Privacy policy

1. Controller

The controller within the meaning of the General Data Protection Regulation (GDPR) is:

Roman Zhuchenko
Phantom Lab
c/o Block Services
Stuttgarter Str. 106
70736 Fellbach
Germany
E-mail: kontakt@phantom-creator.com

There is no statutory obligation to appoint a data protection officer.

2. Hosting

This website is operated and delivered as a so-called Worker on the Cloudflare network. The provider is Cloudflare, Inc., 101 Townsend St, San Francisco, CA 94107, USA; the EEA contact is Cloudflare Germany GmbH, Rosental 7, 80331 Munich. When the website is accessed, Cloudflare processes technical access data (in particular the IP address) in order to deliver the content and to ensure the security and stability of the website.

The legal basis is Art. 6 (1) (f) GDPR (legitimate interest in a secure, fast and trouble-free provision of the website). A data processing agreement pursuant to Art. 28 GDPR is in place with Cloudflare. Data may be transferred to the USA; Cloudflare, Inc. is certified under the EU-US Data Privacy Framework (adequacy decision of the EU Commission of 10 July 2023) and additionally relies on the EU Standard Contractual Clauses.

Further information: cloudflare.com/privacypolicy.

3. Server log files and IP address

When the website is accessed, information transmitted by your browser is automatically recorded. This is in particular:

• browser type and version
• operating system used
• referrer URL (the previously visited page)
• date and time of access
• the file or page requested and the amount of data transferred
• IP address

This data is not merged with other data sources and serves solely the technically error-free delivery, error analysis and defence against abusive access. The legal basis is Art. 6 (1) (f) GDPR. The data is deleted as soon as it is no longer required for the purpose of collection, as a rule after a few days.

From your IP address, Cloudflare additionally derives the country of origin of your request (two-letter country code). This value is used to pre-select the language of the website on your first visit and to deliver the version of the legal information appropriate for your country. It is not stored and not linked to your person; no more precise location determination takes place. The legal basis is Art. 6 (1) (f) GDPR (legitimate interest in a correctly localised and legally compliant presentation).

4. Contact form

If you use the contact form on this website, the data you enter is processed: your name, the means of contact you provide (e.g. e-mail address, telephone number or messenger username), the selected services, your message, as well as the set language of the website and the country of origin of the request determined by Cloudflare. The purpose of processing is solely to handle and respond to your enquiry.

The legal basis for handling the enquiry is Art. 6 (1) (b) GDPR (performance of pre-contractual measures at your request) or Art. 6 (1) (f) GDPR (legitimate interest in answering enquiries). The forwarding of the form content to Telegram additionally takes place on the basis of your express consent (see section 5).

Protection against abusive submissions

To ward off automated submissions, the form contains a check field that is invisible to you (a so-called honeypot), limits the size of the transmitted data and limits the number of submissions per IP address and minute (rate limiting). No additional personal data is collected and no cookies are set in doing so. The legal basis is Art. 6 (1) (f) GDPR (legitimate interest in warding off spam and abuse).

5. Communication via messengers and transfer to third countries

Communication with interested parties and clients takes place (depending on which channel you choose yourself) by e-mail, telephone or via messenger services. For each service used, the following states who operates it, which data is processed and on what legal basis processing takes place.

5.1 Telegram

Technically, the content of the contact form is not delivered by e-mail but via the bot interface of the messenger Telegram to my personal Telegram account. You can also contact me directly via Telegram.

The operator of the service is Telegram FZ-LLC, Business Central Towers, Tower A, Dubai Media City, Dubai, United Arab Emirates (for users in the EEA additionally: Telegram Messenger Inc.). The following is processed: your Telegram username or telephone number and your Telegram ID, the content of your message and the information you provided in the form, as well as metadata (time, delivery status, device and connection information).

The legal basis for the substantive handling is Art. 6 (1) (b) GDPR (pre-contractual measures or performance of the contract); otherwise Art. 6 (1) (a) GDPR (consent).

Transfer to a third country: For the United Arab Emirates there is no adequacy decision of the European Commission pursuant to Art. 45 GDPR, and no appropriate safeguards within the meaning of Art. 46 GDPR are available to me. The transfer therefore takes place exclusively on the basis of your express consent pursuant to Art. 49 (1) (a) GDPR, which you give before submitting the form by ticking the box provided for this purpose. Without this consent, the form cannot be submitted.

Risks of the transfer: In the destination country there is no level of data protection equivalent to Union law. In particular, it cannot be ruled out that authorities of the third country access the data without your knowledge, that the data is used there for further purposes or passed on to third parties, and that your data subject rights (access, rectification, erasure) and effective legal remedies before courts or supervisory authorities are not, or only to a limited extent, enforceable.

