Privacy

Privacy policy

1. Controller

The controller for processing personal data under the EU General Data Protection Regulation (GDPR) is:

The Papa Company UG (haftungsbeschränkt)
Pestelstr. 38–40
49324 Melle
Germany

Represented by managing director: Moritz Groppel

2. Hosting (Vercel)

This website is delivered via Vercel Inc., 440 N Barranca Ave #4133, Covina, CA 91723, USA (“Vercel”). When you visit the site, technically necessary data may be processed (e.g. IP address, date and time of the request, amount of data transferred, browser type) to provide and secure the service.

Legal basis: Art. 6 (1) (f) GDPR (legitimate interest in a secure, stable website). Where Vercel processes data in the USA, transfers rely on appropriate safeguards under Art. 44 et seq. GDPR — e.g. standard contractual clauses (Art. 46 GDPR), an adequacy decision (Art. 45 GDPR), or, as described by Vercel, the EU-US Data Privacy Framework.

More information: Vercel Privacy Policy.

3. Domain and DNS (one.com)

The domain is registered and managed through the one.com Group (one.com Group AB, Sweden — “one.com”). Personal data may be processed for contract fulfilment and technical DNS/domain services.

Legal basis: Art. 6 (1) (b) GDPR (domain/hosting contract) and, where applicable, Art. 6 (1) (f) GDPR for technical logs.

More information: one.com privacy policy.

4. Fonts (Google Fonts)

This site loads fonts via Google Fonts (provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland; possibly Google LLC, USA), including DM Sans and Instrument Serif. Loading the page may connect your browser to Google’s servers; Google may process your IP address in particular.

Legal basis: Art. 6 (1) (f) GDPR (consistent, readable presentation). Transfers to the USA are subject to the mechanisms described in section 2.

More information: Google Privacy Policy.

Note: Hosting fonts locally would reduce third-party requests; this statement would then need updating.

5. Contact by email

If you email us, we process the data you provide (e.g. sender address, message content) to handle your request.

Legal basis: Art. 6 (1) (b) GDPR (pre-contractual steps or contract) and/or Art. 6 (1) (f) GDPR (communication with prospects and partners).

6. No cookies / no analytics (as of this version)

This static site does not use our own tracking cookies or embedded web analytics. If you add analytics or similar tools later, this policy must be updated and consent may be required.

7. Storage period

Server and access logs at the host are kept only as long as needed for security and operations or as required by law. We retain email correspondence as long as the business relationship or legal duties require.

8. Your rights

Where the legal requirements are met, you have the right to access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction (Art. 18), data portability (Art. 20), and objection (Art. 21). If processing is based on consent, you may withdraw it with effect for the future (Art. 7 (3) GDPR).

9. Right to complain

You have the right to lodge a complaint with a supervisory authority, in particular in the member state of your habitual residence, workplace, or the place of the alleged infringement. Authorities in Germany are listed at bfdi.bund.de.

10. Changes

We may update this privacy policy if the law, this website, or our services change. The version published on this site applies.

Last updated: April 2026