Privacy notice

This notice explains which personal data we process when you visit our website littletug.com or send us an email. The controller is Vegvisir Consulting GmbH. Its address and register details are at the end of this page under “Controller”. For any question about data protection, write to hello@littletug.com.

The website tells you about Littletug. It has no user accounts, no forms and no newsletter. It sets no cookies, and the only thing it loads from another provider is the script of our audience measurement (Plausible). Data arises only when you open pages, in our audience measurement and when you write to us.

Hosting

The website runs on a server we rent from Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany. The server is in a Hetzner data centre in Germany. Hetzner backs up the server’s disk daily at the same location and deletes each backup after seven days. Hetzner processes the data that arises when the website is visited only on our behalf and on our instructions. We have concluded a data processing agreement with Hetzner under Art. 28 GDPR for this. We manage the operating system, the web server and the logging ourselves.

Visiting the website and the access log

When you open a page, your browser sends our server the data it technically needs to deliver the page. Our server records these details in an access log:

• your IP address, shortened
• the date and time of the request
• the address requested and the method and protocol of the request
• the status code of the response, the amount of data transferred and the processing time
• the details your browser sends with every request, including your browser and operating system (user agent), the page you came from (referrer) and your language setting

The IP address is shortened before it is stored: an IPv4 address keeps the first three of its four blocks, an IPv6 address its first 48 bits. The log file is replaced daily, and every entry is deleted after seven days at the latest. It disappears from the server’s backups (see “Hosting”) no later than 14 days after the request. If a request or the set-up of an encrypted connection fails, our server records the details in an error log, to which the same applies. If entries show an attack, we keep the entries concerned until the incident has been dealt with.

We process this data to deliver the website, keep it secure, detect and fend off attacks and misuse, and find faults. The legal basis is Art. 6(1)(f) GDPR. Our legitimate interest lies in exactly these purposes.

If you open littletug.com without a language in the path, the server sends you to the German or English version according to your browser’s language setting. It makes no other use of this setting.

Providing this data is not required by law or by contract. Without it, however, the website cannot be displayed.

Audience measurement with Plausible

To understand how many people visit the website, where they come from and what interests them, we use Plausible Analytics, provided by Plausible Insights OÜ, Västriku tn 2, 50403 Tartu, Estonia.

Every page of the website loads a script from Plausible. With it, your browser sends the following directly to Plausible: the address of the page, the page you came from (referrer), how far down the page you scroll and how long you actively view it. If you click a button to log in or to get started, it also sends which button you chose and where; for the prices, together with the plan and the billing period you selected. If you switch between monthly and annual billing on the prices, it sends the billing period you chose. If you open an address that does not exist, it reports this as an error page. With each of these reports, Plausible receives your IP address and your browser’s identifier (user agent).

From the IP address, the user agent, the website’s domain and a random value that changes daily, Plausible calculates a hash that groups the page views of one day into a visit. Plausible deletes old random values after three days at the latest, so visits on different days are not linked to each other. From the user agent, Plausible derives the browser, operating system and device type; from the IP address, the approximate country, region and city. Plausible does not store the IP address or the user agent themselves. We see the data only as aggregated statistics. We keep the statistics for as long as we use Plausible. If we stop using it, Plausible deletes them, and removes them from its backups within 30 days.

The measurement sets no cookies and stores nothing on your device. Before each report, the script reads an entry called “plausible_ignore” from your browser’s local storage. Our website never creates this entry; if it exists, the script sends nothing. Plausible processes the data as our processor, on our instructions and only within the EU, with sub-processors in Germany (Hetzner), Finland (UpCloud) and Slovenia (Bunny). The data processing agreement under Art. 28 GDPR applies through our use of the service.

The legal basis is Art. 6(1)(f) GDPR. Our legitimate interest is to measure the reach of the website and to see whether visitors are interested and in what, so that we can improve the website and what we offer. You can object to the measurement; see “Right to object”. The measurement is not required by law or by contract, and it is not needed for you to use the website.

Contacting us by email

When you send us an email, we process your email address, your name if you give it, the content of your message with any attachments, and the date and time, in order to answer your enquiry. The legal basis is Art. 6(1)(b) GDPR where your enquiry is aimed at a contract with us, and Art. 6(1)(f) GDPR otherwise. Our legitimate interest is to answer enquiries.

Our mailbox is hosted by Gandi SAS, 63-65 boulevard Masséna, 75013 Paris, France. Gandi stores the emails as our processor, on our behalf, under a data processing agreement in accordance with Art. 28 GDPR.

We delete your emails once your matter is settled and no further message is expected, and no later than twelve months after the last message. Where we have to keep an email as a business letter (§ 257 HGB, the German Commercial Code, and § 147 AO, the German Fiscal Code), we store it for the statutory period of six years, counted from the end of the calendar year in which we received or sent it. The legal basis for this is Art. 6(1)(c) GDPR.

Writing to us is your free choice. On their way to us, emails are not protected against being read throughout. Please do not send us confidential information by email.

Cookies and content from other providers

This website sets no cookies and places no identifier on your device by which you could be recognised. Your browser loads all content, including fonts and scripts, from our own server. The one exception is the script of the audience measurement: your browser loads it from Plausible and sends the measurement data there (see “Audience measurement with Plausible”).

Recipients and countries outside the EU

The only recipients of your data are the service providers named above, Hetzner, Plausible and Gandi, who act on our behalf, and public authorities where we are legally obliged to disclose data. All three process the data in the European Union. We do not transfer any data to countries outside the EU and the EEA.

Your rights

You have the right of access to the data we process about you (Art. 15 GDPR), to rectification (Art. 16 GDPR), to erasure (Art. 17 GDPR) and to restriction of processing (Art. 18 GDPR). Where we process your emails with a view to a contract, you also have the right to data portability (Art. 20 GDPR). To exercise these rights, write to hello@littletug.com or to the address at the end of this page.

We cannot identify individual visitors from shortened IP addresses or from the statistics of the audience measurement. For this data, we can only meet your rights if you give us details that let us find you in it (Art. 11(2) GDPR).

Right to object

Where we process data on the basis of Art. 6(1)(f) GDPR, that is in the access log, in the audience measurement and for emails not related to a contract, you may object to this processing at any time on grounds relating to your particular situation (Art. 21(1) GDPR). We will then stop processing the data unless we can demonstrate compelling legitimate grounds that override your interests, rights and freedoms, or the processing serves the establishment, exercise or defence of legal claims. The access log is necessary to run the website securely, so we will usually be unable to act on an objection to it. Your objection needs no particular form. Send it to hello@littletug.com.

You can also prevent the audience measurement yourself: if you block scripts in your browser or use a content blocker that blocks Plausible, your browser sends nothing to Plausible.

Right to complain

You have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR), in particular in the Member State of your habitual residence, your place of work or the place of the alleged infringement. The authority responsible for us is:

Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen (LDI NRW), the data protection authority of North Rhine-Westphalia
Kavalleriestr. 2-4, 40213 Düsseldorf, Germany
poststelle@ldi.nrw.de, telephone +49 211 38424-0
www.ldi.nrw.de

Automated decisions

We make no automated decisions within the meaning of Art. 22 GDPR and create no profiles.

Changes and language versions

We update this notice when the processing changes. The date above the text shows the current version. This notice is available in German and in English. If the two versions differ, the German version prevails.