Provider's privacy notice: telegram.org/privacy.

5.2 WhatsApp

On request, further communication takes place via WhatsApp, for example if you provide your mobile number in the contact form or contact me via WhatsApp yourself. I use WhatsApp purely reactively; no advertising and no newsletters are sent via this channel.

The provider for users in the EEA is WhatsApp Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland, a company of the Meta group (Meta Platforms Ireland Ltd.). The following is processed: your mobile number, your profile name and picture, the content of your messages, as well as metadata (times, delivery and read status, device and connection information). Message contents are end-to-end encrypted; the metadata is not.

The legal basis is Art. 6 (1) (b) GDPR (communication to initiate or perform the contract) as well as Art. 6 (1) (a) GDPR insofar as you consent to the use of this channel by choosing it yourself.

Transfer to a third country: Processing by the US parent company Meta Platforms, Inc. cannot be ruled out. Meta Platforms, Inc. is certified under the EU-US Data Privacy Framework; in this respect an adequacy decision of the European Commission of 10 July 2023 exists for the USA, so that transfers to certified US companies can be based on Art. 45 GDPR. The EU Standard Contractual Clauses apply additionally. Insofar as transfers should take place to states outside this framework, I base these on your express consent pursuant to Art. 49 (1) (a) GDPR with the risks described in section 5.1.

Provider's privacy notice: whatsapp.com/legal/privacy-policy-eea.

5.3 Other channels chosen by you

If you provide a telephone number, an e-mail address or the username of another messenger in the contact form, I use exactly that channel for my reply. The respective provider's privacy policy governs the processing of your data; I have no influence on the scope and purpose of that processing. If a transfer to a country without an adequacy decision takes place, the risks described in section 5.1 apply accordingly; the basis is your express consent pursuant to Art. 49 (1) (a) GDPR, which you give by choosing the channel.

Alternative without a transfer requiring consent: You can instead send me your enquiry at any time simply by e-mail to kontakt@phantom-creator.com. In this case, no transfer to Telegram, WhatsApp or any other messenger takes place. Your e-mail is delivered via Cloudflare's e-mail forwarding and processed in a mailbox provided by Google; any associated transfer to the USA is covered by the adequacy decision on the EU-US Data Privacy Framework and therefore requires no consent. Details can be found in section 6.

Withdrawal: You can withdraw your consent at any time with effect for the future; the lawfulness of the processing carried out until the withdrawal remains unaffected. An informal message to the e-mail address given above is sufficient. The data is deleted as soon as your enquiry has been finally dealt with and no statutory retention obligations stand in the way.

6. Contact by e-mail, forwarding and mailbox

If you write to me by e-mail at kontakt@phantom-creator.com, the resulting information is processed: your sender address and the display name you use, the subject, the content of your message, any file attachments, as well as the technical metadata of the message (in particular headers with timestamps, the mail servers involved and IP addresses).

The purpose of processing is to handle and answer your enquiry and the subsequent correspondence within the scope of initiating and performing a contract. The legal basis is Art. 6 (1) (b) GDPR (performance of pre-contractual measures at your request or performance of the contract); for messages without a contractual context the legal basis is Art. 6 (1) (f) GDPR (legitimate interest in answering enquiries and in comprehensible business correspondence).

Service providers are involved in the e-mail communication via this address: incoming messages are delivered via Cloudflare's e-mail forwarding (section 6.1) and stored and processed in a mailbox provided by Google (section 6.2). To send my replies from this address, I use the delivery service SMTP2GO (section 6.3).

6.1 Incoming messages: forwarding via Cloudflare

No dedicated mailbox is operated for the address kontakt@phantom-creator.com on the domain phantom-creator.com. The domain's MX records point to Cloudflare Email Routing: incoming messages are received by Cloudflare's mail servers and, based on a defined forwarding rule, delivered directly to my mailbox (see section 6.2). In doing so, the complete message including sender address, subject, content and attachments passes through Cloudflare's systems. No mailbox is provided there, so no permanent storage of the messages takes place at Cloudflare; technically necessary short-term processing operations as well as log and delivery data (in particular time, sender and recipient address and delivery status) may arise.

The provider of this service is the same company that also provides the hosting of this website. For the provider's name and registered office, the existing data processing agreement pursuant to Art. 28 GDPR and the information on transfer to the United States, the statements in section 2 apply accordingly. The purpose of processing is solely the technical delivery of the messages addressed to me. The legal basis is Art. 6 (1) (b) GDPR insofar as the message serves to initiate or perform a contract, otherwise Art. 6 (1) (f) GDPR (legitimate interest in operating a functioning business e-mail address).

