Privacy policy

1. Controller

The controller responsible for data processing on this website within the meaning of the General Data Protection Regulation (GDPR) is:

CódigoWorks
Langern 23
31592 Stolzenau
Germany

Email: kontakt@codigoworks.de
Phone: +34 900 968 009

2. General information on processing

We process personal data only as far as necessary to provide a functional website and to handle incoming enquiries. Processing is based on the GDPR and applicable German data protection law (BDSG).

Where we request consent, the legal basis is Art. 6(1)(a) GDPR. Processing necessary to perform a contract or take pre-contractual steps is based on Art. 6(1)(b) GDPR. Where processing is required to comply with a legal obligation, Art. 6(1)(c) GDPR applies. Otherwise we rely on our legitimate interests under Art. 6(1)(f) GDPR – in particular a secure, stable and auditable operation of this website.

This website is intended for companies and business partners. There is no contact form and no open consumer funnel. Direct communication is by email only.

3. Hosting and server log files

This website runs on infrastructure provided by us or on our behalf. When you access the website, technically necessary connection data are processed in server log files.

• IP address
• Date and time of the request
• Requested URL / path
• HTTP status code
• Amount of data transferred
• Referrer URL (if transmitted)
• User agent (browser type/version, operating system)

3.1 Purpose and legal basis

Processing serves the technical delivery of the website, system security, error analysis and prevention of abuse. Legal basis: Art. 6(1)(f) GDPR (legitimate interest in a secure and functional online offering).

3.2 Retention

Log data are stored only as long as needed for the purposes above and are then deleted or anonymised, unless longer retention is required for security or evidentiary reasons.

4. Contact by email

If you contact us by email, we process the data you send (in particular email address, name if provided, message content and technical metadata of the transmission) to handle and, where necessary, follow up on your request.

Legal basis is Art. 6(1)(b) GDPR where the request relates to entering into or performing a contract; otherwise Art. 6(1)(f) GDPR (legitimate interest in handling and documenting business correspondence).

Data are deleted once no longer required for the purpose, unless statutory retention obligations apply. Business correspondence may in particular be retained under commercial and tax rules.

5. Reach measurement (first-party analytics)

To measure use of our website in anonymised or pseudonymised form, we operate our own analytics. The tracking script is loaded from server.codigoworks.net; event data are sent to the same endpoint. This is not a third-party ad network and not Google Analytics.

In particular, the following data may be processed:

• Page path and host
• Time of the visit and heartbeat signals while the page remains open
• Referrer (if available)
• Pseudonymous visitor and session IDs (in the browser’s localStorage / sessionStorage)
• Technical details such as user agent and IP address (for security and aggregation)

5.1 Purpose and legal basis

Purpose: measuring reach, page views and technical stability, and improving our offering. Legal basis: Art. 6(1)(f) GDPR (legitimate interest in reach analysis and operational security).

5.2 Retention and objection

Analytics events are generally retained for up to 400 days and then deleted. Short-lived presence data (live status) are purged much earlier.

You may object by clearing the IDs in your browser, disabling local/session storage for this site, or blocking the script technically (e.g. via browser settings). Objection may limit usage analysis but usually does not affect core website functions.

6. Cookies and local storage

We do not use classic third-party tracking cookies for analytics. For recognition within or across sessions, the browser’s localStorage and sessionStorage (pseudonymous IDs) may be used.

Technically necessary browser storage during ordinary page loads remains unaffected. A cookie consent banner is not required for the current measurements based on legitimate interest; you may still delete or block storage in your browser at any time.

7. SSL/TLS encryption

This website uses SSL/TLS encryption to protect data in transit between your browser and our server. An encrypted connection is usually indicated by “https://” in the address bar and a padlock icon.

8. Disclosure of data

We disclose personal data to third parties only where necessary to perform a contract, where required by law, where you have consented, or where disclosure is permitted based on a legitimate interest and your interests do not override.

Where we use processors (e.g. for hosting or infrastructure), this is done under Art. 28 GDPR and corresponding agreements.

9. Retention (general)

Unless a more specific period is stated in this policy, personal data are kept only as long as needed for the respective purposes or as required by law. After the purpose ceases or the period expires, data are deleted or restricted.

10. Your rights

Subject to statutory conditions, you have the following rights vis-à-vis the controller:

• Right of access (Art. 15 GDPR)
• Right to rectification (Art. 16 GDPR)
• Right to erasure (Art. 17 GDPR)
• Right to restriction of processing (Art. 18 GDPR)
• Right to data portability (Art. 20 GDPR)
• Right to object to processing based on Art. 6(1)(e) or (f) GDPR (Art. 21 GDPR)
• Right to withdraw consent with effect for the future (Art. 7(3) GDPR)

10.1 Right to lodge a complaint

You have the right to lodge a complaint with a data protection supervisory authority about our processing of your personal data. This is typically the authority of your habitual residence, place of work or the place of the alleged infringement. For our registered location in Lower Saxony (Germany), this is usually:

The State Commissioner for Data Protection of Lower Saxony
Prinzenstraße 5
30159 Hannover
Germany
https://www.lfd.niedersachsen.de

11. Obligation to provide data

Providing personal data is neither legally nor contractually mandatory merely to browse the website. Without the technically required connection data, however, the site cannot be delivered. If you email us, a valid sender address is required for a reply.

12. Automated decision-making

No automated decision-making including profiling within the meaning of Art. 22 GDPR takes place.

13. Updates to this privacy policy

We may update this privacy policy to reflect legal requirements or changes to our services. The version current at the time of your visit applies.