Updated: 19 October 2026
Controller
Stefan Bärisch
Marlene-Dietrich Str 21
80636 Munich, Germany
Phone: +49 15146528293
Email: web@stbaer.de
Website and hosting
This website runs on a DigitalOcean, LLC (USA) server in Frankfurt am Main, Germany. To deliver requested content and protect the service, the server processes your IP address, requested path, request time and technical information supplied by your browser. The legal basis is Article 6(1)(f) GDPR: our legitimate interest in operating a secure and reliable website.
DigitalOcean processes hosting data as a service provider. Its standard terms include a Data Processing Agreement. The server location does not mean that all processing takes place exclusively in the EU. For relevant international transfers, DigitalOcean's DPA specifies the EU-US Data Privacy Framework with standard contractual clauses as a fallback.
Request data and security
We do not keep routine HTTP access logs or use web analytics, advertising trackers or profiling. Technical data is processed to handle requests. Errors and security events may be logged separately and may include IP addresses or details of the affected request. This processing serves troubleshooting and protection against misuse, based on Article 6(1)(f) GDPR.
Error and security data is retained for as long as needed to investigate and resolve the relevant incident. Data that is no longer needed is deleted unless statutory retention duties or the establishment, exercise or defence of legal claims require further retention.
Cookies and protected downloads
The public pages do not set cookies. Only protected downloads under /files/ use necessary cookies: share_csrf protects forms against forged requests for up to one hour; share_grant retains access permission after successful password verification for up to eight hours. Both are scoped to the relevant share and are not used to track your behaviour. Logging out revokes access permission.
These cookies are necessary for the protected download you explicitly request (§25(2)(2) TDDDG). Password verification, session identifiers and IP-based limits on login attempts are processed under Article 6(1)(f) GDPR to restrict access to intended recipients and prevent misuse. Submitted passwords are checked but are not stored in access logs. Session and rate-limit records are held in memory; expired entries are cleared during subsequent checks, and all entries are cleared on service restart.
Shared files and filenames are stored to make them available to intended recipients. Where they contain personal data, the legal basis depends on the particular exchange. They are removed when the purpose of sharing ends unless legal duties or claims require further retention. Please contact us about any particular share.
Email enquiries
If you email us, we process your address, message, any names and attachments you provide, and communication metadata to handle your enquiry. General enquiries are handled under Article 6(1)(f) GDPR (our interest in responding); enquiries concerning a contract with you or steps before entering one are handled under Article 6(1)(b). Without the information necessary to reply, we may be unable to handle your request.
Our email provider is Fastmail Pty Ltd, Australia. The Fastmail Data Protection Agreement is enabled for the account. Primary storage is set to the EU; this does not exclude processing in other countries. Fastmail provides EU standard contractual clauses for relevant transfers. See its privacy policy for further information.
Correspondence is retained as long as needed to handle the enquiry and any follow-up questions. It is then deleted unless statutory retention duties or specific legal claims require further retention.
External links and encryption
External websites are reached through ordinary links; we do not embed external videos, fonts or social-media widgets. Following a link allows the destination provider to process data under its own policies. HTTPS encrypts transport to this website. This protects transmission but does not eliminate every security risk; email is not automatically end-to-end encrypted.
Your rights
Subject to the statutory conditions, you have rights of access, rectification, erasure, restriction and data portability under Articles 15–20 GDPR. You may withdraw any consent you have given at any time for the future, without affecting the lawfulness of earlier processing. Contact the controller using the details above.
Right to object under Article 21 GDPR
Where processing is based on legitimate interests, you may object on grounds relating to your particular situation. We will stop processing the affected data unless we demonstrate compelling legitimate grounds overriding your interests, rights and freedoms, or processing is needed for the establishment, exercise or defence of legal claims.
Complaints
You may complain to a supervisory authority, particularly in the country of your habitual residence, workplace or the alleged infringement. The Bavarian State Office for Data Protection Supervision (BayLDA) supervises private controllers in Bavaria.