Privacy Policy

Artifaktory, Inhaber: Farshid Abdollahnejadbarough Farshid Abdollahnejadbarough, Einzelunternehmer Pralistraße 21 76149 Karlsruhe Deutschland Email: info@artifaktory.de Phone: 0721 1566 5942 The controller for website processing is listed below. These details come from the approved operator facts baseline AWG-BASE-2026-09-03. Privacy contact: datenschutz@artifaktory.de. No data protection officer is appointed.

This privacy notice is derived from processing inventory AWG-PI-2026-09-14. It covers AWG-PI-WEB-001 website delivery, AWG-PI-WEB-002 contact inquiry storage, AWG-PI-WEB-003 contact SMTP/mailbox delivery, AWG-PI-WEB-004 product catalogue/media administration, AWG-PI-WEB-005 product download logging, AWG-PI-WEB-006 server/reverse-proxy/application logs, AWG-PI-WEB-007 database/Django Admin, AWG-PI-WEB-008 encrypted backups, AWG-PI-WEB-009 monitoring/alerting and AWG-PI-WEB-010 repository/CI/deployment metadata. Open production blockers: Monitoring/Alerts DPA, location and transfer status remain open/unknown; the current backend code still creates DownloadLog entries. Before production publication, #186 must disable or anonymize the download logs, or the download endpoints must remain disabled or gated.

Inventory: AWG-PI-WEB-002 contact inquiry storage and AWG-PI-WEB-003 contact SMTP/mailbox delivery. When you use the contact form, the application processes the information you enter, such as name, email address, optional company, category/subject, message and optional solution interest. The application also processes technical metadata such as creation time, language/locale, processing flags, spam/read state, an IP-derived hash, a hashed browser retry key, the linked privacy notice version reference and email delivery status. If SMTP delivery fails, delivery timestamps, error class and SMTP code may be stored for troubleshooting. The contact notification is prepared through Checkdomain DNS/Mail/SMTP; your address may be used as Reply-To. Checkdomain is approved with DPA yes, DE/EU location and no third-country transfer. Legal basis: Art. 6(1)(b) GDPR for pre-contractual or contractual inquiries or Art. 6(1)(f) GDPR for the legitimate interest in operating and documenting the contact channel. Approved retention target: contact inquiries in the database for 6 months after resolution unless a contract materializes. Contact emails should be manually deleted or archived after processing, or synchronized with database retention. SMTP/mail logs have the approved target of 7 to 14 days for troubleshooting only. Operational implementation and verification of deletion or archiving remain a separate production gate.

Inventory: AWG-PI-WEB-001 website delivery and AWG-PI-WEB-006 server/reverse-proxy/application logs. When the website is accessed, technical connection data is created, such as requested URL, locale route, IP address at ingress/proxy, browser/user-agent information, referrer if sent, timestamp and response status. This data is needed to provide the website and API, investigate disruptions and trace security events. Netcup VPS and Coolify self-hosted on Netcup are approved with DPA yes, DE/EU location and no third-country transfer. Legal basis for server, app and security logs is Art. 6(1)(f) GDPR for security and stability. Approved retention target for server/app/proxy security logs: 7 days; operational implementation and verification remain a separate production gate.

Inventory: AWG-PI-WEB-004 product catalogue/media administration and AWG-PI-WEB-005 product download logging. The product catalogue and media content may be shown publicly. The approved privacy target is: download logs and product telemetry are disabled or anonymized. However, the current backend code in this revision still writes DownloadLog data for download endpoints: product, product file, timestamp, IP-derived hash, user agent and referrer. An email field exists on DownloadLog but the current download views do not populate it. IP-derived hashes are not described as anonymous. Result: the production notice must not claim that download logs are disabled or anonymous while the current runtime still writes them. For the disabled/anonymized target state, no legal basis applies as active processing; for the currently active pseudonymous logging, publication remains blocked until #186 changes runtime behavior or download endpoints remain disabled/gated.

Inventory: AWG-PI-WEB-007 database/Django Admin, AWG-PI-WEB-008 encrypted backups, AWG-PI-WEB-009 monitoring/alerting and AWG-PI-WEB-010 repository/CI/deployment metadata. The website uses PostgreSQL and Django Admin to manage site settings, categories, products/media, contact inquiries, download logs and authorized staff/admin access. Backups may contain database and media data and are needed for recovery, incident response and rollback. Hetzner Storage Box BX11 is approved with DPA yes, DE/EU location and no third-country transfer; approved retention target for backups: 30 days. Monitoring checks availability, DNS/TLS, API health, host/container health, backup freshness and repeated SMTP failures. Legal basis is Art. 6(1)(f) GDPR for system stability. Approved retention target for monitoring/alert data: 14 to 30 days. Operational implementation and verification of these retention targets remain a separate production gate. Monitoring/Alerts DPA, location and transfer status are open/unknown and remain a production blocker. GitHub is used for repository, issues, projects and CI/CD; GitHub is approved with DPA yes, USA location and transfer yes under the EU-US Data Privacy Framework.

Inventory: AWG-PI-WEB-DIS-001 newsletter, AWG-PI-WEB-DIS-002 analytics/tracking, AWG-PI-WEB-DIS-003 online contracting/payments and AWG-PI-WEB-DIS-004 non-essential client storage. Newsletter, analytics, non-essential client storage, checkout, online contracting and payments are not active for the first launch. They are not described here as active processing. If they are enabled later, purpose, legal basis, recipients, retention, technical implementation and public notices must be approved and tested first.

The current launch baseline does not approve analytics, newsletter processing or non-essential client storage. This page therefore does not make a blanket claim that all cookies or technical events are free of personal data. Runtime review of cookies, browser storage and third-party calls remains required before production approval. If storing or accessing information on a user device is not strictly necessary for message transmission or for a service explicitly requested by the user, a separate decision and implementation are required before activation.

Subject to the GDPR, you may request access, rectification, erasure, restriction of processing, data portability and object to processing. If processing is based on consent, you may withdraw that consent for the future. You also have the right to lodge a complaint with a data protection supervisory authority. To exercise your rights, please contact us at datenschutz@artifaktory.de. Competent data protection supervisory authority: State Commissioner for Data Protection and Freedom of Information Baden-Wuerttemberg (LfDI BW).

This version is linked to processing inventory AWG-PI-2026-09-14. Changes to active processing, disabled features, providers, retention or legal bases must be updated traceably in the inventory, tests and this DE/EN notice.