Privacy Policy

Draft: pending legal review. Reflects the technical data flows as built (F-004). Highlighted items are owner-specific and to be confirmed before launch.

Controller

The controller for the processing described here within the meaning of the GDPR is Eigenstack LLC, a Single-Member LLC under the laws of the U.S. state of Wyoming. Its address and contact details can be found in the imprint.

EU representative (Art. 27 GDPR)

Eigenstack LLC is established outside the EU/EEA (Wyoming, USA). A controller established outside the Union that offers services to data subjects in the EU must, as a rule, designate a representative in the Union (Art. 27(1) GDPR).

The exemption under Art. 27(2)(a) GDPR applies where the processing is occasional, does not include large-scale processing of special categories of data (Art. 9) or data relating to criminal convictions (Art. 10), and is unlikely to result in a risk to the rights and freedoms of data subjects. The processing described here is limited to technically necessary server logs and a contact form: no tracking, no profiling, no special categories of data, low volume and low risk. We therefore rely on this exemption and have not designated a mandatory representative.

[EU representative under Art. 27 GDPR, if designated: name + address]

What we do not do

This site loads no third-party services: no external fonts, CDNs, analytics, trackers or embeds. Nothing is requested from another origin when you open a page, so no non-essential cookies are set and no consent banner is required.

Server logs

The site is hosted on our own server (VPS). The web server records standard access logs (IP address, date and time, requested URL, amount of data transferred, referrer and user agent), which are necessary for the secure and stable operation of the service (Art. 6(1)(f) GDPR; legitimate interest in operation, error diagnosis and defence against attacks). The data is not combined with other data sources and is not analysed to identify individual persons unless this is necessary to avert a threat.

Hosting provider: [hosting provider + server location]. Logs are retained for [server-log retention period] and then deleted automatically.

Contact form

If you use the contact form, we process the data you enter (name, email address and message) to handle and answer your enquiry (Art. 6(1)(b) GDPR where there is a contractual or pre-contractual context, otherwise Art. 6(1)(f) GDPR; legitimate interest in responding). The transmission is encrypted (TLS) to a fixed internal recipient address; the data is not passed on to third parties and is not used for any other purpose.

For spam protection the form uses server-side, self-hosted measures only (a hidden honeypot field plus a simple time and plausibility check). No third-party service such as reCAPTCHA is used, and no additional personal data is collected in the process.

Messages are retained for [contact-enquiry retention period]and then deleted, unless statutory retention obligations require otherwise.

International transfers

Insofar as our server or email provider is located outside the EU/EEA, this may involve a transfer of personal data to a third country. We base any such transfer on an adequacy decision of the EU Commission or, where none exists, on the EU Commission’s Standard Contractual Clauses (SCCs) together with supplementary safeguards (Art. 44 et seq. GDPR). Location of the infrastructure used:[server location / email-provider location: EU or third country]. If the infrastructure is located entirely within the EU/EEA, no third-country transfer takes place.

Retention

We store personal data only for as long as is necessary for the respective purposes or as required by statutory retention periods. The specific periods for server logs and contact enquiries are stated in the relevant sections above.

Your rights

Subject to the statutory conditions, you have the right of access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and the right to object to processing (Art. 21 GDPR). Where processing is based on consent, you may withdraw that consent at any time with effect for the future. To exercise your rights, an informal message to [hello@eigenstack.llc] is sufficient.

Right to lodge a complaint

Without prejudice to any other remedy, you have the right to lodge a complaint with a data protection supervisory authority, generally the authority of your habitual residence, place of work or the place of the alleged infringement (Art. 77 GDPR). As the controller has no establishment in the EU, the competent authority is not determined via a German establishment; the supervisory authority of the respective EU member state is competent.[Optional: competent / lead supervisory authority, name + address]

Last updated: [Month Year].