Contact

Legal

Privacy policy

Information pursuant to Art. 13 of the General Data Protection Regulation (GDPR, in German: DSGVO) on the processing of personal data when you visit hubutau.de and hubutau.com and when you contact us. The legally binding version is the German Datenschutzerklärung at hubutau.de.

001At a glance

For HUBUTAU, protecting your data is not an add-on but a basic principle. This website is therefore deliberately built to be lean:

  • We set no cookies, neither our own nor third-party ones.
  • We use no tracking, no audience measurement, no analytics tools and no advertising networks.
  • We embed no third-party content: no external fonts, no scripts from external servers, no videos, maps or social media buttons. Everything your browser loads from us comes from our own server.
  • We store nothing in your browser, apart from what your browser keeps on its own for security reasons (see the section "Storage in your browser").
  • Personal data arises only because a web server cannot technically work otherwise (server log files), and when you contact us on your own initiative.

In the following sections we explain exactly what data this is, what we use it for, on what legal basis, how long we keep it and what rights you have.

002Controller

The controller responsible for data processing on this website within the meaning of Art. 4(7) of the GDPR (DSGVO) is:

Sascha Dämgen IT and More Systems
Owner: Sascha Dämgen
Am Neumarkt 22
45663 Recklinghausen
Germany

Phone: +49 2361 9702434
E-mail: info@hubutau.com

HUBUTAU is a trading name of Sascha Dämgen IT and More Systems. The websites hubutau.de (German) and hubutau.com (English) are operated by the same controller, on the same server and using the same procedures. This privacy policy applies to both.

003Data protection officer

We are not obliged to appoint a data protection officer (Art. 37 GDPR, § 38 BDSG, the German Federal Data Protection Act), because fewer than 20 people at our company are permanently engaged in the automated processing of personal data and no processing takes place that would require such an appointment.

For all questions about data protection, you can reach the controller directly using the contact details given above. Your enquiry will be handled personally by the owner.

004Terms

We use the terms of the GDPR. The most important ones in brief:

  • Personal data is any information relating to an identified or identifiable natural person, for example a name, an e-mail address or an IP address (Art. 4(1) GDPR).
  • Processing is any operation performed on such data, such as collection, storage, retrieval, transmission or erasure (Art. 4(2) GDPR).
  • The controller is whoever determines the purposes and means of the processing (Art. 4(7) GDPR).
  • A processor is whoever processes personal data on behalf of and on the instructions of the controller (Art. 4(8) GDPR), for example a hosting provider.
  • The data subject is you, where data relates to you.

006Hosting, DNS and e-mail

This website runs on a virtual server that we rent from the following provider:

IONOS SE
Elgendorfer Straße 57
56410 Montabaur
Germany

The same provider also handles the name resolution (DNS) for hubutau.de and hubutau.com and hosts the mailboxes for the e-mail addresses of these domains.

We manage the server ourselves. The web server, configuration and all content come from us. IONOS provides the hardware, the data centre and the network connection and therefore has technical access to the data stored on the server and in the mailboxes. IONOS acts as our processor within the meaning of Art. 4(8) GDPR.

The server is located in a data centre in Germany. The hosting does not involve any transfer of your data to a country outside the European Union or the European Economic Area.

The legal basis is Art. 6(1)(f) GDPR. Our legitimate interest lies in the reliable, secure and privacy-friendly provision of the website and our communication by a provider based in Germany.

007Server log files

Whenever a page is requested, every web server necessarily receives certain data from your browser for technical reasons. Our web server stores the following information in a log file for each request:

  • IP address of the requesting device
  • date and time of the request
  • requested address (for example /imprint/) and request method
  • protocol used and status code of the response (for example 200 for success or 404 for not found)
  • amount of data transferred
  • the page you came from (referrer), if your browser transmits it
  • identifier of the browser and operating system (user agent), if your browser transmits it
  • for a password-protected area, the username entered (not the password)

In addition, the web server logs technical errors. Such entries may also contain the IP address and the requested address.

Purpose: We need this data to deliver the website, to find and fix errors, to ensure the stability of the server and to detect and fend off attacks. We do not analyse the log files to identify visitors, create usage profiles or measure visitor numbers. We do not combine them with other data sources.

Legal basis: Art. 6(1)(f) GDPR. Our legitimate interest lies in the secure and error-free operation of the website.

Retention period: The log files are rotated daily and automatically deleted after 15 days at the latest. We keep individual entries longer only if they are needed to investigate a specific security incident, and only until that incident has been resolved.

