Skip to content
mode

Legal

Privacy Policy

Last updated

This policy explains what personal data mode41 processes when you visit this website, why we process it, the legal basis under the GDPR (DSGVO), and which processors are involved.

The controller responsible for this processing is:

mode41 UG (haftungsbeschränkt), Bruckwiesenstr. 109, 90522 Oberasbach, Germany — represented by its Geschäftsführer Dr. Florian Patzer. Email: legal@mode41.com. Full company details are in our Imprint.

At a glance

  • We run no advertising trackers and set no analytics or marketing cookies, so there is no cookie banner.
  • We process the minimum data needed to serve the site, answer your messages, and (only if you ask) send you our newsletter.
  • We disclose every processor below, host the newsletter in the EU, and conclude a data-processing agreement (DPA/AVV) with each processor.

Hosting & content delivery — Vercel

This site is hosted on Vercel (Vercel Inc., USA). When you load a page, Vercel processes the data your browser necessarily sends — your IP address, the requested URL, referrer, user-agent, and timestamp — to deliver the site and to keep it secure. Vercel may log the IP address server-side for a short period for abuse detection and operational security.

  • Legal basis: Art. 6(1)(f) GDPR (legitimate interest in operating a secure, performant site).
  • Transfer: Data may be processed in the USA under the EU Standard Contractual Clauses (SCCs) in Vercel's Data Processing Agreement.
  • Retention: Server-side request logs are kept only for the short operational window Vercel's platform retains them (a matter of days) and are then deleted automatically.

Analytics — cookieless

We measure aggregate, anonymous usage with Vercel Web Analytics (provided by Vercel, see above), a cookieless, privacy-friendly analytics service. It records page views, the referring site, campaign tags in the link you arrived by (utm_* parameters), and a small set of anonymous interactions: newsletter sign-up, contact-form submission (with its topic category only — never your name, email, or message), course and consulting inquiry clicks, and clicks to architrace and GitHub. All other URL parameters are removed before anything is sent. Visitors are counted via a hash of the request that Vercel discards after 24 hours.

We do not set cookies, do not build cross-session profiles, and do not store data that identifies you personally. If your browser sends a Do Not Track (DNT) or Global Privacy Control (GPC) signal, the analytics script is not loaded at all.

  • Legal basis: Art. 6(1)(f) GDPR (legitimate interest in understanding, in aggregate, how the site is used). Because no information is stored on or read from your device, this requires no consent and no banner.
  • Retention: The visitor hash is discarded after 24 hours; only aggregate, non-personal statistics remain.

Contact form — Resend

If you use our contact form, we process the name, email address, and message you submit so we can reply. Delivery of the resulting notification and auto-reply email is handled by our transactional email provider Resend (Resend, Inc., USA). We never add you to a mailing list from this form. The form is protected against abuse by Cloudflare Turnstile (see below) and server-side rate limiting.

  • Legal basis: Art. 6(1)(b) GDPR (steps prior to a contract / handling your enquiry) and Art. 6(1)(f) (legitimate interest in responding and preventing abuse).
  • Transfer: Processing in the USA under the EU Standard Contractual Clauses in Resend's DPA.
  • Retention: We keep enquiry correspondence only as long as needed to handle your request and any follow-up, then delete it.
  • Is it required? No. Providing these details is voluntary and there is no statutory or contractual obligation to do so — but without a name, an email address and a message we cannot process or answer your enquiry.

Spam protection — Cloudflare Turnstile

The contact form is protected by Turnstile, a CAPTCHA alternative provided by Cloudflare, Inc. (USA). When the form page loads, the Turnstile widget is fetched from Cloudflare and processes your IP address, browser and device characteristics, and interaction signals in order to distinguish humans from bots. Your form content is never sent to Cloudflare — only the challenge result is, which our server then verifies with Cloudflare.

  • Legal basis: Art. 6(1)(f) GDPR (legitimate interest in protecting the form against automated abuse and spam).
  • Transfer: Processing in the USA under the EU Standard Contractual Clauses in Cloudflare's Data Processing Addendum.
  • Storage on your device: Turnstile may store information strictly necessary to run the security check. It is not used for tracking or advertising and, as a strictly necessary measure for a service you requested, requires no consent (§25(2) TTDSG).

Newsletter — Keila (double opt-in)

If you subscribe to our newsletter, we process your email address and your consent record (the confirmation timestamp and IP address, as proof of consent). We use double opt-in: you receive a confirmation email and are only added to the list after you click the confirmation link. The newsletter is delivered with Keila (managed, hosted in Germany / the EU). There is no transfer to the USA. Every newsletter contains an unsubscribe link, and you can withdraw your consent at any time with effect for the future.

  • Legal basis: Art. 6(1)(a) GDPR (your consent).
  • Retention: Your address is stored until you unsubscribe or withdraw consent, after which it is deleted; the consent record is kept for as long as we may need it to demonstrate that consent was given (Art. 7(1) GDPR), and then deleted.
  • Is it required? No. Subscribing is entirely voluntary — but we cannot send you the newsletter without your email address.

International transfers

Where a processor above handles data in the USA, the transfer is based on the EU Standard Contractual Clauses (Art. 46(2)(c) GDPR) concluded with that provider, supplemented by their technical and organisational safeguards. You can obtain a copy of the safeguards for any of these transfers by writing to legal@mode41.com.

Your rights

Under the GDPR you have the right to access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction (Art. 18), and data portability (Art. 20). Where processing is based on consent, you may withdraw that consent at any time with effect for the future. You also have the right to lodge a complaint with a supervisory authority.

To exercise any of these rights, contact us at the address in our Imprint.

Your right to object (Art. 21 GDPR)

You have the right to object at any time, on grounds relating to your particular situation, to processing of your personal data that is based on our legitimate interest under Art. 6(1)(f) GDPR. On this site that covers hosting and delivery, cookieless analytics, and the spam protection on the contact form.

If you object, we will stop processing your data for that purpose unless we can demonstrate compelling legitimate grounds that override your interests, rights and freedoms, or unless the processing serves to establish, exercise or defend legal claims. An objection is free of charge and requires no particular form — an email to legal@mode41.com is enough.