GDPR · Last updated: 27 October 2026

Privacy Policy

This English version is provided for convenience. The German version is legally binding.

1. Controller

werz-digital
Owner: Lukas Werz
Am Riembach 21, 31171 Nordstemmen, Germany
VAT ID: DE361830924
Phone: +49 151 25973194 (Mon to Fri, 9 am to 5 pm CET)
E-mail: hallo@werz-digital.de

We have not appointed a data protection officer. For all privacy questions, please write to the e-mail address above.

2. Scope

This policy applies to the website werz-digital.de (including www.werz-digital.de and the English pages under /en) and, in section 10, to the CarnetPix platform at carnetpix.werz-digital.de. The CamCue shop and the CamCue licence server have their own privacy policy (see section 11).

3. Hosting and server logs

All our websites run on our own server operated by netcup GmbH, Daimlerstraße 25, 76185 Karlsruhe, Germany. The server is located in Germany. We do not use a content delivery network or any other upstream service. We have concluded a data processing agreement with netcup under Art. 28 GDPR.

When you open a page, your browser necessarily transmits your IP address and technical request data. We use them only to deliver the page and, for forms, to limit the number of requests per IP address. The limit is kept in working memory only and is not stored. Our reverse proxy writes no access logs, and the application does not log client IP addresses. Legal basis: Art. 6(1)(f) GDPR (our legitimate interest in a secure, working website).

4. E-mail

If you write to us by e-mail, your message is received and stored in a mailbox hosted by netcup GmbH (see section 3). Messages from our forms and automatic system notifications are delivered to the owner's e-mail mailbox at STRATO AG (Germany). We send e-mails through our own mail server, which delivers directly to the recipient's mail server. It logs the recipient address, time and delivery status in a size-limited log that is overwritten on a rolling basis. Legal basis: Art. 6(1)(b) GDPR where your message concerns a contract or a possible contract, otherwise Art. 6(1)(f) GDPR (our legitimate interest in answering enquiries and in reliable delivery).

5. Cookies and local storage

We do not use advertising or third-party cookies. Storing information on your device or reading it from there is only permitted without consent if it is strictly necessary for a service you have requested (Section 25(2) no. 2 TDDDG, the German Telecommunications Digital Services Data Protection Act). Anything else requires your consent (Section 25(1) TDDDG). On werz-digital.de we use:

6. Language detection

If you open a German page and no language cookie is set, our server reads the Accept-Language header that your browser sends with every request. If your browser does not prefer German, we redirect you to the English version under /en. Nothing is stored in the process. Legal basis: Art. 6(1)(f) GDPR (our legitimate interest in showing the page in a language you understand).

7. Statistics (only with your consent)

If you allow statistics in the consent banner, we record how our website is used so that we can improve it. The data is stored in a separate database of our own on the same server. Nothing is passed to third parties. We store:

• the page path, the page language and the referring domain,
• UTM source, UTM medium and UTM campaign, if the link you followed contains them,
• device class, browser family, screen size class and time zone,
• scroll depth and time spent on the page,
• the text and target of buttons you click and the identifier of forms you submit (not their contents),
• a random session identifier for the current tab (werz-sid),
• a salted checksum of your browser identification string, device classes and the current date. It changes every day, so we cannot recognise you on a later day.

We do not store your IP address or your country. We cannot attribute this data to you as a person; to be safe, we still treat it as personal data. Legal basis: Section 25(1) TDDDG and Art. 6(1)(a) GDPR (consent). Without your consent, no statistics are collected. The data is deleted automatically after 18 months. You can withdraw your consent at any time with effect for the future via the “Cookie-Einstellungen” (cookie settings) link in the footer (Art. 7(3) GDPR).

8. Forms

Our forms are protected by a hidden honeypot field and by the per-IP request limit described in section 3. The data you enter is not stored in a database. It is sent as an e-mail to the owner's mailbox at STRATO AG (see section 4).

Contact form

Data: name, e-mail address, company (optional), the selected project types and your message. Purpose: to handle and answer your enquiry. Legal basis: Art. 6(1)(b) GDPR where your enquiry is aimed at a contract, otherwise Art. 6(1)(f) GDPR (our legitimate interest in answering enquiries). The checkbox only confirms that you have read this notice.

Early access list

Data: your e-mail address. Purpose: to contact you about the early access. Legal basis: Art. 6(1)(a) GDPR (consent). We keep your address until the early access ends or until you withdraw your consent, whichever comes first, and no longer than 24 months after you signed up. You can withdraw it at any time by e-mail to hallo@werz-digital.de.