Objection: Collecting this data is technically necessary for providing the website. We will comply with an objection under Art. 21(1) GDPR unless compelling legitimate grounds for storing the data prevail. For the short-term storage to keep the server secure, this is generally the case.

008Protection against attacks

Automatic protection software runs on our server. It monitors only login attempts on the administrative remote access to the server (SSH), not visits to this website. If it detects repeated failed login attempts there, it blocks the IP address from which they originate from this access for a limited period. When you visit this website, the protection software does not process any data about you.

Block entries are deleted from the protection software's database after one day. Its log is rotated weekly and deleted after five weeks at the latest.

The legal basis is Art. 6(1)(f) GDPR. Our legitimate interest lies in protecting the server, the website and the data of all visitors against misuse. This does not involve any automated decision within the meaning of Art. 22 GDPR that produces legal effects concerning you. A block affects only technical remote access to the server and lifts itself automatically.

009Encrypted transmission

This website can only be accessed via an encrypted connection (HTTPS with TLS 1.2 or TLS 1.3). Requests via unencrypted HTTP are automatically redirected to HTTPS. You can recognise the encrypted connection by the padlock symbol and by "https://" in your browser's address bar.

The certificates for encryption are issued by the non-profit certificate authority Let's Encrypt. When certificates are issued and renewed, only information about our domains is transmitted, no visitor data.

We also send security instructions to your browser, including:

  • a strict Content Security Policy that technically prevents content from being loaded from external sources,
  • the instruction not to pass on an origin address to other sites when you leave our site (Referrer-Policy "no-referrer"),
  • the instruction not to embed our pages in other sites.

In this way we also ensure on a technical level that the commitments made in this policy are kept.

010Storage in your browser

We do not set cookies and we use neither local storage nor session storage nor comparable techniques to store information in your browser or read it from there.

However, your browser stores some information related to your visit on its own accord:

  • HTTP Strict Transport Security (HSTS): We instruct your browser to access our domains only in encrypted form for the next two years. For this, your browser remembers the domain name and the period of validity. This information contains nothing about you and serves solely your security.
  • Cache: Your browser may cache files such as fonts, graphics and stylesheets so that the page loads faster on your next visit.
  • Access credentials for the protected area: If you are one of the authorised persons and log in to the password-protected area, your browser keeps the access credentials until it is closed.

Insofar as information on your device is accessed in the process, this is strictly necessary under § 25(2) no. 2 TDDDG in order to provide the website you have requested securely. You can delete this data at any time via your browser settings.

011Fonts, scripts and third-party content

All components of this website are delivered from our own server.

  • Fonts: We use the typefaces IBM Plex Sans Condensed and IBM Plex Mono. They are stored on our server. No connection is made to Google Fonts or any other font service.
  • JavaScript: Our pages contain our own script, which runs exclusively in your browser. It controls the animations, the countdown and the window in which the legal notices are displayed. To display these notices, the script loads the text from our own server. This request is recorded in the server log files like any other page request. The script does not send any data to us or to third parties and does not analyse your behaviour.
  • No third-party providers: We use no content delivery networks, no embedded videos, no map services, no social media plugins, no comment functions, no chat tools and no advertising.

If you click a link to an external website, for example to a supervisory authority, you leave our website. The operator of the external site is responsible for the processing there.

012Password-protected area

Until the public launch, parts of this website are accessible only to authorised persons with a username and password. Anyone without access sees only a login prompt from their browser.

When a login is attempted, the web server checks the access credentials entered. The password is transmitted only over the encrypted connection and is kept on the server exclusively as an irreversible hash value (bcrypt). The username entered appears in the server log files, never the password.

The legal basis is Art. 6(1)(f) GDPR. Our legitimate interest lies in protecting unpublished content against access by unauthorised persons. For the retention period, the section "Server log files" applies.

013Contact by e-mail, phone or post

You can reach us by e-mail, phone or letter. There is no contact form on this website.

Data processed: When you contact us, we process the information you provide yourself, for example your name, your e-mail address, your phone number, your postal address and the content of your message. E-mails also involve technical information that every e-mail carries, such as the time and the sending and receiving mail servers.

Purpose: We use this data exclusively to process and answer your enquiry and to clarify any follow-up questions. We do not add you to mailing lists without your express consent and we do not pass on your details for advertising purposes.