6.2 E-mail mailbox at Google

The mailbox in which the messages addressed to me are received, stored and processed is provided by Google. The contracting party and the provider's establishment responsible for users in the European Economic Area is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Processed there are sender and recipient address, subject, message content, file attachments and the metadata of the message. The messages remain in the mailbox until I delete them; the storage period is governed by the information in section 6.4 and section 10.

The purpose is the receipt, handling and answering of your messages. The legal basis is Art. 6 (1) (b) GDPR insofar as the message serves to initiate or perform a contract, otherwise Art. 6 (1) (f) GDPR (legitimate interest in a reachable business e-mail address). Which data Google processes in the context of providing the service is set out in the provider's privacy policy linked below.

Transfer to a third country: Google Ireland Limited may use its US parent company Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA to provide the service, so that a transfer of personal data to the United States may take place. Google LLC is certified under the EU-US Data Privacy Framework; in this respect an adequacy decision of the European Commission of 10 July 2023 exists for the USA, so that the transfer can be based on Art. 45 (1) GDPR. A separate consent pursuant to Art. 49 GDPR is (unlike for the transfer to Telegram described in section 5.1) not required for this.

Provider's privacy notice: policies.google.com/privacy.

6.3 Outgoing messages: sending via SMTP2GO

I send my replies and further correspondence from the address kontakt@phantom-creator.com via the delivery service SMTP2GO. In doing so, the recipient address, the subject, the content of the message, any file attachments, as well as the metadata of the dispatch (in particular time, mail servers involved and delivery status) are processed by this service. The service does not receive any incoming messages.

The provider of the service is Sand Dune Mail Ltd (SMTP2GO), 96-106 Manchester Street, Christchurch 8011, New Zealand. The account used is assigned to the provider's EU region; according to the provider, messages from such accounts are routed via European mail servers and processed in the data centre in Amsterdam (Netherlands), and personal data of users from the European Economic Area is stored within the EEA. A data processing agreement pursuant to Art. 28 GDPR is in place with the provider.

The purpose of processing is to answer your enquiry and to communicate within the scope of initiating and performing a contract. The legal basis is Art. 6 (1) (b) GDPR, supplemented by Art. 6 (1) (f) GDPR (legitimate interest in reliable dispatch of business correspondence). Permanent storage of the message contents is not intended with this service; technically necessary short-term intermediate storage (queue in the event of delivery problems) as well as log and delivery data may arise there for a limited period.

Third-country reference: Sand Dune Mail Ltd is based in New Zealand. For New Zealand there is an adequacy decision of the European Commission (Implementing Decision 2013/65/EU of 19 December 2012), which continues to apply pursuant to Art. 45 (9) GDPR and which the Commission confirmed in its review of 15 January 2024. A transfer to New Zealand is therefore based on Art. 45 GDPR; no additional safeguards pursuant to Art. 46 GDPR or consent pursuant to Art. 49 GDPR are required for this.

Provider's privacy notice: smtp2go.com/privacy.

6.4 Storage period and note on transport encryption

Your messages are deleted as soon as they are no longer required to achieve the purpose (enquiries that do not lead to a contract at the latest six months after the last contact) and no statutory retention obligations stand in the way. The general information on the storage period in section 10 applies additionally.

E-mails are usually transmitted between the mail servers involved with transport encryption (TLS) according to the current state of the art. However, there is no end-to-end encryption, so confidentiality along the entire transmission path cannot be guaranteed. For the transmission of particularly confidential information, you are welcome to ask me in advance for an alternative means of transmission.

7. Local storage of your settings

This website stores settings in your browser's local storage (localStorage or sessionStorage): the language you have chosen (key phantomlab-lang), the selected colour scheme light/dark (phantomlab-theme), and a note that the intro animation has already been shown within the same session (phantomlab-visited).

This information remains exclusively on your device, is not transmitted to me or third parties and serves solely to display the website the way you have set it up. As this is a strictly necessary function to provide the service you expressly requested, no consent is required for this pursuant to § 25 (2) no. 2 TDDDG. You can delete these entries at any time via your browser's settings.

8. No cookies, no tracking, no external content

This website sets no cookies of its own and uses no analytics, tracking, advertising or marketing technologies (such as Google Analytics). No profiling and no automated decision-making within the meaning of Art. 22 GDPR takes place.

All fonts, scripts and graphics are loaded locally from our own server; this expressly also applies to the web fonts used and the animation library GSAP. When the website is accessed, no connections to third-party servers are established as a result; in particular, there is no transmission of your IP address to Google Fonts, to a third-party content delivery network or to a social network. No social media plug-ins, maps, videos or embedded third-party content are included.

