DAWTheory

Privacy Policy

Last updated: 28 July 2026

1. Controller

The controller responsible for the processing of personal data through this website is:

Martin Riedel
trading as DAWTheory
Josefstal 16
42699 Solingen
Germany

Email: martinriedel478@icloud.com

2. Hosting and technical operation

This website is hosted and delivered using services provided by Cloudflare, Inc.

When the website is accessed, Cloudflare may process technical information such as the IP address, requested page, date and time of access, browser and system information, routing information, and security-related data.

This processing is necessary to deliver the website, maintain its security and availability, prevent misuse, and investigate technical errors.

The legal basis is Article 6(1)(f) GDPR. The legitimate interest is the secure and reliable operation of the website.

Cloudflare may generate server-side operational, traffic, and security statistics from requests processed as part of hosting and protecting the website.

Cloudflare may process information outside the European Economic Area. Where required, international transfers are protected by an adequacy decision, standard contractual clauses, or another legally recognised safeguard.

3. Cloudflare Web Analytics

This website uses Cloudflare Web Analytics to measure website usage and technical performance.

Cloudflare Web Analytics uses a JavaScript beacon that is loaded in the visitor’s browser. Depending on the page visited and the browser used, the following information may be processed:

  • page views and visits;
  • visited pages and paths;
  • referring websites;
  • country;
  • device type;
  • browser and operating system;
  • navigation type;
  • page-loading times;
  • Core Web Vitals and other performance measurements; and
  • information required to distinguish normal visitor traffic from automated traffic.

According to Cloudflare, Cloudflare Web Analytics does not use cookies or local storage for analytics, does not fingerprint individual visitors, and does not track visitors across different websites.

Cloudflare Web Analytics is loaded only after the visitor has consented to analytics.

The legal basis is Article 6(1)(a) GDPR. Any access to information provided by the visitor’s browser is also based on consent under Section 25(1) TDDDG.

Consent is voluntary and may be withdrawn or changed at any time through:

[NAME OR LINK OF THE PRIVACY SETTINGS BUTTON]

If consent is not given or is withdrawn, Cloudflare Web Analytics will not be loaded. The basic operation of the website and access to its content will remain available.

Analytics information is retained only for as long as necessary to measure website usage, evaluate technical performance, and improve the website. The applicable retention period also depends on Cloudflare’s service configuration.

Cloudflare Web Analytics is provided by:

Cloudflare, Inc.
101 Townsend Street
San Francisco, California 94107
United States

4. Membership accounts and authentication

Users may create an account to purchase and access premium content.

Authentication is provided by:

[AUTHENTICATION PROVIDER]
[PROVIDER ADDRESS AND COUNTRY]
[LINK TO THE PROVIDER’S PRIVACY POLICY]

The following information may be processed for account creation, authentication, and account security:

  • email address;

  • internal account identifier;

  • securely hashed password credentials;

  • email-verification and password-reset information;

  • login and session information;

  • IP address;

  • browser and device information; and

  • security and fraud-prevention information.

Passwords are not stored in plain text. Authentication credentials are handled by the authentication provider using appropriate security measures.

The legal basis is Article 6(1)(b) GDPR, as processing is necessary to create and administer the account and provide the requested membership. Security-related processing is based on Article 6(1)(f) GDPR.

5. Memberships and premium content

The following information may be processed in order to administer memberships and premium access:

  • internal user identifier;
  • email address;
  • membership plan;
  • membership and access status;
  • start, renewal, cancellation, and expiry dates;
  • payment-provider customer and subscription identifiers;
  • payment status; and
  • records required to manage the membership or demonstrate the performance of the contract.

A name is processed only if it is entered by the user or required for billing, support, contractual, or legal purposes.

The legal basis is Article 6(1)(b) GDPR. Processing required to fulfil accounting, tax, or other legal obligations is based on Article 6(1)(c) GDPR.

6. Payment processing

Membership payments are processed by:

[PAYMENT PROVIDER]
[PROVIDER ADDRESS AND COUNTRY]
[LINK TO THE PROVIDER’S PRIVACY POLICY]

The payment provider may process information such as:

  • name and contact information;
  • billing address;
  • selected payment method;
  • card or bank-account information;
  • transaction amount and currency;
  • subscription and invoice information;
  • IP address and device information; and
  • information required for payment security, fraud prevention, refunds, or disputes.

Complete card numbers, bank-account details, and similar payment credentials are processed by the payment provider and are not stored in this website’s membership database.

This website normally receives only the information required to confirm the payment and manage the membership, such as the customer identifier, subscription identifier, payment status, membership period, and invoice information.

The legal bases are Article 6(1)(b) GDPR and, where legal record-keeping obligations apply, Article 6(1)(c) GDPR.

7. Cookies and browser storage

This website may use technically necessary cookies or comparable browser storage to:

  • create and maintain login sessions;
  • authenticate members;
  • protect accounts and prevent misuse;
  • provide access to premium content;
  • remember privacy and consent choices; and
  • provide interface settings expressly selected by the user.

These technologies are necessary to provide the functions requested by the user and do not require consent where the applicable legal requirements for technically necessary storage are met.

Optional analytics and advertising technologies are loaded only after the visitor has given the required consent.

A consent-management service is used to obtain, store, and communicate visitors’ privacy choices.