Legal basis: Art. 6(1)(b) GDPR if your enquiry relates to a contract or its initiation, for example questions about the product or the market launch. In all other cases Art. 6(1)(f) GDPR. Our legitimate interest then lies in answering the enquiries addressed to us.

Technology: Our e-mail mailboxes are hosted by IONOS (see the section "Hosting, DNS and e-mail"). Transmission between mail servers is encrypted (TLS) wherever possible. However, continuous end-to-end encryption is not guaranteed with normal e-mail. Please therefore do not send us particularly sensitive information by unencrypted e-mail. Let us know if you need a different means of transmission.

Retention period: We delete your enquiry as soon as it has been fully dealt with and no further communication is expected, as a rule no later than six months after the last message. This does not apply to messages that we are required to keep longer due to statutory obligations (see the section "Retention and erasure").

014What we do not do

For clarity, we also list what does not take place on this website:

  • no audience measurement and no web analytics, not even anonymised,
  • no newsletter and no registration,
  • no user accounts, no customer portal and no shop on this website,
  • no online payments,
  • no profiling and no automated individual decisions,
  • no selling, renting or exchanging of personal data.

Should we introduce any of these services later, we will update this privacy policy beforehand and, where necessary, obtain your consent.

015Search engines

The public pages of this website may be indexed by search engines and other automated services so that HUBUTAU can be found. Which pages these are is defined in the files robots.txt and sitemap.xml. The password-protected area is blocked for search engines.

If you reach our website via a search engine, the operator of the search engine processes your search query under its own responsibility. We have no influence on this. We do not receive any data about individual visitors from search engines.

016Recipients and disclosure

We pass on your personal data only if this is necessary for the purposes stated or if we are legally obliged to do so. Recipients may be:

  • IONOS SE as processor for server, DNS and e-mail (see above),
  • authorities and courts, if we are obliged to disclose data due to a statutory obligation or an enforceable order from an authority or court,
  • advisers bound by professional secrecy, such as lawyers or tax advisers, insofar as this is necessary to protect our rights or to fulfil statutory obligations.

No further disclosure takes place.

017Transfers to third countries

We do not transfer your personal data to countries outside the European Union or the European Economic Area. Server, DNS and e-mail are operated by a provider based in Germany. No services that transfer data to third countries are embedded on this website.

If you write to us from a country outside the EU, for example via hubutau.com, the transmission of your message up to our mail server is your own responsibility and that of your e-mail provider. From the moment it reaches us, the rules of this policy apply.

We send our replies to the address you have given us. If your e-mail provider is based or has its servers outside the EU, our reply reaches it there at your instigation.

018Retention and erasure

We store personal data only for as long as is necessary for the respective purpose. We state the specific periods for each individual processing operation. In summary:

  • server log files: after 15 days at the latest, except in the case of a specific security incident,
  • block entries of the protection software: after one day, its log after five weeks at the latest,
  • enquiries by e-mail, phone or post: once fully dealt with, as a rule no later than six months after the last message.

Statutory retention obligations: Insofar as a message counts as a commercial or business letter or is relevant for tax purposes, we are legally obliged to keep it (§ 147 AO, the German Fiscal Code, and where applicable § 257 HGB, the German Commercial Code): commercial and business letters for six years, accounting vouchers for eight years, books and records for ten years. In these cases we restrict processing to fulfilling the retention obligation and delete the data once the period has expired. The legal basis is Art. 6(1)(c) GDPR.

019Obligation to provide data

You are under no statutory or contractual obligation to provide us with personal data. However, without the technically necessary connection data (see "Server log files"), your browser cannot retrieve the website. Without contact details, we cannot reply to you.

020Automated decisions

We do not use automated decision-making, including profiling, within the meaning of Art. 22 GDPR. The automatic blocking of suspicious IP addresses on the administrative remote access (see "Protection against attacks") is a technical protective measure without legal effect on you.