This information relates exclusively to accessing and displaying the website. The involvement of service providers in subsequent communication when you contact me remains unaffected, in particular the messenger services described in section 5 and the e-mail forwarding described in section 6, the e-mail mailbox at Google mentioned there and the delivery service mentioned there, which may also involve transfers to third countries.

The hosting service provider Cloudflare (see section 2) may set technically necessary cookies to ward off automated access and to ensure security. These are strictly necessary for the operation of the website and therefore require no consent pursuant to § 25 (2) no. 2 TDDDG. A cookie banner is not required for these reasons.

9. SSL/TLS encryption

For security reasons and to protect the transmission of confidential content, this website uses SSL or TLS encryption. You can recognise an encrypted connection by the fact that the browser's address bar begins with “https://”. When encryption is active, the data you transmit to me cannot be read by third parties.

10. Storage period

Unless a more specific storage period is stated in this policy, your personal data remains with me until the purpose for the data processing ceases to apply. Enquiries that do not lead to a contract are deleted at the latest six months after the last contact. If you assert a request for access or erasure or withdraw a consent, your data is deleted unless there are other legally permissible grounds for storage, such as retention periods under commercial or tax law (§ 147 AO, § 257 HGB). In the latter case, deletion takes place after these grounds cease to apply.

11. Your rights

Within the scope of the applicable statutory provisions, you have the right at any time to:

• access to your stored personal data (Art. 15 GDPR)
• rectification of inaccurate data (Art. 16 GDPR)
• erasure of your data (Art. 17 GDPR)
• restriction of processing (Art. 18 GDPR)
• data portability (Art. 20 GDPR)
• objection to processing (Art. 21 GDPR)
• withdrawal of a consent given, with effect for the future (Art. 7 (3) GDPR)

To exercise these rights, an informal message to kontakt@phantom-creator.com is sufficient.

12. Visitors outside the EU and EEA

This website is operated from Germany, so the GDPR is the standard applied to every visitor. If the law of your own country of residence grants you further or differently named rights, you may rely on those as well; the routes described below are in addition to, not instead of, the rights listed in section 11.

12.1 United Kingdom

For visitors in the United Kingdom the same processing is governed by the UK GDPR together with the Data Protection Act 2018. The purposes, legal bases and storage periods stated above apply unchanged, and the rights in section 11 correspond to those under the UK GDPR. You may lodge a complaint with the Information Commissioner's Office (ICO), Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF, United Kingdom (ico.org.uk). Transfers of data out of the United Kingdom rely on the UK adequacy regulations or, where these do not cover the recipient, on your express consent as described in section 5.

12.2 Switzerland

For visitors in Switzerland the processing is additionally governed by the revised Federal Act on Data Protection (FADP/DSG). You have the rights to information, rectification, erasure and data portability corresponding to section 11, and you may contact the Federal Data Protection and Information Commissioner (FDPIC), Feldeggweg 1, 3003 Bern, Switzerland (edoeb.admin.ch).

12.3 United States and all other countries

Wherever you are, and regardless of whether your jurisdiction grants you a statutory right to it, the following holds for this website:

• I do not sell personal data and do not share it for cross-context behavioural advertising, in the sense those terms carry under US state privacy laws such as the CCPA/CPRA. No money or other consideration is received for your data.
• There is no advertising, no tracking and no profiling on this website (see section 8), so there is nothing to opt out of in that respect.
• Personal data is collected only where you provide it yourself (through the contact form, by e-mail or via a messenger), plus the technical access data described in section 3.
• Requests for access, correction or deletion of your data are honoured on request irrespective of your country of residence, and you will not be treated differently for making one.

A request to kontakt@phantom-creator.com is sufficient in every case. Please note that this website is not directed at residents of any particular country outside the European Union, and that it offers no automated decision-making that could produce legal effects for you.

13. Children's data

The services described here are addressed to businesses and to adults acting in a professional capacity. This website is not directed at children, and I do not knowingly collect personal data from children under the age of 16 (Art. 8 GDPR; a lower age limit applies in some countries). If you believe that a child has sent me personal data, please let me know at kontakt@phantom-creator.com and I will delete it without delay.

14. Right to lodge a complaint with a supervisory authority

Without prejudice to any other legal remedy, you have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR), in particular in the Member State of your place of residence, place of work or the place of the alleged infringement. Visitors in the United Kingdom and Switzerland may instead approach the authorities named in section 12. The supervisory authority responsible for me is:

Der Landesbeauftragte für den Datenschutz und die Informationsfreiheit Baden-Württemberg
Lautenschlagerstraße 20
70173 Stuttgart
www.baden-wuerttemberg.datenschutz.de