Privacy policy

1. Who is responsible

The controller for the processing described here is:

2. Cookies and tracking

This website sets no cookies, embeds no third-party scripts and runs no analytics. Nothing about your visit is used to profile you or to advertise to you. That is why you are not being asked to accept anything.

3. When you email us

What we collect

Your email address and whatever you choose to put in the message — normally a store URL and a company name.

Why

To run the requested check and reply to you with the result.

Legal basis

Article 6(1)(b) GDPR — steps taken at your request before entering into a contract.

Who else sees it

There is no form and no form provider. Your message goes straight to our mailbox, which is hosted by Google Workspace (Google Ireland Limited) as our processor under a data processing agreement.

How long we keep it

Twelve months after our last contact, unless you become a client, in which case statutory retention periods for business correspondence apply.

4. When you visit this website

What is collected

This site is hosted on GitHub Pages, operated by GitHub, Inc. Their servers record standard access log data: IP address, date and time, the page requested, and the browser identifier your browser sends. We have no access to those logs and build no profile from them.

Why

To deliver the site and to keep it secure and available.

Legal basis

Article 6(1)(f) GDPR — our legitimate interest in operating a secure website.

How long

Retention is governed by GitHub's own privacy statement, which you can read at docs.github.com.

5. What we look at when we scan a website

When you ask us to audit a webshop, we review publicly accessible pages within the agreed scope and process the business information needed to produce the requested findings. We do not sign in, place orders, access authenticated areas or intentionally collect customer data. Our crawler identifies itself and respects robots.txt; further information is available on our crawler transparency page.

6. Transfers outside the EU

Two of our processors are reachable from the United States. GitHub, Inc. hosts this website and is certified under the EU-U.S. Data Privacy Framework; it also offers Standard Contractual Clauses. Google Workspace is contracted through Google Ireland Limited, with the same frameworks in place for any onward transfer. We tell you this rather than claiming everything stays in Europe, because it does not.

7. Your rights

Under the GDPR you have the right to:

• access the personal data we hold about you (Article 15);
• have inaccurate data corrected (Article 16);
• have your data erased (Article 17);
• restrict how we process it (Article 18);
• receive it in a portable format (Article 20);
• object to processing based on legitimate interest (Article 21).

To exercise any of these, write to hallo@elbebridge.com. You do not need to give a reason and it costs you nothing.

8. Complaints

You can complain to a data protection supervisory authority. The competent authority for us is the Hamburgische Beauftragte für Datenschutz und Informationsfreiheit (Hamburg Commissioner for Data Protection and Freedom of Information).

9. Changes

If we change how we handle data, we update this page and the date at the top. We keep previous versions on file.