Privacy Policy

1. Controller

The controller for data processing on this website is:

Further provider details are set out in the imprint.

2. Data protection officer

No data protection officer has been appointed, because none is required. Fewer than 20 people are permanently engaged in the automated processing of personal data (Section 38(1) of the German Federal Data Protection Act), and none of the cases in Article 37(1) GDPR apply.

3. Hosting and server log files

This website is hosted on Appwrite Cloud and served from a data centre in Frankfurt am Main, that is, within the European Union. Appwrite Cloud is operated by Appwrite Code LTD and Appwrite Code, Inc.

When you open a page, your browser transmits technically necessary data which the server records in log files:

• IP address of the requesting device
• Date and time of the request
• Name and path of the resource requested
• Referrer URL, that is, the page visited previously
• User agent, that is, browser and operating system identification

This data is not combined with other sources and is not used to identify you as a person. It is, however, necessary to deliver the page at all, and it helps detect faults and attacks.

The legal basis is Article 6(1)(f) GDPR. The legitimate interest lies in the secure and trouble-free operation of the website.

The log files are deleted automatically by the hosting provider after 7 days.

Processing agreement and sub-processors

A data processing agreement under Article 28 GDPR is in place with the hosting provider. The provider processes the data solely on instruction for the purpose of operating this website. Further information on data protection at the provider is available at appwrite.io/privacy.

The provider in turn engages sub-processors. For cloud infrastructure and web security these include, according to the list attached to the data processing agreement, DigitalOcean, Fastly and Cloudflare.

Transfers to third countries

The server is located in Frankfurt am Main. Even so, access from third countries cannot be ruled out: Appwrite provides operations and support through affiliated companies in the United States and Israel, and some of the sub-processors engaged are based in the United States.

For transfers to countries without an adequacy decision (here primarily the United States), the provider has entered into the European Commission's Standard Contractual Clauses. These constitute appropriate safeguards within the meaning of Article 46(2)(c) GDPR. Israel is covered by an adequacy decision of the European Commission, so no additional safeguards are required there.

This concerns the access data listed above only. No further data is transmitted to the provider through this website.

4. No external content

This website loads no resources from third-party servers. Fonts, images, videos, icons and scripts are served exclusively from the same server as the website itself. In particular, no Google Fonts, no content delivery network, no embedded map, no video embedded from a video platform and no comparable third-party content is used.

This means that simply visiting this website transmits your IP address to no one other than the hosting provider and its sub-processors, both named under point 3. No connection is established to servers operated by Google, Meta or any other provider.

The website does contain links to the Pastro app at pantry.pastro.app. A connection to that service is established only once you click such a link.

5. No analytics or tracking

No web analytics tool is embedded on this website. There is no audience measurement, no counting of visits, no evaluation of clicks, no creation of usage profiles and no setting of recognition identifiers. No advertising networks, social media plugins or conversion trackers are integrated.

The only access data generated at all are the server log files described under point 3.

6. Contact by email

This website has no contact form and no sign-up for a waiting list or newsletter. Contact only comes about if you write to pastro.app.contact@gmail.com of your own accord.

In that case the data processed is your email address, the content of your message, and any further details you choose to provide, such as your name.

Providing this data is neither required by law nor by contract. Without a sender address, however, your enquiry cannot be answered.

Google as the mailbox provider

This contact address is a Gmail mailbox. That means Google, as the provider of the email service, receives, stores and technically processes the messages, including the content of your message. For users in the European Economic Area the provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland.

This may involve a transfer of data to Google LLC in the United States. Google LLC is certified under the EU-US Data Privacy Framework. Transfers to certified companies in the United States are therefore covered by the adequacy decision of the European Commission of 10 July 2023 (Article 45 GDPR).

If you would prefer to avoid this, please get in touch by another route, for example by post to the address given above.

Legal basis and deletion

The legal basis is Article 6(1)(b) GDPR where your enquiry relates to entering into or performing a contract. In all other cases it is Article 6(1)(f) GDPR, with the legitimate interest of responding to enquiries.

Your message is deleted once the matter has been dealt with conclusively and no statutory retention obligations apply. Retention obligations under commercial and tax law can delay deletion by up to ten years, for example in the case of business correspondence.

7. Cookies and local storage

This website sets no cookies. There is therefore no cookie banner either.

If you select a colour theme on the homepage, a single entry is stored in your browser's local storage:

The entry is created solely by that selection. If you merely visit the website without clicking a colour theme, nothing is stored. The entry contains no identifier that could be used to recognise you, and it is never transmitted to the server or to third parties. It stays on your device.

Storage is strictly necessary in order to provide the display you explicitly requested (Section 25(2) no. 2 of the German Telecommunications Digital Services Data Protection Act); no consent is required for it. You can delete the entry at any time through your browser settings, along with the other website data.

8. Retention periods

9. Your rights

You have the following rights vis-à-vis the controller:

• Access (Article 15 GDPR): you can find out whether and which data concerning you is processed.
• Rectification (Article 16 GDPR): inaccurate data must be corrected and incomplete data completed.
• Erasure (Article 17 GDPR): you can request the deletion of your data where no retention obligation applies.
• Restriction of processing (Article 18 GDPR): the data is then only stored and no longer otherwise used.
• Data portability (Article 20 GDPR): you can receive your data in a structured, commonly used and machine-readable format.

An informal message to pastro.app.contact@gmail.com is enough to exercise these rights. Exercising them is free of charge.

10. Right to lodge a complaint with a supervisory authority

Irrespective of the above, you may lodge a complaint with a data protection supervisory authority at any time (Article 77 GDPR), in particular in the member state of your habitual residence, place of work or the place of the alleged infringement.

The supervisory authority responsible for the controller is:

11. No automated decision-making

There is no automated decision-making within the meaning of Article 22 GDPR and no profiling. The data arising on this website is not used to evaluate or predict the characteristics, behaviour or interests of visitors.

12. The Pastro app

This privacy policy applies to this website only. The Pastro app is a separate service with a considerably larger feature set and, correspondingly, its own privacy policy. That policy is linked within the app and applies from the moment you use the app.