1. Controller
The controller within the meaning of the GDPR is CoderConda – Damjan Savić, Overather Straße 64, 51429 Bergisch Gladbach, Deutschland. Owner: Damjan Savić. Email: info@coderconda.com. No data protection officer has been appointed; the contact for data protection questions is the owner.
2. Hosting and server logs
The website is operated on a server of its own, managed by CoderConda. To provide it securely, the server processes IP address, time, requested address, referrer, user agent and status code. The legal basis is the legitimate interest in security and reliable operation (Art. 6(1)(f) GDPR). Logs are rotated daily and deleted after 14 days unless a security incident requires longer retention.
When a form is submitted, the IP address is also counted to protect against abuse: only as a hash, with a key that expires when the server restarts, only in working memory and for ten minutes at most; the web server likewise counts form requests per IP address only briefly in memory. The legal basis here, too, is the legitimate interest in protecting against abuse.
3. Contact form and email
When you send an enquiry through the contact form, your name, email address, company or website, topic, message, language, origin details (the referring page and the entry address of your visit, with campaign parameters where present), a random identifier of the page view and technical transmission data are processed. If you write directly to CoderConda’s email address, your details and your message are processed in the same way. The enquiry is delivered by email; section 7 names the sending service and the receiving mailbox. The purpose is to respond and, where applicable, to prepare a contract. The legal bases are Art. 6(1)(b) GDPR (pre-contractual steps at your request) and point (f) (legitimate interest in answering business enquiries). Enquiries that are no longer needed are generally deleted after twelve months; tax and commercial records follow the applicable retention periods. Providing the details is voluntary; without the required fields the enquiry cannot be answered.
The English-language page for enquiries from the United States asks for company, website address and email address and, optionally, a telephone number and a note; the origin details and the random identifier of the page view are sent here as well. These details are used to prepare and send you the analysis of your website you asked for (Art. 6(1)(b) GDPR); the retention periods are the same. A call back or a text message happens only if you tick the box for it. You can withdraw this consent (Art. 6(1)(a) GDPR) at any time with effect for the future.
4. AI phone assistant (demo number)
If you call the demo number of the AI phone assistant (which is also the phone number in the imprint), an AI voice assistant answers the call. At the start it introduces itself as an AI assistant and says that the conversation, or your concern, is written down; if you do not want that, you can hang up. Your phone number (where it is transmitted), the time and length of the call, what you say, the word-for-word call record made from it, the details you give yourself (for example name, company, concern, call-back number or email address) and a summary written by the assistant, including an assessment of urgency, are processed. No audio recording is stored. In urgent cases the assistant can put the call through to the owner. The purpose is to demonstrate the assistant and to deal with your concern, for example a call back; the legal basis is the legitimate interest in that (Art. 6(1)(f) GDPR), or, for an agreed trial run, preparing a contract (point (b)).
Taking part technically are Telnyx (telephone line), ElevenLabs (speech recognition, voice output, analysis of the call and operation of the language model, currently Claude from Anthropic) and CoderConda’s own server, where the call record and call data are kept. A short notice about the call is delivered by WhatsApp to an internal group that only CoderConda and CoderConda’s notification service belong to. It contains the name given (otherwise the phone number), the subject, the summary and any call-back request with number; if the assistant could not record a concern, it contains instead the phone number, length, time and the course of the conversation (up to 2,500 characters). The notices are deleted automatically in the group after 90 days (disappearing messages). ElevenLabs deletes the call record after 30 days. On the own server, name, company, phone number, call-back details, concern, call record, summary and analysis are cleared after 90 days (time, length, outcome and urgency of the call remain without name and phone number), messages are deleted after 90 days, queued notices 30 days after sending (after 90 days at the latest), technical log entries (identifiers without name or phone number) after twelve months, and backups are deleted after 14 days. How CoderConda uses AI is described under AI transparency.
5. Booking appointments (cal.com)
Appointments can be booked through a calendar from Cal.com, Inc. (cal.com, USA). It is loaded only after you have clicked “Load the calendar”. When it loads, your browser connects to cal.com and transmits, among other things, your IP address; the provider may set its own cookies in the process. When you book, cal.com processes what you enter, such as name, email address and the time you choose; the booking stays in CoderConda’s calendar account and is deleted twelve months after the appointment at the latest. The legal basis is your consent by clicking (Art. 6(1)(a) GDPR, section 25(1) TDDDG) and, for the booking, preparing a contract (point (b)). According to the provider, the transfer to the USA relies on the EU-US Data Privacy Framework; the provider also names standard contractual clauses where appropriate. You can also arrange an appointment through the contact form or by email.