021Your rights

As a data subject, you have the following rights against us, which you can exercise at any time and free of charge:

  • Access (Art. 15 GDPR): You can request information on whether and which personal data we process about you, for what purpose, to whom it is disclosed and how long it is stored. You can receive a copy of this data.
  • Rectification (Art. 16 GDPR): You can request that inaccurate data be corrected and incomplete data be completed.
  • Erasure (Art. 17 GDPR): You can request that we delete your data, insofar as there is no statutory obligation to retain it and the processing is not necessary for the establishment, exercise or defence of legal claims.
  • Restriction of processing (Art. 18 GDPR): You can request that we restrict processing, for example while the accuracy of your data is being verified.
  • Data portability (Art. 20 GDPR): You can request to receive data that you have provided to us and that we process by automated means on the basis of consent or a contract in a structured, commonly used and machine-readable format, or to have it transmitted to another controller.
  • Withdrawal of consent (Art. 7(3) GDPR): If you have given us consent, you can withdraw it at any time with effect for the future. The lawfulness of the processing carried out up to that point remains unaffected.
  • Complaint to a supervisory authority (Art. 77 GDPR): see the section "Right to lodge a complaint".

Please note that we are generally unable to determine from the server log files which entries relate to you, because we only record IP addresses there and no names. If you would like information about such data, details such as your IP address at the time and the approximate time of your visit will help us (Art. 11 GDPR).

022Right to object

You have the right to object at any time, on grounds relating to your particular situation, to the processing of personal data concerning you that is carried out on the basis of Art. 6(1)(f) GDPR (Art. 21(1) GDPR).

If you object, we will no longer process your data unless we can demonstrate compelling legitimate grounds for the processing that override your interests, rights and freedoms, or the processing serves the establishment, exercise or defence of legal claims.

If your data is processed for the purpose of direct marketing, you can object to this at any time without giving reasons (Art. 21(2) GDPR). We currently do not process any data for advertising purposes.

You can send your objection informally to the contact details given in the section "Controller".

023How to exercise your rights

A short message to info@hubutau.com or a letter to the address given above is sufficient. We will respond to your request without undue delay, and at the latest within one month of receipt (Art. 12(3) GDPR). In justified exceptional cases, this period may be extended by a further two months. We will then inform you of this in good time.

To ensure that your data does not fall into the wrong hands, we may ask you to prove your identity if we have reasonable doubts about it. We will only request as much information as is necessary to match your request.

024Right to lodge a complaint

Without prejudice to any other remedies, you have the right to lodge a complaint with a data protection supervisory authority if you believe that the processing of your personal data infringes the GDPR (Art. 77 GDPR). In particular, you can contact the supervisory authority of your place of residence, your place of work or the place of the alleged infringement.

The authority responsible for us is:

Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen
Kavalleriestraße 2-4
40213 Düsseldorf
Phone: +49 211 38424-0
E-mail: poststelle@ldi.nrw.de
Web: www.ldi.nrw.de

We would appreciate it if you contacted us first with any concern, so that we can resolve it quickly.

025Data security

In accordance with Art. 32 GDPR, we take state-of-the-art technical and organisational measures to protect your data against loss, manipulation and unauthorised access. These include in particular:

  • exclusively encrypted transmission (HTTPS, TLS 1.2 and 1.3) with HSTS,
  • a static website without a database, without a content management system and without forms, which keeps the attack surface small,
  • strict security instructions to the browser (Content Security Policy and others),
  • automatic detection and blocking of attack attempts on the administrative remote access,
  • regular, automatic security updates of the server operating system,
  • storage of passwords only as bcrypt hash values,
  • administrative access to the server by the owner only,
  • data minimisation: what we do not collect cannot be lost.

We review our measures continuously and adapt them to technical developments. Nobody can guarantee absolute security when transmitting data over the internet.

026Note on minors

The content of this website is aimed at adults aged 18 and over. We do not knowingly collect personal data from minors. If we learn that a minor has sent us data without the consent of their parents or guardians, we will delete it, insofar as there is no statutory retention obligation.

027HUBUTAU products, app and portal

This privacy policy applies only to the websites hubutau.de and hubutau.com. No data from HUBUTAU devices, from an app or from a customer portal is processed via these websites.

For the use of HUBUTAU products and the associated app and services, we will provide separate privacy information at market launch. You will receive it before any personal data is processed there.

028Changes to this policy

We will adapt this privacy policy if the website, our procedures or the legal situation change. The version published on this page applies in each case. If a change requires your consent, we will obtain it beforehand.

The German version at hubutau.de/datenschutz/ is legally binding. This English version is provided for information only.

As of: October 2026

  • MECHANICAL TRIGGER
  • REMOTE COMMANDS CAN ONLY LOCK
  • DAYLIGHT AIMING SYSTEM
  • END-TO-END ENCRYPTED
  • POST-QUANTUM ENCRYPTION
  • SERVERS IN THE EU
  • EVERY FUNCTION OPTIONAL
  • MODULAR BY DESIGN