Privacy Policy

The controller within the meaning of Art. 4 (7) GDPR is Gowsik Chandran, Highbury Tech, Zeppelinstr. 12, 26121 Oldenburg, Germany.

You can reach us at hello@highburytech.com or +49 152 38042797. No data protection officer is appointed; the thresholds in § 38 BDSG are not met.

This site runs on Amazon Web Services in the eu-central-1 region (Frankfurt), served through Amazon CloudFront. Every request produces a log entry containing your IP address, the time of the request, the page requested, the referring page, and your browser and operating system.

These logs exist to keep the site available and to investigate faults and abuse. The legal basis is Art. 6 (1) (f) GDPR — our legitimate interest in operating the site securely. They are not used to identify you and are not combined with other data.

If you use the contact form we process the name, email address, optional company name and message you provide. The submission is stored in our database and sent to us by email so we can reply.

The legal basis is Art. 6 (1) (b) GDPR where your enquiry relates to a possible engagement, and Art. 6 (1) (a) GDPR on the basis of the consent you give with the checkbox. You can withdraw that consent at any time with effect for the future by emailing us.

You also receive a confirmation email. Both the confirmation and our internal notification are sent through Amazon SES in eu-central-1.

The contact form is protected by Cloudflare Turnstile. When you submit the form, Turnstile receives your IP address and technical signals about your browser in order to distinguish people from automated submissions. No cookie is set for this purpose.

The legal basis is Art. 6 (1) (f) GDPR — our legitimate interest in not receiving automated spam. Provider: Cloudflare, Inc., 101 Townsend St, San Francisco, CA 94107, USA.

The "Book a call" button opens a scheduling window provided by Cal.com. Nothing is loaded from Cal.com until you click it. If you book, Cal.com processes the name, email address and time zone you enter, and the appointment itself.

The legal basis is Art. 6 (1) (b) GDPR — steps taken at your request prior to entering into a contract. Provider: Cal.com, Inc., 2261 Market Street, San Francisco, CA 94114, USA.

We use Google Analytics 4 to understand how the site is used. Nothing is requested from Google, no script is loaded and no cookie is set unless you have actively agreed through the banner. Declining loads nothing at all and changes nothing about how the site works.

If you agree, Google processes your IP address (shortened), the pages you view, approximate location, and technical details about your device. The legal basis is your consent under Art. 6 (1) (a) GDPR and § 25 (1) TDDDG.

You can withdraw consent at any time through "Cookie settings" in the footer. Provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, which may transfer data to Google LLC in the USA.

Your choice itself is stored in your browser's local storage so we do not ask again. Storing that preference does not require consent under § 25 (2) TDDDG, because it is strictly necessary to provide the function you asked for.

Each of these processes data on our behalf under a data processing agreement pursuant to Art. 28 GDPR:

Amazon Web Services

Hosting, content delivery, media storage and outbound email. Region eu-central-1 (Frankfurt).

Neon

Managed PostgreSQL database holding contact submissions. Region eu-central-1 (Frankfurt).

Cloudflare

DNS for highburytech.com, and Turnstile spam protection on the contact form.

Cal.com

Appointment scheduling, loaded only when you choose to book.

Zoho Corporation

Email hosting for our @highburytech.com mailboxes, where enquiries are received and answered.

Google Ireland

Google Analytics 4. Active only after you consent.

Hosting and the database stay within the EU. Some of the services above are operated from, or may transfer data to, countries outside the EU:

• Google — USA. Transfers are based on the EU Standard Contractual Clauses and Google's certification under the EU-US Data Privacy Framework.
• Cloudflare — USA. Transfers are based on the EU Standard Contractual Clauses.
• Cal.com — USA. Transfers are based on the EU Standard Contractual Clauses.
• Zoho — our mailboxes are hosted in Zoho's India data centre, so email we receive is processed there. Transfers are based on the EU Standard Contractual Clauses.

Contact enquiries are kept for as long as needed to deal with them and for any follow-up correspondence, and are deleted once that purpose has ended and no statutory retention period applies. Commercial and tax retention obligations under § 257 HGB and § 147 AO can require six or ten years for documents that become part of a business relationship.

Server logs are held only briefly for operations and security, and are deleted automatically thereafter.

Under the GDPR you have the right to request access to your data (Art. 15), correction of inaccurate data (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), portability (Art. 20), and to object to processing based on legitimate interests (Art. 21). Where processing rests on consent, you may withdraw it at any time with effect for the future.

To exercise any of these, email hello@highburytech.com. We do not charge for this and we will respond within one month.

If you believe we are handling your data unlawfully, you can complain to a supervisory authority. The one responsible for us is Die Landesbeauftragte für den Datenschutz Niedersachsen, Prinzenstraße 5, 30159 Hannover, Germany. You may also complain to the authority where you live or work.

We update this policy when the site changes — when a service is added or removed, for example. The date at the top always reflects the current version.