7. Recipients and international transfers
Access is limited to people responsible for operations and communication and contracted technical providers. The website runs on a server of its own at netcup GmbH (Germany), which under its data processing agreement uses further processors within the EU (Anexia Holding GmbH and Anexia Cloud Solutions GmbH, Austria and Germany). Form emails are sent by Google Ireland Ltd. (Google Workspace) through its SMTP server; enquiries arrive in the same mailbox. Data may be transferred to the United States in the process, and Google LLC is certified under the EU-US Data Privacy Framework. The calendar (section 5) is operated by Cal.com, Inc. in the USA. The AI phone assistant (section 4) uses Telnyx and ElevenLabs; the language model (currently Claude from Anthropic) is integrated through ElevenLabs. All three are companies based in the United States. The transfer to the United States relies on the standard contractual clauses of the European Commission in the data processing agreements of Telnyx and ElevenLabs; Telnyx is additionally certified under the EU-US Data Privacy Framework. The short notice about the call runs through WhatsApp Ireland Ltd. (Meta group); data may be transferred to the United States in the process, and WhatsApp LLC is certified under the EU-US Data Privacy Framework. For the example chat (section 10), the messages you enter are sent to Anthropic (the contracting party is Anthropic Ireland, Limited; they are also processed by Anthropic, PBC in the United States); the transfer to the United States relies on the standard contractual clauses of the European Commission in Anthropic’s data processing agreement. A copy of the relevant standard contractual clauses is available on request. When analytics or marketing is active, data may be transferred to Google LLC and Meta Platforms, Inc. in the United States; both are certified under the EU-US Data Privacy Framework.
8. Your rights
Subject to GDPR requirements, you have rights of access, rectification, erasure, restriction of processing and portability. You can withdraw a consent you have given at any time with effect for the future. No decision based solely on automated processing that has legal effect on you or similarly significantly affects you (Art. 22 GDPR) takes place.
Right to object: At any time, on grounds relating to your particular situation, you can object to the processing of your data where it is based on legitimate interests (Art. 21(1) GDPR). The processing then ends unless there are compelling legitimate grounds. The objection can be sent informally to the email address in section 1.
You also have the right to complain to a data protection authority, for example the Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen, Kavalleriestraße 2–4, 40213 Düsseldorf.
9. Customers, contracts and billing
If you enter into a contract with CoderConda, your master data (name, address, contact details, contract content) and payment data are processed to perform the contract and for billing (Art. 6(1)(b) GDPR). Commercial and tax retention duties (in particular section 147 AO and, where applicable, section 257 HGB) require storage for the statutory periods, currently up to ten years (Art. 6(1)(c) GDPR). Recipients are, where necessary, the bank and possibly a tax adviser. Where CoderConda processes personal data on a customer’s behalf, the contract under Art. 28 GDPR applies. Without these details no contract can be concluded.
10. Example chat (WhatsApp demo)
On the page AI chat demo you can write to an invented example business. The replies are generated by an AI language model (Claude Haiku 4.5 from Anthropic), so you are not talking to a person there. The chat is a demonstration with invented data. Please do not enter real personal data in it, neither your own nor anyone else’s, and no business or customer data.
What is processed is the messages you type, the earlier history of this conversation and the language of the page. With every message these details are sent to Anthropic, and processed in the United States too, so that the model can answer; your IP address, cookies or an identifier are not sent along. The history lives only in your browser’s memory and is gone as soon as you leave the page or start over. CoderConda stores neither your messages nor the replies; the application logs only the number of tokens, the duration and the kind of an error, and the access log of the web server (section 2) holds, as for any request, the IP address, the time and the requested address, but never the content of your messages.
To protect against misuse and disproportionate cost, the server counts calls per internet connection (IP address; for IPv6, per /64 network): only as a hash, with a key that expires when the server restarts, only in memory and for 24 hours at most; the web server likewise counts requests per IP address only briefly in memory. The legal basis is the legitimate interest in demonstrating the function in response to your own input and in protecting it against misuse (Art. 6(1)(f) GDPR). Using it is voluntary; the rest of the website works without it.
CoderConda’s processor is Anthropic Ireland, Limited (Ireland); the messages are also processed by Anthropic, PBC in the United States. The transfer to the United States relies on the standard contractual clauses of the European Commission in Anthropic’s data processing agreement; a copy is available on request (section 7). According to Anthropic, it deletes the messages sent to it within 30 days; if its automated checks flag a message as a violation of its usage policy, Anthropic keeps it for up to two years, and the scores of those checks for up to seven years.
11. Links to other providers
The website contains links to pages of other providers, for example a YouTube channel or customers’ websites. They are plain links: data is transferred only once you click a link; from then on the privacy policy of that provider applies.
12. Version and changes
Version: October 2026. This policy will be updated when services, recipients or legal requirements change.