Privacy
Not yet published
How personal data is handled here, as required by Art. 13 GDPR.
Controller
Name and contact details of the controller — the same entity as in the Imprint. If a data protection officer is appointed, their details belong here too; a business of this size normally does not need one.
What is processed, and why
The parts of this that are already true of the running system, and which the finished text has to describe accurately:
- The serial number you enter. Stored with the result of the check so the report can be reissued, and so the check can be reconstructed if you query it.
- Your email address, when you pay. It comes from the payment step and is stored on the order.
- Payment data. Card details are entered on Stripe's own pages and never reach this service; what is stored here is Stripe's identifier for the payment, the amount and the status.
- Server logs kept by the reverse proxy, including IP addresses, for security and troubleshooting.
The legal basis for each of the four, and the retention period for each. Contract performance (Art. 6(1)(b)) covers the check and the order; the logs are legitimate interest (Art. 6(1)(f)) and need a stated retention. Commercial and tax law also impose minimum retention on records of a sale, which will be longer than what the product itself needs.
Recipients
Three processors are involved in delivering this service:
- Stripe — payment processing. Card data is entered on Stripe's pages, not here.
- Hetzner — hosting, in Germany.
- Cloudflare — DNS, and the forwarding of mail sent to contact@serialrisk.com.
A data processing agreement (AVV / DPA) with each of the three, and — for Stripe and Cloudflare — the basis for any transfer outside the EU. This is the section most likely to be wrong in a copied template, because the list of processors is specific to how this service is actually run.
Your rights
Access, rectification, erasure, restriction, portability, objection, and the right to complain to a supervisory authority — with the competent authority named. Standard text, but it has to name the right authority for the operator's state.
Cookies and tracking
This site sets no analytics or advertising cookies and embeds no third-party trackers. Video embeds use YouTube's no-cookie host.
Confirmation that this is still true at launch, and — if it is — the statement that no consent banner is required because nothing beyond strictly necessary storage is used. If anything changes, this is the section that decides whether a banner becomes mandatory.