal identifiers are stored in the database.

Legal basis: our legitimate interest in understanding and improving our website, Art. 6 (1) (f) GDPR.

3. Cookies and Local Storage

Our website does not use tracking cookies or third-party advertising cookies. We use only technically necessary browser storage (e.g. to remember your preferred language or to support view transitions). This data is stored on your device only and is not transmitted to us.

Legal basis: Art. 6 (1) (f) GDPR and § 25 (2) No. 2 TDDDG for technically necessary storage.

4. Retention

We only process your personal data for as long as necessary to fulfil the purpose for which it was collected, or for as long as statutory retention periods require. In particular:

  • Server / API access logs (AWS CloudWatch): retained for 30 days and then deleted automatically, unless retention is necessary to investigate a security incident.
  • Contact form messages: retained in the receiving Slack channel for as long as necessary to handle your inquiry. If your inquiry leads to a business relationship, related email correspondence and documents are retained for the duration of the relationship and thereafter deleted, subject to statutory retention obligations (e.g. 6 or 10 years under German commercial and tax law).
  • Web analytics (Umami): aggregated statistics are retained indefinitely; no personal identifiers are stored in these statistics.

When we no longer need the data, we will delete it or take appropriate measures to anonymise it so that it is no longer identifiable.

5. Recipients of Personal Data

5.1 We only share your personal data with third parties:

  • insofar as this is necessary for the operation of our website or for handling your inquiry,
  • insofar as you have given us your consent to do so,
  • to the extent that we commission service providers who process personal data on our behalf and in accordance with our instructions, or
  • insofar as this is required by mandatory legal provisions.

5.2 We use the external service providers listed below to provide IT and administrative support for our website and contact form. These service providers may have access to your personal data to the extent necessary to provide their services. Access is limited to personnel who need the information to complete our or your requests.

5.3 Where service providers act as processors on our behalf, they are contractually obliged under data processing agreements pursuant to Art. 28 GDPR to comply with the applicable statutory data protection provisions and with our instructions. The same applies to any subprocessors, to the extent that our processors use such with our prior consent.

Legal basis: Art. 6 (1) (b) GDPR (performance of contract / pre-contractual measures) and Art. 6 (1) (f) GDPR (legitimate interest in reliable service delivery).

5.4 We use the following service providers:

5.4.1 Amazon Web Services. We use Amazon Web Services EMEA SARL (“AWS”), 38 avenue John F. Kennedy, L-1855 Luxembourg, for the core hosting and delivery of our website. The specific AWS services we use are:

  • Amazon S3 — storage of the static website files
  • Amazon CloudFront — content delivery network (CDN). Our distribution uses AWS price class 100, meaning CloudFront serves our site from edge locations in the United States, Canada, and Europe.
  • Amazon Route 53 — DNS resolution for our domain
  • Amazon API Gateway and AWS Lambda — the serverless endpoint that receives contact form submissions
  • Amazon CloudWatch — log storage for the API endpoint
  • AWS Certificate Manager (ACM) — TLS certificates for HTTPS

Our primary AWS region is eu-central-1 (Frankfurt, Germany). Certificates for CloudFront are managed in us-east-1 (Northern Virginia, USA) as required by AWS; the certificates themselves do not contain personal data. We have concluded a data processing agreement with AWS. Transfers of data to the United States take place on the basis of the European Commission’s adequacy decision (EU-U.S. Data Privacy Framework), for which AWS is certified, and additionally on the basis of EU Standard Contractual Clauses.

For more information, please refer to the privacy notice of AWS.

5.4.2 Slack. We use Slack Technologies Limited, Salesforce Tower, 60 R801, North Dock, Dublin, Ireland, for internal team communication. Messages submitted via our contact form are relayed to a Slack channel by the AWS Lambda function described in section 5.4.1. Slack may have access to your personal data to the extent necessary to provide its services. We have concluded a data processing agreement with Slack. Transfers of data to the United States take place on the basis of the European Commission’s adequacy decision (EU-U.S. Data Privacy Framework), for which Salesforce (Slack) is certified, and additionally on the basis of EU Standard Contractual Clauses.

For more information, please refer to the privacy notice of Slack.

5.4.3 Hetzner Online GmbH. We use Hetzner Cloud services, provided by Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany, to host our internal Kubernetes cluster in the Falkenstein (fsn1) data centre region, Germany. This cluster runs, among other internal tools, our self-hosted Umami web analytics described in section 2.3. Hetzner may have access to your personal data to the extent necessary to provide the infrastructure service.

