Privacy policy

1. Controller

The controller responsible for processing personal data on this website within the meaning of the General Data Protection Regulation (GDPR) is:

“Tommsel Books” is the name of this website. The controller is the natural person named above.

2. Overview

This website consists exclusively of static pages. It does not use cookies, does not store any information in your browser (for example local storage), does not use analytics, tracking or advertising tools, offers no user accounts or forms and does not load scripts, fonts or other content from third parties. The fonts used are served by this website itself.

Personal data is processed only in the following cases: when the hosting provider technically delivers the pages (section 3) and when you contact us by email (section 5).

3. Hosting and delivery of the website

The website is hosted by the following provider and delivered via its global content delivery network (CDN):

Vercel Inc., 440 N Barranca Ave #4133, Covina, CA 91723, USA

Each time a page is requested, the hosting provider processes technically necessary data. This includes:

• IP address of the requesting device
• date and time of the request
• requested address (URL) and HTTP status code
• amount of data transferred
• browser type and version and operating system (user agent)
• referrer address, if your browser sends it
• approximate location derived from the IP address (country, city)

The purpose of this processing is to deliver the website, ensure its stability and security, and prevent misuse and attacks. The legal basis is Art. 6(1)(f) GDPR. The legitimate interest lies in delivering this website securely and reliably.

The processing is carried out on behalf of the controller under a data processing agreement pursuant to Art. 28 GDPR. This website runs on the Pro plan. For this plan, the provider’s Data Processing Addendum (DPA) forms part of the contract according to the provider. Under the DPA, the provider also processes certain data arising from the use of its service under its own responsibility, for example to secure its platform.

The hosting provider is based in the USA. Data may therefore be transferred to the USA and to other countries in which the provider or its sub-processors operate servers. According to the provider, it complies with the EU-U.S. Data Privacy Framework; for certified companies an adequacy decision of the European Commission exists (Art. 45 GDPR). In addition, the DPA provides for the European Commission’s Standard Contractual Clauses (Decision 2021/914, Art. 46(2)(c) GDPR). The provider publishes its sub-processors at security.vercel.com.

Safeguards: The connection between your browser and this website is encrypted (HTTPS); the website instructs browsers via HSTS to connect only in encrypted form. The provider describes its technical and organisational measures in its DPA, including encryption of stored data and TLS in transit.

Retention: For runtime logs, the provider states a retention of one day on the Pro plan. With paid add-ons, this period can be up to 30 days according to the provider. For other log and connection data (for example requests to the delivery network) it states no fixed period; according to its DPA it deletes or anonymises such data once it no longer needs it.

This website embeds no analytics or measurement scripts, and its Content Security Policy prevents scripts from being loaded in the browser. Audience measurement in the browser (such as the provider’s Web Analytics or Speed Insights) therefore does not take place. If further services of the provider are used, this policy will be updated beforehand.

4. Cookies and storage on your device

This website does not set cookies and does not read any information from your device. It uses neither local storage nor session storage or comparable technologies. Consent under Section 25 of the German Telecommunications Digital Services Data Protection Act (TDDDG) is therefore not required, and there is no cookie banner.

Your browser may cache files of this website (for example images and stylesheets). This browser cache serves only the technical delivery and is managed by your browser.

5. Contact by email

If you contact us by email, your email address, your name (if provided) and the content of your message are processed in order to answer your enquiry. The mailbox (a Gmail address) is operated by the following provider:

Google Ireland Limited (Gmail), Gordon House, Barrow Street, Dublin 4, Ireland

The legal basis is Art. 6(1)(b) GDPR insofar as your enquiry relates to a contract or pre-contractual measures, and otherwise Art. 6(1)(f) GDPR. The legitimate interest lies in answering your enquiry.

Your message is therefore not processed exclusively on the controller’s own device, but also by the email provider. The provider processes the data under its own privacy policy; for users in the European Economic Area, Google names Google Ireland Limited as the responsible entity. Data may also be transferred to the USA and to other countries; Google states that it complies with legal frameworks for such transfers. Your own email provider and other parties along the transmission path may also process your message, and emails are not always encrypted in transit.

Your message is deleted once your enquiry has been dealt with and no statutory retention obligation applies. Business correspondence may be subject to retention periods under commercial or tax law; in that case it is kept until the period expires and then deleted.

6. Links to Amazon and to sources

The books are sold exclusively through Amazon. This website does not embed any content, scripts or images from Amazon. Simply visiting this website therefore does not transmit any data to Amazon.

Only when you deliberately click a link to an Amazon product page (currently amazon.com) does your browser open the Amazon website. From that point on, Amazon is responsible for processing your data and Amazon’s privacy notice applies. This website does not send any referrer information, so Amazon does not learn which page you came from. The links contain no affiliate or tracking identifiers.

Some pages cite scientific sources with a link via doi.org, a service that forwards you to the page of the respective journal. Here too, a connection is only made when you click, and no referrer information is sent. The operators of the pages you visit are responsible for them.

7. Recipients

Recipients of personal data are exclusively the hosting provider (section 3) and the provider of the mailbox (section 5), each together with their sub-processors. Data is not passed on for advertising purposes.

8. Your rights

Under the GDPR, you have the following rights:

• access to your personal data (Art. 15 GDPR)
• rectification of inaccurate data (Art. 16 GDPR)
• erasure (Art. 17 GDPR)
• restriction of processing (Art. 18 GDPR)
• data portability (Art. 20 GDPR)
• objection to processing based on Art. 6(1)(f) GDPR on grounds relating to your particular situation (Art. 21 GDPR)
• lodging a complaint with a data protection supervisory authority, in particular in the Member State of your habitual residence, place of work or place of the alleged infringement (Art. 77 GDPR)

9. Further information

No automated decision-making, including profiling, within the meaning of Art. 22 GDPR takes place.

You are not obliged to provide personal data. However, the website cannot be delivered without the technical processing of your IP address.

This privacy policy will be updated whenever the website or the services used change. The German version is authoritative.