Privacy policy

1. Controller
Maximalman UG (haftungsbeschränkt), represented by Maximilian Venhofen. Address as in the legal notice. Contact: [email protected].

2. Hosting (Cloudflare Pages)
This site is served through Cloudflare Pages, operated by Cloudflare, Inc. (101 Townsend St, San Francisco, CA 94107, USA). When you open a page, Cloudflare processes technically necessary data (such as IP address, time, page requested, user agent) in server logs, also to fend off attacks. The legal basis is our legitimate interest in secure and stable operation (Art. 6(1)(f) GDPR). We have a data processing agreement with Cloudflare, and transfers to the USA are based on the EU standard contractual clauses.

3. Fonts
The Mona Sans typeface is self-hosted and delivered from this site's own network. No connection to Google Fonts is made.

4. Getting in touch
When you use the contact form or write to us by email, we process the details you provide (name, email address, subject, message) in order to deal with your enquiry (Art. 6(1)(b) or (f) GDPR). For the form, a Cloudflare Pages function receives the message and stores it in a Cloudflare database (D1) located in Europe. An automated workflow at GitHub (GitHub, Inc., USA) reads new messages regularly and delivers them by email through a Google mail account (Gmail) to our mailbox; the entry in the database is then deleted. This can involve a transfer to the USA at GitHub and Google. Hosting and database run on Cloudflare (see section 2). A hidden field serves spam protection only. The mailbox [email protected] is operated through Apple iCloud+ (Custom Email Domain). We also record the message in our internal contact database so that we can see what was discussed with whom (see section 9). We process your details only to answer you and to work together, and keep them no longer than needed for that.

5. Newsletter (MailerLite, double opt-in)
Sign-up uses double opt-in: after you enter your address you receive an email with a confirmation link, and only then are you added. We store the email address and the time of sign-up and confirmation as proof of consent. The legal basis is your consent (Art. 6(1)(a) GDPR), which you can withdraw at any time with effect for the future, for example through the unsubscribe link in every issue. Sending and administration run through MailerLite (UAB „MailerLite“, Pašilaičių g. 79-77, Vilnius, Lithuania) as a processor inside the EU. The sign-up form is embedded by MailerLite on most pages of this website. Loading such a page establishes a connection to MailerLite, and functional cookies may be set for the display and function of the form. The legal basis for this is our legitimate interest in providing the sign-up form (Art. 6(1)(f) GDPR).

6. Audience measurement and cookies
We measure usage on two levels in order to improve the site. (a) A cookieless measurement records technical basics (page requested, outbound clicks on external links, referring website as the bare domain such as "linkedin.com" without path or parameters, time) without cookies, without storing the IP address and without personal data; processing runs through Cloudflare (see section 2). The legal basis is our legitimate interest in data-minimising audience measurement (Art. 6(1)(f) GDPR); as there are no cookies and no personal data, consent is not required. (b) In addition you may allow Google Analytics 4 through the cookie banner. It uses cookies and is loaded only after your express consent (Art. 6(1)(a) GDPR). You can withdraw that consent at any time with effect for the future. The provider is Google, and a transfer to the USA may take place. IP anonymisation is switched on. Without your consent Google Analytics is not loaded. We store your choice in your browser's local storage so that the banner does not appear on every visit; this is necessary for that function (§ 25(2) no. 2 TDDDG).

7. Videos (YouTube)
On the interview pages we embed videos from YouTube. The embedding works as a two-click solution: when you open the page you first see only a preview image, served from our own network. As long as you do not start the video, no connection to Google is made and no data is transferred to Google. Only when you click the play button is the player loaded from youtube-nocookie.com and playback starts. Google then learns your IP address as well as further device and browser data, and cookies or similar technologies are stored on or read from your device. If you are signed in to Google at the same time, Google can link the request to your account. The provider is Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Ireland); a transfer to Google LLC in the USA may take place. Google processes this data under its own responsibility, see the Google privacy policy. The legal basis is the consent you give by clicking (Art. 6(1)(a) GDPR, § 25(1) TDDDG). You can withdraw it at any time with effect for the future by leaving or reloading the page and not starting the video again.

8. People listed under „Who shapes CRCF“
On the page /people/ we name people who publicly shape the CRCF, with their name, role and organisation. The details come from publicly accessible sources such as the websites of the institutions, event programmes and publications. The legal basis is our legitimate interest in making the public debate on the CRCF traceable (Art. 6(1)(f) GDPR). Anyone named who does not want to be can object at any time; a message to [email protected] is enough and we remove the entry.

9. Contacts at listed project developers
In order to tell listed project developers about their entry and give them the chance to correct it, we research the name, role and business email address of contacts, in particular of the management. Sources are the companies' websites (legal notice, team and contact pages), public registers and a business contact service (Apollo.io, USA). The same applies to companies we ask about their activity before a possible listing, and to contacts at institutions and partners. We record the history (date, channel, subject, notes) in an internal contact database at Cloudflare (D1, located in Europe) that is reachable only after signing in through Cloudflare Access; connection requests on LinkedIn are sent without a message. These details are not published and are not carried over into our newsletter. If no contact comes about, we delete them at the latest twelve months after the last message. The legal basis is our legitimate interest (Art. 6(1)(f) GDPR). You can object at any time, and we will then delete the details.

10. Your rights
Access, rectification, erasure, restriction, data portability and objection under Art. 15 to 21 GDPR. A message to [email protected] is enough to exercise them. You also have the right to lodge a complaint with a supervisory authority; the competent one is the Bavarian State Office for Data Protection Supervision (BayLDA).

Last updated: 4 October 2026.