Privacy policy
Controller
The controller responsible for data processing on this website within the meaning of the GDPR (DSGVO) is:
Thorsten Beck Bergstraße 125, 70186 Stuttgart, Germany Email: [email protected]
See also the imprint.
What this site does not do
5bats is privacy-by-default. This website:
- sets no cookies;
- loads no analytics and runs no trackers;
- makes zero third-party requests — all fonts, styles, scripts and images are self-hosted and served from this domain only;
- shows no consent banner, because there is nothing to consent to.
There is therefore no profiling, no advertising, and no cross-site tracking of any kind.
Hosting and server logs (Cloudflare)
This website is hosted on Cloudflare Pages, a service of Cloudflare, Inc., 101 Townsend Street, San Francisco, CA 94107, USA.
When you visit the site, your browser necessarily transmits technical data to Cloudflare’s servers so the page can be delivered and protected from abuse. This data is processed in server log files and may include:
- your IP address (considered personal data under the GDPR, even on a cookieless site),
- the date and time of the request,
- the page or file requested,
- the referring page (if any),
- your browser type, version and operating system.
This processing is necessary to deliver the website securely and reliably and is based on our legitimate interest (Art. 6 (1) (f) GDPR) in a functional, attack-resistant site. Cloudflare acts as our processor under a data-processing agreement pursuant to Art. 28 GDPR. Where data is transferred to the USA, the transfer is safeguarded by Cloudflare’s certification under the EU–US Data Privacy Framework and/or the EU Standard Contractual Clauses. Log data is retained only as long as needed for delivery and security and is then deleted or anonymised.
Cloudflare’s privacy policy: https://www.cloudflare.com/privacypolicy/.
Encryption (SSL/TLS)
The site is served over HTTPS (TLS), provided through Cloudflare. This encrypts the connection between your browser and the server so that the data transmitted cannot be read by third parties in transit.
Contacting us
Email (Proton Mail)
If you email [email protected], the data you send — your email address and the content of your message — is processed solely to handle and respond to your enquiry. The legal basis is our legitimate interest in answering your message (Art. 6 (1) (f) GDPR), or, where your message relates to entering into or performing a contract, Art. 6 (1) (b) GDPR.
Email is handled via Proton Mail, a service of Proton AG, Route de la Galaise 32, 1228 Plan-les-Ouates, Geneva, Switzerland. Switzerland is recognised by the EU as providing an adequate level of data protection (adequacy decision), so no additional transfer safeguards are required. Proton Mail provides zero-access and end-to-end encryption for message storage. Your message is kept until your request has been dealt with and any statutory retention periods have expired, then deleted.
Proton’s privacy policy: https://proton.me/legal/privacy.
Session (optional)
The contact page also offers Session, a decentralised, end-to-end-encrypted messenger that requires no phone number or email address. If you choose to contact 5bats over Session, the message content is processed only to reply. 5bats keeps no CRM and builds no profiles.
Legal bases at a glance
- Art. 6 (1) (f) GDPR (legitimate interests) — secure, reliable delivery of the website (server logs) and responding to enquiries.
- Art. 6 (1) (b) GDPR (contract) — where an enquiry concerns a contract or pre-contractual steps.
How long we keep data
We only retain personal data for as long as necessary for the purpose it was collected for, or as required by statutory retention obligations. Server log data is short-lived; email correspondence is deleted once your request is resolved and no retention period requires us to keep it.
Your rights
Under the GDPR you have the right to:
- access the personal data we hold about you (Art. 15),
- have inaccurate data rectified (Art. 16),
- have your data erased (Art. 17),
- restrict processing (Art. 18),
- data portability (Art. 20),
- object to processing based on legitimate interests (Art. 21), and
- withdraw consent at any time, where processing is based on consent (Art. 7 (3)).
To exercise any of these rights, contact us using the details above.
You also have the right to lodge a complaint with a supervisory authority (Art. 77 GDPR). The authority responsible for the controller is:
Der Landesbeauftragte für den Datenschutz und die Informationsfreiheit Baden-Württemberg (LfDI BW) Lautenschlagerstraße 20, 70173 Stuttgart, Germany https://www.baden-wuerttemberg.datenschutz.de/
Changes to this policy
We may update this policy when the site, its providers, or the legal requirements change. The current version always applies.
