Effective Date: 25th July 2026
1. Controller
Koifluence LLC is the data controller for this website.
Contact: [INSERT NAME], [INSERT EMAIL ADDRESS], [INSERT PHONE NUMBER]
Address: [INSERT PHYSICAL ADDRESS]
A Data Protection Officer has not been appointed as the organization does not meet the mandatory criteria under GDPR Article 37(1).
2. What data we collect
Server logs: Servers hosted in Germany. Logs include abbreviated IP addresses (last octet removed, e.g., 192.168.1.0), timestamps, page accessed, browser type, and operating system. Abbreviated IP addresses cannot be linked to individuals and are therefore anonymized. Retention: 90 days or as necessary for security investigation.
Website analytics: Counter.dev collects and aggregates pageviews, referrer data, browser type, operating system, device type, screen size, language preference, and country. Data is saved anonymously in aggregated form only (hourly, daily, weekly, monthly, yearly). Counter.dev does not retain individual data points, only statistical aggregations. Hosted in Germany (Linode Frankfurt datacenter).
Contact form submissions: Email address, name (optional), and message content. We use this data to respond to your inquiry and provide customer support.
3. Legal basis and purpose for processing
Server logs (IP addresses, timestamps)
- Legal basis: Legitimate interest (Article 6(1)(f))
- Purpose: Ensure website stability, detect and prevent unauthorized access, and maintain security
- Balancing test: The controller’s interest in website security and operation is not overridden by data subjects’ privacy interests, as processing is limited to technical data necessary for infrastructure operation, data is retained only as long as necessary, and data subjects can reasonably expect such processing for website functionality
Website analytics (pageviews, referrer, browser, OS, country via Counter.dev)
- Legal basis: Legitimate interest (Article 6(1)(f))
- Purpose: Understand user behavior and optimize website performance
- Balancing test: The controller’s interest in understanding website usage to improve user experience is proportionate and not overridden by data subject interests, as Counter.dev processes aggregated data without IP fingerprinting, individual tracking is minimized, and data subjects have a reasonable expectation that analytics are used on websites
Contact form submissions (email, name, message)
- Legal basis: Contract performance (Article 6(1)(b)) for responding to inquiries and legitimate interest (Article 6(1)(f)) for resolving questions
- Purpose: Respond to user inquiries and provide customer support
- Not used for marketing without explicit consent
4. Data retention
- Server logs: As necessary for server operation, not to exceed 90 days.
- Counter.dev analytics: Aggregated data only, not personal data. No specific retention period applies.
- Contact form submissions: General inquiries: 2 years. Service orders: 7 years (for dispute/refund handling).
5. Your rights
You have the right to:
- Request access to your personal data (Article 15)
- Request correction of inaccurate data (Article 16)
- Request erasure of your data (Article 17)
- Request restriction of processing (Article 18)
- Object to processing (Article 21)
- Request data portability in a structured, machine-readable format (Article 20)
- Withdraw consent at any time without affecting the lawfulness of prior processing (Article 7(3))
- Lodge a complaint with your data protection authority
To exercise these rights, contact the controller using the details in section 1.
6. Data processors
- Counter.dev: Website analytics (EU data centers, Germany)
- Zoho Mail (EU): Contact form submissions are processed in EU datacenters located in the Netherlands and Ireland via mail.zoho.eu. No third country transfer occurs.
7. Security
Contact form submissions are processed by Zoho Mail (processor), which implements ISO 27001 and SOC 2 Type 2 certified security controls, including AES-256 encryption at rest (EAR) and TLS encryption in transit. Data is stored in EU datacenters in the Netherlands and Ireland.
Server logs containing IP addresses and timestamps are protected through HTTPS encryption in transit and access controls.
8. Changes to this policy
Updates posted here with new effective date.
9. Contact
[INSERT NAME] [INSERT EMAIL ADDRESS] [INSERT PHONE NUMBER] [INSERT PHYSICAL ADDRESS]