Privacy notice

This notice explains which personal data is processed when you visit codemantix.com or send an enquiry. It applies to this portfolio and services site. Linked applications have their own privacy notices.

Controller

Providing and protecting the website

This site is delivered via Cloudflare Pages by Cloudflare, Inc., 101 Townsend Street, San Francisco, CA 94107, USA. When you access it, Cloudflare processes connection and access data needed for technical operation. This may include your IP address, access time, requested URL, browser and operating system details, and the referring page.

This processing serves delivery, stability and security. The legal basis is Article 6(1)(f) GDPR; the legitimate interest is providing a reliable and secure website.

Cloudflare’s Data Processing Addendum forms part of its Self-Serve Subscription Agreement. It also covers international transfers and related safeguards, including EU standard contractual clauses. Processing in the USA and other countries is possible.

I do not maintain my own archive of visitor access logs. Cloudflare also processes network and security data for its own purposes. Retention depends on the purpose of processing, security needs and legal requirements; no single fixed period applies to every category. See Cloudflare’s privacy policy for more on end-user data and retention.

Cookies, fonts and analytics

The site sets no analytics or advertising cookies, uses no visitor tracking with identifiers and has no user accounts. Only for the tender-preselection offer page does the server count requests without identifiers; nothing is stored in or read from your browser for this (see below). Font files and project images are delivered with the site. Visiting this site does not load fonts from Google Fonts or embedded social-media content.

The hosting provider may set technical cookies for necessary security checks. Where strictly necessary for the service you requested, these are used under Section 25(2)(2) of the German Telecommunications Digital Services Data Protection Act (TDDDG); related personal-data processing protects the site under Article 6(1)(f) GDPR.

Contacting me

Clicking an email link opens your email app. Only if you send a message will I process your sender address, message and any other information you provide to handle your enquiry. A prefilled subject or message is never sent automatically.

The legal basis for precontractual or contractual enquiries is Article 6(1)(b) GDPR. For other enquiries, it is the legitimate interest in responding under Article 6(1)(f) GDPR.

The email inbox is operated by ALL-INKL.COM – Neue Medien Münnich, owner René Münnich, Hauptstraße 68, 02742 Friedersdorf, Germany. Further details: ALL-INKL privacy information.

Messages are deleted once the enquiry is resolved unless statutory retention duties or legitimate reasons to preserve legal claims apply. Business correspondence and contract documents may be subject to statutory retention periods.

As an alternative, this site links to the contact form on my Kinokanon website. It is not embedded here. If you open and submit that form, its contact-form privacy notice applies.

Tender preselection for businesses (trial and subscription)

If you request a trial of the tender preselection for your business via the form or by email, I process the company name, business email address, the requested search area (all of NRW or one administrative district, with the derived official NUTS area), any postcode areas you add, your statement on taking part in public tenders, your confirmation that you are acting for a business and, if provided, the name of a contact person. I flag known free-mail addresses internally without rejecting them. I use this to send you a preselection of public tenders for your area by email on working days, to assign your feedback and, after your explicit confirmation, to perform and invoice the contract (adding billing address and payments). If you are my contracting party yourself (for example as a sole trader), the legal basis is Article 6(1)(b) GDPR. If you make the request for a company or another legal entity, that entity is my contracting party; I then process your details as its contact person on the basis of my legitimate interest in handling the trial and contract with the business through the contact person it has named (Article 6(1)(f) GDPR). For invoices and contract correspondence the legal basis is Article 6(1)(c) GDPR in each case (statutory retention duties).

I keep the subscriber list locally on my own computer and send and receive the emails via my ALL-INKL.COM mailbox. The content comes from the official notices of the German public procurement notice service; no data about you is transferred to third parties for this. The emails contain no tracking pixels or tracking links. I delete local copies of the sent preselection emails and the sending log 30 days after sending. If it is unclear whether an email was delivered, its copy stays until this is resolved; sending is paused until then. Which notices you have already received is kept until 30 days after the trial or contract ends, so that you only receive new and changed procedures.

If the trial ends without confirmation, sending stops automatically. If you unsubscribe during the trial, I record this by the next business day (Monday to Friday) at the latest; no further emails are sent after that, but preselection emails may still arrive until then. In both cases I delete your details within 30 days. If you cancel a contract, sending continues until the end of the contract month; after that the same applies. Records with a statutory retention duty are excepted (section 147 AO, section 14b UStG): I keep invoices for eight years and the contract correspondence (offer, acceptance, contract confirmation, cancellation and its confirmation) for six years, each from the end of the calendar year, stored separately from other emails. In individual cases I keep details longer only where the law requires it or I need them to establish, exercise or defend legal claims, and only for as long as necessary (Article 17(3)(b) and (e), Article 6(1)(c) and (f) GDPR). The details are required for sending; without them I cannot set up a trial. During the trial you can unsubscribe at any time by replying with the subject “Abmelden” (recorded as described above). During a subscription, such an unsubscribe counts as cancellation at the end of the current contract month. The terms for the tender preselection (German) apply.

Form requests are stored with their time of receipt and processing status in the key-value storage (KV) of my hosting provider Cloudflare and deleted there automatically 30 days after receipt, even if I have already transferred them to my local subscriber list or discarded them. To prevent abuse, the form uses a secret pseudonymous identifier derived from the IP address that changes daily and is kept for at most two days, and a protected check value of the email address for duplicate detection kept for at most 30 days; the IP address itself is not stored. Against automatically submitted requests, the server writes a signed time into the form when the page is delivered and checks the time taken when it is submitted. The legal basis is Article 6(1)(f) GDPR (secure operation, preventing unwanted requests).

To evaluate the offer, the server counts requests for the offer page per day, ad campaign and ad group, and stored trial requests per day. It reads campaign and ad group only from the requested address and only from a fixed list of values; other parts of the address are ignored. Only a normal page view counts, not prefetching or a link preview; the server recognises this from the headers the browser sends anyway. Nothing is stored in or read from your browser for this: there are no cookies and no counting script. The counters contain no IP address, device, session or visitor identifier, expire after 30 days and are not combined with sign-ups. The legal basis is Article 6(1)(f) GDPR (evaluating the offer using simple usage figures). For Cloudflare, the information in the section “Providing and protecting the website” applies.

Links to projects and other websites

Project previews are locally stored images. Your browser connects to an external website only when you follow its link. That website’s privacy information then applies.

Your rights

Subject to the legal requirements, you have rights of access (Article 15 GDPR), rectification (Article 16), erasure (Article 17), restriction of processing (Article 18) and data portability (Article 20).

You may object to processing under Article 6(1)(f) GDPR on grounds relating to your particular situation (Article 21 GDPR). Contact me using the details above.

You may lodge a complaint with a data protection supervisory authority (Article 77 GDPR), particularly at your habitual residence, workplace or the place of the alleged infringement. For North Rhine-Westphalia, this is the State Commissioner for Data Protection and Freedom of Information.

No automated decision-making with legal or similarly significant effects takes place.