Legal · Last updated July 24, 2026

Data Processing (Art. 28 DSGVO)

This page describes how Queryance organizes data processing on behalf pursuant to Art. 28 DSGVO for operating the launch notification list. It supplements the Privacy Policy and does not replace an individual agreement where one is required by law.

1. Controller and Processor

Controller: Fabian Schmitt, Henriette-Brey-Str. 41, 47608 Geldern, Germany, contact@queryance.com.

Processor: Cloudflare, Inc. (USA) for hosting (Cloudflare Workers), storage (Cloudflare KV), and bot protection (Cloudflare Turnstile).

2. Subject Matter and Duration

The subject matter is the technical operation of the Queryance launch notification list: receiving and storing notification signups (email address), abuse prevention, and serving the website. Processing lasts as long as the notification list is operated; stored email addresses are automatically deleted after 12 months at the latest (see Privacy Policy, Section 3).

3. Nature, Purpose, and Categories

  • Nature/purpose: hosting and delivery of the website, storage of notification-list entries, bot and abuse protection, debugging and security (server logs).
  • Data categories: email address (notification list), proof of consent (text version + timestamp), HMAC hashes of IP and email addresses (rate limiting), user agent (optional, error analysis), Turnstile challenge data, server log data.
  • Data subjects: visitors of the website and notification-list subscribers. No special categories (Art. 9 DSGVO).

4. Technical and Organisational Measures (TOMs, Overview)

  • Encryption in transit (TLS/HSTS) and within the Cloudflare network;
  • no plaintext storage of IPs/emails in keys and logs: HMAC-SHA256 with a server-side secret (pepper);
  • access restriction for KV data (operator only, no admin frontend);
  • storage limitation via TTLs (emails 12 months, limits hours/days);
  • logging exclusively server-side (RPC boundary), no PII in client error messages;
  • Turnstile bot protection and rate limits against abuse.

The infrastructure-side measures of Cloudflare (data centers, network security, certifications) are described in its documentation and DPA.

5. Sub-processors

Cloudflare may use sub-processors (including data center and network service providers). Cloudflare maintains the current list in its sub-processor documentation; contractually, this is governed by the Cloudflare DPA (Section 6).

6. DPA by Reference

For processing by Cloudflare, the Data Processing Addendum (DPA) of Cloudflare, including the EU Standard Contractual Clauses, applies by reference: https://www.cloudflare.com/cloudflare-customer-dpa/. We make no deviating or additional commitments beyond the Cloudflare DPA.

7. Data Subject Rights and Contact for DPA Matters

We process data subject requests (access, erasure, etc.) manually within one month. Contact: contact@queryance.com. The same applies to questions about this page and about data processing on behalf in general.