CarnetPix access request

Data: name, e-mail address, production or company (optional) and your message (optional). Purpose: to discuss access to the CarnetPix beta with you. Legal basis: Art. 6(1)(b) GDPR (steps prior to entering into a contract at your request) and, where you tick the consent box, Art. 6(1)(a) GDPR.

Retention

We delete form messages once your request has been dealt with. If the correspondence becomes a business letter (for example because it leads to an offer or a contract), we keep it for 6 years as required by German tax law (Section 147 AO). The early access address is kept as described above.

9. Fonts

All fonts are served from our own server. We do not use external services such as Google Fonts, so no data is sent to third parties when a page loads.

10. CarnetPix platform (carnetpix.werz-digital.de)

CarnetPix is a closed beta and an internal tool for documenting equipment with photos. This section applies to people who use the platform with an account. We operate the beta platform ourselves on the same server at netcup in Germany. If we set up a separate installation for a company, we conclude a data processing agreement (Art. 28 GDPR) with that company. We do not use third-party services and do not pass on data.

What we process

• Accounts: e-mail address, display name, role, password hash (Argon2id), and a counter of failed sign-in attempts with a temporary lock.
• Device sessions for phones: device name, time of creation and last use, and revocation. The device table contains no IP address and no device fingerprint.
• Security log: the action and the account or device concerned. For sign-ins and device pairing we also log the IP address and the browser identification string. E-mail addresses appear in this log only as a checksum. IP address and browser identification string are removed after 90 days.
• Photos of equipment and who uploaded them. Metadata, including GPS location, is removed on upload; only the time the photo was taken is kept.
• Operational logs of the server, which contain IP addresses, are kept for 14 days.

Cookies and local storage

cp_web (sign-in in the browser, 14 days), cp_dev (phone session, 24 hours), cp_csrf (protection against forged requests, until the browser is closed) and the localStorage entry carnetpix.m.merker (work in progress on the phone, 12 hours, contains no photos). All of them are strictly necessary for the service you use (Section 25(2) no. 2 TDDDG).

Legal basis

Art. 6(1)(b) GDPR for users who work with CarnetPix under a usage relationship with us, and Art. 6(1)(f) GDPR for security logging (our legitimate interest in protecting accounts and detecting misuse). If CarnetPix is used on behalf of a company, that company may be the controller for the data processed in its installation. werz-digital then acts as its processor under a data processing agreement (Art. 28 GDPR); in that case, please contact the company first.

Retention

Account data is kept for as long as the usage relationship exists. Deleted photos are removed permanently after 30 days. Database backups are kept for 30 days, so deleted data may remain in a backup until that backup expires.

11. CamCue shop

For the CamCue shop at camcue.werz-digital.de, including customer accounts, payments and licence checks by the CamCue app (license.werz-digital.de), a separate privacy policy applies: camcue.werz-digital.de/datenschutz.

12. Recipients, transfers and automated decisions

Recipients of personal data are only the processors named above: netcup GmbH (hosting and mailbox) and STRATO AG (the owner's mailbox). We do not transfer personal data to countries outside the EU or the EEA, except where an e-mail you asked for is delivered to your own mail provider. We do not use automated decision-making, including profiling, within the meaning of Art. 22 GDPR.

You are not legally or contractually required to provide personal data. Without your e-mail address, however, we cannot answer your enquiry, and without an account you cannot use CarnetPix.

13. Your rights

You have the following rights regarding your personal data:

• Access (Art. 15 GDPR)
• Rectification of inaccurate data (Art. 16 GDPR)
• Erasure, unless a legal retention obligation applies (Art. 17 GDPR)
• Restriction of processing (Art. 18 GDPR)
• Data portability (Art. 20 GDPR)
• Objection (Art. 21 GDPR, see the box below)
• Withdrawal of consent at any time with effect for the future (Art. 7(3) GDPR). Processing carried out before the withdrawal remains lawful.

Please send requests by e-mail to hallo@werz-digital.de.

14. Right to lodge a complaint

You have the right to lodge a complaint with a data protection supervisory authority, in particular in the EU member state of your habitual residence, place of work or the place of the alleged infringement (Art. 77 GDPR). The authority responsible for us is:

Der Landesbeauftragte für den Datenschutz Niedersachsen
(Data Protection Commissioner of Lower Saxony)
Prinzenstraße 5, 30159 Hannover, Germany
www.lfd.niedersachsen.de

Last updated: 27 October 2026. We will update this policy when our services or the law change.