Legal

Privacy Policy

Last updated: July 22, 2026

This Privacy Policy explains what personal data we ("SSEC") collect when you use this website or the SSEC service, why we collect it, how long we keep it, who we share it with, and the rights you have under the EU General Data Protection Regulation (GDPR). The German-language "Datenschutzerklärung" (available here) is the legally binding version for a controller based in Germany; this English translation is provided for convenience.

1. Controller (Verantwortlicher)

The controller responsible for the processing of your personal data under Art. 4(7) GDPR is:

Bastian Wiedenhöfer
Jahnstr. 23
73441 Bopfingen, Germany
Phone: +49 157 81288056
Email: ssec.concepts@gmail.com

We have not appointed a Data Protection Officer as we do not meet the thresholds under Art. 37(1) GDPR / § 38 BDSG.

2. What data we collect and why

2.1 Server log files

When you visit this website, our hosting provider (Netlify Inc.) automatically collects and stores technical information ("server log files") in an access log:

IP address (anonymised after 7 days)
Date and time of the request
Requested URL and HTTP method
HTTP status code and bytes transferred
Referring URL, browser and OS user-agent string

Purpose: operating and securing the website, detecting and defending against attacks.
Legal basis: Art. 6(1)(f) GDPR — legitimate interest in providing a stable and secure service.
Retention: 7 days, then automatic deletion; longer only if a specific security incident is under investigation.

2.2 Contact by email

If you contact us at ssec.concepts@gmail.com, we process the email address you write from, any name you provide, and the content of your message.

Purpose: responding to your inquiry.
Legal basis: Art. 6(1)(b) GDPR (pre-contractual measures) or Art. 6(1)(f) GDPR (legitimate interest in responding).
Retention: until your inquiry is resolved, then archived for up to 3 years per § 195 BGB statute-of-limitations; commercial correspondence up to 6 years per § 257 HGB.

2.3 Waitlist signup

If you enter your email on the waitlist, we store the email address, the timestamp, and the consent record (confirmation checkbox + double-opt-in click).

Purpose: notifying you when SSEC opens and — if you also opted in — occasional product updates.
Legal basis: Art. 6(1)(a) GDPR — your consent.
Retention: until you unsubscribe. Every email contains a one-click unsubscribe link. You can also revoke consent at any time by emailing ssec.concepts@gmail.com.
Processor: Netlify Inc. (USA — see section 5 below on international transfers). Migration to MailerLite Ltd (Ireland, EU-hosted) is planned once subscriber count justifies a dedicated newsletter provider..

2.4 Testimonial form (on pricing page)

If you submit the "Share your experience" form, we store the name and testimonial text you submit.

Purpose: collecting and — with your subsequent consent — publishing testimonials.
Legal basis: Art. 6(1)(a) GDPR — consent (form submission).
Retention: until you request deletion. We do NOT publish any testimonial without a separate written OK from you.

2.5 Account and payment data (for paying customers)

If you subscribe to SSEC, we process:

Name, billing address, email
Subscription tier and start/end dates
Connection metadata needed to link your TradingView and TradersPost accounts

Payment data (card number, IBAN, PayPal identifier) is never stored by SSEC — it is handled directly by our payment processor: Lemon Squeezy LLC (USA, mit EU-DPA). See their privacy policy at https://www.lemonsqueezy.com/privacy.

Purpose: delivering the paid service, billing, tax records.
Legal basis: Art. 6(1)(b) GDPR (contract) and Art. 6(1)(c) GDPR (legal obligation — § 147 AO, 10-year retention for tax-relevant documents).
Retention: for the duration of the contract plus 10 years for tax records.

2.6 Onboarding (Zoom)

If you book a Zoom onboarding call, Zoom Video Communications, Inc. (USA) processes your name, email, IP address, and any video/audio you transmit during the call. See Zoom's privacy policy at https://zoom.us/en-us/privacy.html.