For more information, please refer to Hetzner’s privacy policy here.

5.4.4 Google Workspace. We use Google Workspace, provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, as our business email infrastructure. If your inquiry via the contact form or elsewhere leads to email correspondence with our team, that correspondence is handled through Google Workspace. Google may have access to your personal data to the extent necessary to provide its services. We have chosen that the data is processed and stored on servers in the European Union; however, we have no influence over whether Google transfers data to other countries outside the EU as part of its global service operation. We have concluded a data processing agreement with Google. Transfers of data to the United States take place on the basis of the European Commission’s adequacy decision (EU-U.S. Data Privacy Framework), for which Google is certified.

For more information, please refer to Google Workspace’s privacy policy here.

5.4.5 NextCloud by rackSPEED GmbH. We use a NextCloud server provided by rackSPEED GmbH, Reisholzer Werftstraße 31b, 40589 Düsseldorf, Germany, for the storage of documents relating to our business relationships (offers, quotes, contracts, project documentation). Where your inquiry leads to a business relationship with us, the related documents and correspondence may be archived on this system. rackSPEED provides a hosting service based in Germany and may have access to your personal data to the extent necessary to provide the service.

For more information, please refer to rackSPEED’s privacy policy here.

6. Transfer of Personal Data to Third Countries

We do not intend to transfer your personal data outside the European Union. However, as noted in section 5, some of our service providers are part of corporate groups that may transfer data to third countries (in particular AWS and Google, which operate globally).

In addition, our CloudFront CDN serves our site from edge locations in the United States, Canada, and Europe (AWS price class 100). Visitors from outside Europe may therefore be served by a non-EU edge location; the edge processes the request technically in order to deliver the cached page.

For certain countries, the EU Commission has issued an adequacy decision that provides a level of data protection equivalent to the EU. Where such an adequacy decision applies, no additional safeguards are required for the transfer.

Where no adequacy decision exists, we ensure before any transfer that an adequate level of data protection exists at the recipient — in particular by agreeing EU Standard Contractual Clauses pursuant to Art. 46 (2) (c) GDPR or on the basis of binding corporate rules within the meaning of Art. 47 GDPR — or that you have given your explicit consent.

7. Your Rights as a Data Subject

7.1 Right of access

You may request information pursuant to Art. 15 GDPR about your personal data processed by us. To help us compile the necessary data, we kindly ask you to specify your request.

7.2 Right to rectification

If your personal data is not, or no longer, accurate, you may request a rectification pursuant to Art. 16 GDPR. If your data is incomplete, you may request to complete it.

7.3 Right to erasure

You may request the deletion of your personal data under the conditions of Art. 17 GDPR. Your right to erasure depends on whether your personal data is still needed to fulfil our legal duties.

7.4 Right to restriction of processing

Within the framework of the requirements of Art. 18 GDPR, you may request a restriction of the processing of your personal data.

7.5 Right to data portability

You may request to receive your personal data, which you have provided to us, in a structured, commonly used, and machine-readable format under the requirements of Art. 20 GDPR.

7.6 Right to object

Pursuant to Art. 21 GDPR, you may object to the processing of your personal data at any time, on grounds relating to your particular situation, where the processing is based on our legitimate interest. We cannot always comply with such an objection — for example, where legal provisions oblige us to process the data to fulfil our legal duties.

Where processing is based on your consent (Art. 6 (1) (a) GDPR), you have the right to withdraw your consent at any time with effect for the future. The withdrawal of consent does not affect the lawfulness of processing carried out on the basis of the consent prior to its withdrawal.

7.8 Right to lodge a complaint

If you believe that we have not complied with data protection regulations when processing your data, you may lodge a complaint with us or with a competent data protection authority. The supervisory authority responsible for us is:

Bayerisches Landesamt für Datenschutzaufsicht (BayLDA) Promenade 18, 91522 Ansbach, Germany Website: lda.bayern.de

You may also lodge a complaint with the supervisory authority of the EU member state in which you reside or work.

8. Automated Decision-Making

We do not use automated decision-making within the meaning of Art. 22 GDPR, including profiling, when processing your personal data.

9. Updates to this Privacy Policy

We may update this privacy policy from time to time to reflect changes in our processing activities or legal requirements. The current version is always available on our website. Material changes will be communicated appropriately; for processing based on consent, we will obtain renewed consent where required by law.