Privacy

This site sets no cookies, runs no analytics and loads no third-party fonts. The only third-party script is a spam check that loads once you start filling in the form. Nothing about your visit is tracked across sites, and there is no profiling and no automated decision-making.

Who is responsible

The controller for the processing described here is rebaze GmbH, Kopernikusstraße 14, 30167 Hannover, Germany, represented by Toni Menzel. Write to hello@openreleaserecord.org about anything on this page.

No data protection officer has been appointed; the company is not required to appoint one.

Visiting the site

Serving a page necessarily processes your IP address, the time of the request, the page requested, and the user agent your browser sends. Cloudflare records this in its server logs to deliver the site and to defend it against attack and abuse. The legal basis is Art. 6(1)(f) GDPR, our legitimate interest in operating a site that works and stays available. We do not build these logs into anything, and we do not combine them with your form submission.

The form

When you submit the form, your choice (early partner or keep me posted), your email address and anything else you enter (name, organisation, area, message) are passed to a function running on Cloudflare Pages, which sends them by email to a mailbox we operate. The submission is not written to any database along the way; it exists in transit and then in the mailbox. The services that carry the email keep delivery logs of the messages they handle, for example the recipient, the subject line and whether it was delivered. The subject line contains your email address, or your organisation for a partner request.

Your email address is required, and for a partner request your organisation too, because without them we cannot reply. Every other field is optional.

Spam check

When you start filling in the form, the page loads Cloudflare Turnstile from challenges.cloudflare.com to tell people from automated abuse. It usually stays invisible and only asks for a click when it is unsure. For the check, Cloudflare processes your IP address, the user agent your browser sends and technical characteristics of the connection. Cloudflare processes these signals for us as our processor, and, according to its Turnstile privacy policy, also as a controller of its own to improve its bot detection. The legal basis is Art. 6(1)(f) GDPR, our legitimate interest in keeping the form free of abuse. The check does not run unless you use the form, and without it the form cannot be sent; you can always write to us instead.

Who processes it

• Hosting, spam check and email forwarding. Cloudflare: Pages serves the site and runs the form function; Turnstile runs the spam check; Email Routing forwards mail sent to openreleaserecord.org addresses, including the form’s messages and anything you write to us, to our mailbox. Cloudflare is headquartered in the United States; transfers outside the EU are covered by the standard contractual clauses in its data processing addendum.
• Email delivery. Brevo (Sendinblue SAS, Paris, France).
• Mailbox. Google Workspace (Google Ireland Ltd), under Google's data processing agreement.

Each acts as our processor under Art. 28 GDPR. We pass your details to no one else, and we sell nothing to anyone.

Purpose and legal basis

We use your details only to contact you about Open Release Record: to answer a partner request, or to send you updates about the project if you asked to be kept posted. The legal basis is your consent under Art. 6(1)(a) GDPR, which you give with the checkbox on the form. You can withdraw it at any time by writing to us, with effect for the future.

Retention

Partner requests are deleted once settled, and at most 12 months after our last exchange. Addresses kept for updates are deleted when you withdraw your consent or when we stop sending updates. Where a statutory retention period applies to correspondence that became part of a contract, that period governs instead.

Your rights

You have the right to access your data (Art. 15), to have it corrected (Art. 16) or erased (Art. 17), to restrict its processing (Art. 18), to receive it in a portable form (Art. 20), and to withdraw your consent at any time (Art. 7(3)). Write to hello@openreleaserecord.org.

You may also complain to a supervisory authority. The one competent for us is Die Landesbeauftragte für den Datenschutz Niedersachsen, Prinzenstraße 5, 30159 Hannover.