Privacy Policy

Status: September 2026

1. Controller

Paradoxx UG (haftungsbeschränkt)
weserberg.net – IT services
Danksteder Straße 11, 26316 Varel, Germany
Email: kontakt@weserberg.net

Represented by the managing director: Dr. Yuno Rolfes

Commercial register: Amtsgericht Oldenburg (Oldenburg), HRB 223956

No data protection officer is required (§ 38 BDSG). For all data protection questions, write to the address above.

2. Summary

This website sets no cookies and uses no tracking, analytics, advertising or social media services.
All fonts, scripts and images are served from our own server. Your browser does not contact any third-party server when you visit the site.
We process your data only to deliver the website, to protect it against attacks, and to answer your enquiry.

3. Hosting and infrastructure

The website, the contact form and our e-mail service run on servers in Germany that are administered by us. We do not use an external hosting provider.

For availability, the data is mirrored hourly to a standby server at the same site and daily to a backup server at a second site in Germany, over an encrypted connection. The mirrors follow the main server: data deleted there disappears from the mirrors within one day. In addition, daily database backups are kept for 14 days. Deleted data therefore disappears from all copies after 14 days at the latest.

The HTTPS certificates are issued by Let's Encrypt (Internet Security Research Group, USA). No visitor data is sent to Let's Encrypt.

4. Server log files

Each time you open a page, the web server logs: the IP address of your device, date and time, the page requested, the referrer, the HTTP status, the amount of data transferred, and the browser identification (user agent).

Purpose: secure and stable operation, detection and defence against attacks. Legal basis: Art. 6(1)(f) GDPR; our legitimate interest is the security of the website. The log files are deleted automatically after 14 days at the latest. They are kept longer only if a specific attack has to be investigated, and only until that is done.

Attack protection with CrowdSec: software on our server evaluates the log files. If requests from an IP address match known attack patterns, that IP address is blocked, and the IP address, time and type of attack are reported to CrowdSec SAS, Paris, France. In return we receive a list of IP addresses known to attack. Legal basis: Art. 6(1)(f) GDPR (protection against attacks).

5. Language setting (no cookie)

If you switch the language, your browser stores the choice ("de" or "en") in its local storage so the site stays in that language. After the contact hint has been shown or closed once, a marker is kept in the session storage so that it does not appear again; it is deleted when you close the tab. These values never leave your device. This storage is strictly necessary for the functions you use (§ 25(2) no. 2 TDDDG).

6. Contact form

The contact form sends the fields you fill in (name, optionally organisation, e-mail address, type of enquiry, message) and the page language to our own server. There the enquiry is stored in our enquiry list and sent to our own mailbox. Your IP address is used only briefly in working memory to limit repeated submissions; it is not stored with the enquiry. No third-party form service is used.

Legal basis: Art. 6(1)(b) GDPR (steps prior to a contract), otherwise Art. 6(1)(f) GDPR (answering enquiries; limiting abuse). Providing the data is voluntary; without a name and e-mail address we cannot answer. We delete the enquiry from the enquiry list and our mailbox 6 months after our last contact if no contract follows. If a contract follows, business letters are kept for 6 years and accounting records for 8 years (§ 257 HGB, § 147 AO).

7. Contact by e-mail or telephone

If you write to us or call us, we process your details (e.g. name, e-mail address, telephone number, content of the message) to handle your enquiry. E-mails are received and stored on our own mail server (see section 8). Legal basis, voluntariness and retention are the same as in section 6.

8. Our own mail server (mail.weserberg.net)

We run our own mail server; mail for weserberg.net is not handled by an external e-mail provider. The server also hosts mailboxes for customer organisations. For those mailboxes we act as a processor on behalf of the organisation (Art. 28 GDPR); the organisation's privacy policy applies.

Data: mailbox holders' account data (address, name, password stored only as a hash); content, attachments and metadata of e-mails; log data (IP addresses at login and delivery, times, failed logins). Legal basis: Art. 6(1)(b) GDPR for providing the service, Art. 6(1)(f) GDPR for log data (security, abuse detection); the secrecy of telecommunications (§ 3 TDDDG) is observed.

Spam and virus protection: incoming e-mails are checked automatically on our own server. For this, the IP address of the sending mail server, domain names from links in the message and, in part, checksums of e-mail addresses are queried against public DNS blocklists (e.g. Spamhaus, SURBL, URIBL, Mailspike, SenderScore/Validity, Barracuda Networks, SpamCop/Cisco); some of these operators are based in the USA. In addition, irreversible checksums (hashes) of parts of the message are compared with the checksum service of the Rspamd project (rspamd.com). The readable content of your e-mail is not transmitted. Legal basis: Art. 6(1)(f) GDPR (protection against spam and malware).

Retention: e-mails remain until they are deleted by the mailbox holder; they then disappear from all copies as described in section 3. If the main server cannot be reached, the backup server accepts incoming mail and holds it only until it can be delivered. Mail server logs, including webmail access logs, are deleted after 5 weeks at the latest. The webmail at mail.weserberg.net sets one session cookie that is strictly necessary for login (§ 25(2) no. 2 TDDDG).

9. Recipients and transfers to third countries

CrowdSec SAS, France: IP addresses of attackers (section 4).
Operators of spam blocklists and the Rspamd checksum service: server IP addresses, link domains and checksums (section 8). Some are based in the USA, so these queries can reach the USA.
Beyond this, we pass on data only if the law requires us to (e.g. to authorities).

There is no automated decision-making, including profiling (Art. 22 GDPR).

10. Your rights

Access to your data (Art. 15 GDPR)
Rectification (Art. 16 GDPR)
Erasure (Art. 17 GDPR)
Restriction of processing (Art. 18 GDPR)
Data portability (Art. 20 GDPR)
Objection (Art. 21 GDPR, see section 11)

To exercise them, an informal message to kontakt@weserberg.net is enough. You also have the right to lodge a complaint with a supervisory authority (Art. 77 GDPR). The authority responsible for us is: Der Landesbeauftragte für den Datenschutz Niedersachsen (LfD Niedersachsen, the Lower Saxony data protection authority), Prinzenstraße 5, 30159 Hannover, www.lfd.niedersachsen.de.

11. Right to object (Art. 21 GDPR)

Where we process your data on the basis of Art. 6(1)(f) GDPR (legitimate interests), you have the right to object at any time, on grounds relating to your particular situation. We will then stop the processing unless we can demonstrate compelling legitimate grounds that override your interests, rights and freedoms, or the processing serves the establishment, exercise or defence of legal claims. An informal message to kontakt@weserberg.net is enough.

12. Changes

We update this policy when the website or our services change. The current version is always available on this page.