Recordings: we do NOT record onboarding calls without your explicit prior consent at the start of the call.
Legal basis: Art. 6(1)(b) GDPR (contract performance).

2.7 Discord community

If you join our Discord server, Discord Inc. (USA) processes your Discord username, messages, and any other data you share on the server. Our role there is limited to moderation; Discord is the primary controller for the platform itself. See Discord's privacy policy: https://discord.com/privacy.

3. Cookies and local storage

This website uses only strictly necessary storage:

ssec_consent (LocalStorage) — stores your cookie/consent choice. Persisted for 12 months. Legal basis: Art. 6(1)(c) GDPR / § 25(2) TTDSG (strictly necessary).
splash_seen (LocalStorage) — remembers whether you have seen the splash animation, so we do not repeat it every page load. Legal basis: Art. 6(1)(f) GDPR — UX improvement, exempt from consent under § 25(2) TTDSG.

We do not use tracking cookies, advertising pixels, third-party analytics that identify you personally, or fingerprinting techniques.

You can revoke your consent at any time via the "Cookie settings" link in the footer or by clearing your browser storage for this domain.

4. Third parties we share data with (processors and recipients)

Recipient	Purpose	Location	Basis
Netlify Inc.	Website hosting	USA (SCC + DPA)	Art. 28 DPA
Netlify Inc.	Waitlist form processing	USA (SCC + DPA)	Art. 46(2)(c) GDPR
Lemon Squeezy LLC	Payment processing	USA (mit EU-Compliance / DPA)	Own controller
Zoom Video Communications, Inc.	Onboarding calls	USA (SCC + DPA)	Art. 46(2)(c) GDPR
Discord Inc.	Community server	USA (SCC)	Own controller
TradingView Inc.	Signal generation (your own account)	USA	Own controller — not our processor
TradersPost, Inc.	Webhook execution (your own account)	USA	Own controller — not our processor
Netlify Inc.	Newsletter delivery	USA (SCC + DPA)	Art. 28 DPA

5. International transfers

Some processors we use are located in the United States, a country outside the EEA. Where such a transfer occurs, we rely on:

The EU-U.S. Data Privacy Framework (Commission adequacy decision of 10 July 2023) for providers who are certified under it; and/or
Standard Contractual Clauses (SCC) per Art. 46(2)(c) GDPR for providers not covered by the DPF; and/or
Your explicit consent per Art. 49(1)(a) GDPR for the waitlist submission (Netlify), after being informed of the residual risks (potential US-government access, limited redress).

6. Your rights

You have the following rights regarding your personal data:

Right of access (Art. 15 GDPR) — a copy of the data we hold about you.
Right to rectification (Art. 16 GDPR) — correction of inaccurate data.
Right to erasure (Art. 17 GDPR) — deletion, subject to legal retention.
Right to restriction (Art. 18 GDPR) — freeze processing.
Right to data portability (Art. 20 GDPR) — export in a structured format.
Right to object (Art. 21 GDPR) — object to processing based on legitimate interest.
Right to withdraw consent (Art. 7(3) GDPR) — with effect for the future.
Right to lodge a complaint with a supervisory authority (Art. 77 GDPR).

To exercise any of these rights, email ssec.concepts@gmail.com. We respond within 30 days per Art. 12(3) GDPR.

7. Right to complain

The competent supervisory authority for us is:

Der Landesbeauftragte für den Datenschutz und die Informationsfreiheit Baden-Württemberg (LfDI BW), Königstraße 10a, 70173 Stuttgart, Telefon 0711 615541-0, E-Mail poststelle@lfdi.bwl.de, https://www.baden-wuerttemberg.datenschutz.de

You may also contact any other EU supervisory authority per Art. 77 GDPR.

8. Automated decision-making

We do not use automated individual decision-making including profiling within the meaning of Art. 22 GDPR.

9. Changes to this policy

We update this Privacy Policy when law or our processing changes. The current version and "Last updated" date at the top always apply. If a change materially affects your rights, we notify you by email (if we have your address) or via a prominent site notice.