22Bits Digital

Privacy Policy

Controller

22Bits Digital GmbH
Im Mediapark 5
50670 Köln, Germany
Email: hq@22bits.de

Hosting

This website runs on Vercel. When the site is accessed, Vercel, acting as our processor, processes technically necessary connection data (server logs) in order to deliver the site and to ensure its secure and undisturbed operation. The legal basis for this is Art. 6(1)(f) GDPR (legitimate interest in the secure and undisturbed operation of this website).

Vercel retains these server logs for one day and then deletes them automatically. This period is not a setting we make: it follows from the plan we have booked and is determined by Vercel. If the plan changes, the period changes with it.

Analytics

This website uses Vercel Web Analytics to count page views. The data collected comprises the number of views, the referrer, and the route accessed. A view is attributed server-side via a hash of the incoming request, not via a recognition value on your device: nothing is stored on your device and nothing is read from it. The legal basis is Art. 6(1)(f) GDPR (legitimate interest in minimal, low-footprint usage statistics). Vercel acts as our processor in this respect.

Waitlist

You can join a waitlist to be notified once, as soon as 22bits.de goes live. The only data collected for this is your email address — no name, no further details, no sorting into groups. The legal basis is Art. 6(1)(a) GDPR (consent). You may withdraw your consent at any time with effect for the future; the link needed for this is included in every email we send to this address.

The sentence you agree to when submitting the form reads:

“Email me when 22bits.de goes live.”

Signing up is a two-step process. Submitting the form does not yet make the sign-up effective: we send you an email containing a confirmation link, and only when you open that link does the sign-up take effect. If you do not open the link, the unconfirmed entry expires on its own after 24 hours and is deleted without any action on our part.

To meet our duty of proof under Art. 7(1) GDPR, we store, for each confirmed sign-up, the consent wording displayed to you together with its version identifier, the time of submission and the time of confirmation, the IP address of both events, and the browser identifier of the confirmation. This data serves solely to prove that consent was given and is never used for any audience or behavioural measurement. The legal basis is Art. 6(1)(c) GDPR in conjunction with Art. 7(1) and Art. 5(2) GDPR (duty of proof and accountability).

A copy of every confirmed sign-up goes to our own mailbox hq@22bits.de so that the list is preserved outside the database as well.

If you withdraw your consent, we delete your email address in plain text, the stored IP addresses, the browser identifier, and all access tokens. What remains is a residual record (Rumpfbeleg): an irreversible hash of your address, the three timestamps of submission, confirmation, and withdrawal, and the version identifier of the consent text. We expressly do not claim that nothing about you remains stored afterwards: your address cannot be recovered from the hash, but an address that is already known can be matched against it. The residual record is therefore pseudonymous, not anonymous data. Its sole purpose is to prove that consent was given and when it was withdrawn. The legal basis is Art. 6(1)(f) GDPR (legitimate interest in being able to defend ourselves against a later claim that consent was never given); the exemption from the obligation to erase follows from Art. 17(3)(e) GDPR. The residual record is deleted automatically three years after the withdrawal.

Processors

We use three service providers that process personal data on our behalf and under our instructions. The contractual basis required by Art. 28 GDPR is in place with all three.

All three providers are US companies and may process data in the United States or in other third countries. For that case, the agreements concluded with Vercel and with Resend each provide for the European Commission’s Standard Contractual Clauses under Implementing Decision (EU) 2021/914, specifically in Module 2 (controller to processor). They thus constitute the safeguard within the meaning of Art. 46(2)(c) GDPR for transfers to a third country.

Why this site works without a cookie banner

This website needs no consent to cookies because it sets none.

It stores nothing on your device and reads nothing from it — neither cookies nor local or session storage. The consent requirement of § 25(1) TDDDG (the German act on data protection in telecommunications and digital services) attaches to exactly that: to access to your device, not to processing as such. Where no such access takes place, it does not apply. The processing operations that do exist here remain governed by the GDPR legal bases stated above for each of them.

We verify automatically, on every change to this website, that this remains the case — twice over: once against the shipped code and once against a real browser run across the home page and the form.

What does not happen on this website

Beyond the processing described above, no further processing of personal data takes place on this website. In particular, this website uses:

Your rights

You have the following rights under Art. 15 to 21 GDPR. For each of them there is a route here that you can actually take.

We respond to requests under Art. 15 to 21 GDPR within the statutory period of Art. 12(3) GDPR, that is, without undue delay and at the latest within one month of receipt.

Version: 2026-08-31.