Privacy

1. Controller

Controller in the sense of the General Data Protection Regulation (GDPR) is:

2. Hosting (Vercel)

This website is hosted on the edge platform of Vercel Inc. (440 N Barranca Ave #4133, Covina, CA 91723, USA). We use the European region Frankfurt (fra1). When a page is requested, Vercel automatically collects technical access data in server logs:

• IP address (processed in shortened form)
• Date and time of the request
• Requested URL
• Amount of data transferred
• Browser type and operating system (user agent)
• Referrer (originating page)

The legal basis is Art. 6(1)(f) GDPR – our legitimate interest in a stable, secure and operational website. Vercel automatically deletes the logs after at most 30 days. Data Processing Agreement: vercel.com/legal/dpa.

3. Cookies

This website does **not** set cookies for tracking or analytics purposes and does **not** use any web analytics or re-targeting services. Therefore there is also no cookie banner. Only the spam protection on the contact page (see section 4) may transmit technically necessary data to Cloudflare.

4. Spam protection on the contact form (Cloudflare Turnstile)

On the page /en/contact/ (and the German variant /kontakt/) we use Cloudflare Turnstile for spam protection. Provider is Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107, USA.

Turnstile uses cryptographic signals to verify when the form is submitted that the request comes from a real human. Browser characteristics, mouse and keyboard patterns and the IP address are transmitted to Cloudflare and processed exclusively for the purpose of bot detection. According to Cloudflare, Turnstile does **not set cookies** and the data is not used for advertising purposes (see Cloudflare Privacy Policy).

The legal basis is Art. 6(1)(f) GDPR – our legitimate interest in rejecting spam submissions. Cloudflare is certified under the EU-US Data Privacy Framework.

5. Contact form and mail dispatch (Resend)

When you fill in the contact form, we process the data you voluntarily provide (name, email, optional organisation, subject, message) in order to respond to your enquiry. The legal basis is Art. 6(1)(b) GDPR (initiation of a contractual relationship) or Art. 6(1)(f) GDPR (legitimate interest in effective communication).

Mail dispatch is handled by the service provider Resend (Resend, Inc., 2261 Market Street #5039, San Francisco, CA 94114, USA). Resend stores the delivered emails and their metadata temporarily for the purpose of delivery and error analysis. A data processing agreement is in place with Resend.

We retain your enquiry only as long as necessary for handling it and for any statutory retention periods. The data is not shared with third parties.

6. Static assets and CDN

Images, fonts and icons are served from the same Vercel edge cache that delivers the HTML pages. No third-party CDNs are loaded. Fonts are self-hosted and do not establish any connection to Google Fonts or other third parties.

7. Your rights

Under GDPR you have, among others, the following rights:

• Right of access (Art. 15)
• Right to rectification (Art. 16)
• Right to erasure (Art. 17)
• Right to restriction of processing (Art. 18)
• Right to data portability (Art. 20)
• Right to object (Art. 21)
• Right to lodge a complaint with a supervisory authority (Art. 77) – the responsible authority is the State Commissioner for Data Protection and Freedom of Information of North Rhine-Westphalia.

To exercise your rights, an informal email to info@satis.aero is sufficient.

8. Status and changes

This privacy notice describes the current state of our technical implementation. If we change the website or the services we use, we will update this notice accordingly. The version published here at any given time applies.