Consent settings are provided through:

[CONSENT MANAGEMENT PROVIDER OR “THE WEBSITE’S OWN CONSENT SYSTEM”]

Visitors can separately accept or reject optional purposes such as:

  • analytics;
  • personalised advertising;
  • advertising measurement; and
  • other optional third-party services.

Refusing optional services does not prevent access to the website or its basic content.

Consent can be withdrawn or changed at any time through:

[NAME OR LINK OF THE PRIVACY SETTINGS BUTTON]

The consent decision and related technical information may be retained for as long as necessary to respect the visitor’s selection and demonstrate that valid consent was obtained.

9. Advertising

This website may display advertisements supplied by third-party advertising providers.

Advertising provider:

[ADVERTISING PROVIDER]
[PROVIDER ADDRESS AND COUNTRY]
[LINK TO THE PROVIDER’S PRIVACY POLICY]

Depending on the provider and the consent given, advertising technologies may process information such as:

  • IP address;
  • browser and device information;
  • cookie or advertising identifiers;
  • pages viewed;
  • interactions with advertisements;
  • approximate location;
  • referrer information;
  • advertising frequency;
  • measurement and reporting information; and
  • fraud-prevention and security information.

Advertising technologies that require optional cookies, local storage, tracking pixels, browser identifiers, device access, or other non-essential processing are loaded only after the visitor has given the required consent.

The legal basis is Article 6(1)(a) GDPR and, where information is stored on or accessed from the visitor’s device, Section 25(1) TDDDG.

If the visitor rejects optional advertising technologies, the website may instead display directly supplied or self-hosted advertisements that do not use third-party tracking or non-essential browser storage.

Advertisements may change depending on the page, campaign, time, availability, or other non-personal criteria.

10. Direct and embedded advertisements

The website may display advertisements that are hosted directly on the website or delivered without third-party tracking technologies.

When a visitor clicks an advertisement, the visitor is transferred to the advertiser’s website. The advertiser is responsible for the data processing that occurs on its own website.

Some advertisers may provide banners, scripts, frames, widgets, or other content that is loaded from the advertiser’s servers. Such content may transmit the visitor’s IP address, browser information, the page containing the advertisement, and the time of access to the advertiser.

Embedded advertising content requiring consent is not loaded until the visitor has made the corresponding selection.

The relevant advertiser or advertising provider will be identified in this Privacy Policy before its content is used.

Some links on this website may be affiliate links. If a visitor follows an affiliate link and subsequently purchases a product or service, I may receive a commission.

Simple affiliate links do not establish a connection to the linked provider merely because the page containing the link is viewed.

When an affiliate link is clicked, the visitor is transferred to the third party’s website. The third party may receive information such as the visitor’s IP address, browser information, referring page, access time, and the affiliate identifier contained in the link.

Affiliate widgets, product embeds, tracking scripts, or comparable technologies are loaded only after any legally required consent has been obtained.

12. Contact by email

When you contact me by email, your email address, message content, and associated communication information are processed in order to respond to your enquiry.

The legal basis is Article 6(1)(b) GDPR where the enquiry relates to a membership, purchase, or prospective contract. For other enquiries, the legal basis is Article 6(1)(f) GDPR.

The information is deleted when it is no longer required, unless statutory retention obligations or the establishment, exercise, or defence of legal claims require longer storage.

13. Recipients and service providers

Personal data may be disclosed to service providers where this is necessary to:

  • host and secure the website;
  • measure website usage and performance after consent;
  • operate user accounts and authentication;
  • send verification, security, and account emails;
  • manage premium memberships;
  • process payments;
  • manage consent choices;
  • deliver advertisements after consent;
  • administer affiliate programmes; or
  • comply with legal obligations.

Relevant recipients may include:

  • Cloudflare, Inc.;
  • [AUTHENTICATION PROVIDER];
  • [EMAIL DELIVERY PROVIDER];
  • [PAYMENT PROVIDER];
  • [CONSENT MANAGEMENT PROVIDER];
  • [ADVERTISING PROVIDER]; and
  • [AFFILIATE NETWORKS OR PROVIDERS].

14. International data transfers

Some service providers may process personal data outside the European Economic Area.

Where required, such transfers are protected by an adequacy decision, the EU–US Data Privacy Framework, standard contractual clauses, or another safeguard recognised under applicable data-protection law.

More specific information will be provided in the sections concerning the relevant service providers.

15. Data retention

Account and membership information is retained for as long as the account or membership remains active and for as long as it is subsequently required for account administration, contractual documentation, security, or legal claims.

Data that is no longer required is deleted or anonymised.

Information relating to payments, invoices, contracts, accounting, or taxation may be retained for the applicable statutory retention period.

Login sessions, verification codes, password-reset links, and temporary security information expire or are deleted when they are no longer required.

16. Your rights

Subject to the applicable legal requirements, you have the right to:

  • obtain access to your personal data;
  • request the correction of inaccurate information;
  • request erasure;
  • request restriction of processing;
  • receive certain data in a portable format;
  • object to processing based on legitimate interests;
  • withdraw consent at any time; and
  • lodge a complaint with a data-protection supervisory authority.

To exercise your rights, contact:

martinriedel478@icloud.com

17. Changes to this Privacy Policy

This Privacy Policy will be updated if the website’s functions, service providers, analytics configuration, membership system, payment methods, advertising technologies, or data-processing practices change.

The version published on this page is the current version.