Privacy policy

This is a translation for convenience. In case of doubt, the German version of this privacy policy prevails.

1. Controller

The controller for data processing on this website within the meaning of the General Data Protection Regulation (GDPR) is:

For questions about data protection, a message to this address is sufficient. No data protection officer has to be appointed, as the conditions of Article 37 GDPR and section 38 BDSG are not met.

2. Principles of processing

We process personal data exclusively on the basis of statutory provisions. Depending on the processing, the legal bases are:

• Article 6 (1) (a) GDPR – consent, for example for optional cookies.
• Article 6 (1) (b) GDPR – initiation or performance of a contract, for example for project enquiries.
• Article 6 (1) (c) GDPR – compliance with legal obligations, for example commercial and tax retention periods.
• Article 6 (1) (f) GDPR – legitimate interest in the secure and stable operation of this website.

3. Hosting and server log files

This website is hosted by Vercel Inc., 440 N Barranca Ave #4133, Covina, CA 91723, USA. Delivery takes place via data centres inside the European Union. A data processing agreement pursuant to Article 28 GDPR is in place with the provider; the European Commission’s standard contractual clauses apply to transfers to third countries.

When you access this website, the server automatically records information transmitted by your browser: IP address, date and time of the request, page accessed, volume of data transferred, referrer URL and the type of browser and operating system. This data serves to deliver the page, analyse errors and defend against attacks. The legal basis is Article 6 (1) (f) GDPR. The data is not combined with other sources.

4. Cookies and local storage

This website currently uses only technically necessary storage entries. Your choice in the cookie notice is stored locally in your browser (local storage, key “syrax.cookie-consent”) so that the notice does not reappear on every visit. This storage is permitted without consent under section 25 (2) TDDDG because it is necessary for the function you requested.

Your language choice is likewise technically necessary: the selected language version follows from the address you call up (/de or /en); no additional cookies are set for it.

Optional cookies for audience measurement are only set after your express consent under Article 6 (1) (a) GDPR in conjunction with section 25 (1) TDDDG. You can withdraw consent at any time with effect for the future by clearing your browser’s local storage for this website or by sending us a brief message.

5. Contact form and email

If you contact us via the contact form or by email, we process the details you provide (name, email address, optionally company, subject and message) in order to answer your enquiry. Mandatory fields are marked as such; without them we cannot process the enquiry.

To send the form message we use the email service provider Resend (Plus Five Five, Inc., San Francisco, USA) as a processor; delivery is made to our mailbox at Proton Mail (Proton AG, Geneva, Switzerland). Data processing agreements under Article 28 GDPR are in place with both providers, and the European Commission’s standard contractual clauses apply to transfers to the USA. You are welcome to write to us directly by email instead.

The legal basis is Article 6 (1) (b) GDPR where your enquiry serves to initiate a contract, otherwise Article 6 (1) (f) GDPR based on our legitimate interest in answering enquiries. To protect against automated submissions the form contains a hidden field (honeypot); no additional personal data is collected through it.

Health data from the Pulse band

We do not process the health data recorded by the band. It stays on the band and on your phone; no transfer to us or to third parties takes place, as there is no cloud synchronisation. You can export the data from the app – the resulting file remains in your hands.

Syrax Magazine newsletter

For the newsletter we process your email address, the language you chose, the page on which you subscribed and the times of subscription, confirmation and, where applicable, unsubscription. We use the double opt-in procedure: after subscribing you receive an email with a confirmation link, and only after you click it is your address enabled for mailings. As proof of consent we also store the wording of the consent text and a truncated IP address (last block removed) that cannot be traced back to you.

The legal basis is your consent under Art. 6(1)(a) GDPR. You can withdraw it at any time with effect for the future – via the unsubscribe link in every email or informally at syrax.shop@proton.me. We send the confirmation email via Resend (see above); the subscriber list is stored with our hosting and database provider. Unconfirmed subscriptions are deleted after 30 days at the latest; after you unsubscribe we keep the address solely as proof of the earlier consent and to block further mailings.

6. Fonts and external content

Fonts are served locally from our own server. No connections to external font providers are established. Map services and video content are not embedded automatically; should they be used in future, they will only load after your consent. Links to the Google Play Store lead to a service of Google Ireland Limited; data is only transmitted there once you click.

7. Recipients and processors

We only pass on personal data where this is necessary to perform a contract, where you have consented, or where a legal obligation exists. The service providers we use (hosting, email delivery) are contractually bound under Article 28 GDPR and may process data only on our instructions. Data is never sold.

8. Retention periods

Server log files are deleted after 30 days at the latest. Enquiries via the contact form or by email are stored until the purpose no longer applies, and at most for the duration of statutory retention periods of six or ten years under commercial and tax law. The data is then deleted or its processing restricted.

9. Your rights

You have the following rights in relation to us:

• Access to the data processed (Article 15 GDPR)
• Rectification of inaccurate data (Article 16 GDPR)
• Erasure (Article 17 GDPR)
• Restriction of processing (Article 18 GDPR)
• Data portability (Article 20 GDPR)
• Objection to processing based on legitimate interests (Article 21 GDPR)
• Withdrawal of consent with effect for the future (Article 7 (3) GDPR)

An informal message to syrax.shop@proton.me is enough to exercise these rights. You also have the right to lodge a complaint with a supervisory authority (Article 77 GDPR), in particular in the member state of your residence or of the alleged infringement.

10. Changes to this policy

We adapt this privacy policy whenever changes to the website or the legal situation require it. The version published here applies in each case.

Last updated: January 2026 · Placeholder version, have it reviewed by a lawyer before publication