Privacy Policy

This policy covers everything under mbohlen.de: the website, the Architecture Practice Lab ("Archilab") at mbohlen.de/archilab/ and, until it has moved there, at archilab.mbohlen.de, my email newsletter, and open seminars you book with me. This page describes who is responsible, what is processed for which purpose and on which legal basis, who receives it, and what rights you have.

1 Who is responsible

The controller under Art. 4(7) GDPR is:

Matthias Bohlen IT-Beratung
Matthias Bohlen
Luise-Albertz-Str. 25
53340 Meckenheim
Germany
Email: mbohlen@mbohlen.de
Phone: +49 (170) 772 8545

I am not required to appoint a data protection officer. For every question about your data, write to the address above.

2 Visiting the website

2.1 Server logs

Every time you open a page, your browser sends technical data to my web server: your IP address, date and time, the address requested, the HTTP status, the amount of data transferred, the referring page and your browser's user agent. The server records these in log files. I use them to deliver the site, to keep it secure and to find errors. The legal basis is my legitimate interest in a secure, working website (Art. 6(1)(f) GDPR).

The website and Archilab run on servers I operate in Germany and Spain.

When you pick a language with the language switcher, the server stores your choice in a cookie named lang (for example lang=de) for one year, so that mbohlen.de opens in that language next time. It is written only when you use the switcher and contains nothing but the language code. Storing it is necessary for a feature you asked for (§ 25(2) no. 2 of the German Telecommunications Digital Services Data Protection Act, TDDDG); the legal basis for using it is Art. 6(1)(f) GDPR. You can delete it in your browser at any time; the site then falls back to your browser's language.

2.3 Usage statistics

On every page of mbohlen.de, the website and Archilab alike, I count visits with Plausible Analytics (Plausible Insights OÜ, Tartu, Estonia). Plausible sets no cookies and stores no IP addresses. It identifies a visit for one day by a hash of IP address, user agent and a salt that changes daily, and keeps only totals: pages, referring sites, countries, devices. I use these to see which pages help people and which don't. Plausible processes the data on my behalf on servers in the EU. The legal basis is my legitimate interest in understanding how the site is used (Art. 6(1)(f) GDPR).

2.4 Page views linked to your newsletter contact

The pages of mbohlen.de also load a script from my newsletter system (Mautic open source), which runs on my own servers (no data is transferred to any 3rd party for this to work). It records which pages you view and, if you are on my newsletter list and have clicked a link in one of my emails, links those page views to your contact, so that I send you the emails you are actually interested in. It stores an identifier on your device for that. You can withdraw your tracking consent at any time, using the unsubscribe link that is contained in every email that I send to you, as well as in the privacy settings of your user profile in Archilab. In both cases, Mautic will stop tracking.

3 Using Archilab

3.1 Account and login

To use Archilab, you create an account with your email address. Login is handled by Hanko, an authentication service of Hanko GmbH (Kiel, Germany), which processes your login data on my behalf on servers in Germany: I store no passwords. After login, Hanko sets a session cookie named hanko that keeps you signed in. Because the website and Archilab share the address mbohlen.de, your browser also sends this cookie with requests for website pages; the website ignores it. The cookie is technologically necessary for the service you requested (§ 25(2) no. 2 TDDDG). Processing your account data is necessary to provide Archilab to you (Art. 6(1)(b) GDPR).

3.2 Courses, submissions and Git workspaces

When you enroll in a course, Archilab stores your enrollments, your progress, the work you submit and the feedback you receive. For each exercise you get a Git repository on my own Git server (Gitea), and Archilab reads the commit history of that repository to show your activity. This processing is what the service consists of (Art. 6(1)(b) GDPR).

3.3 AI review of your submissions

If you ask for an AI review, Archilab sends the code and notes of your submission to Anthropic PBC (USA), which runs the language model that writes the review. Your name and email address are not sent. Anthropic processes this data on my behalf and does not use it to train its models. The legal basis is Art. 6(1)(b) GDPR. On the transfer to the USA, see section 7.

An AI review is feedback on your work. It does not decide anything about you with legal or similarly significant effect (Art. 22 GDPR).

3.4 Payments

Paid plans and cohort seats are sold through Paddle (Paddle.com Market Ltd, London, United Kingdom). Paddle is the merchant of record: you enter into the purchase with Paddle, and Paddle collects your payment and billing data and issues the invoice as a controller in its own right, under its own privacy policy (paddle.com/legal/privacy). I never see your card or bank details. From Paddle I receive what I need to unlock your plan: which plan you bought, when, and its status. The legal basis is Art. 6(1)(b) GDPR.

3.5 Service emails

Archilab sends you emails that belong to the service, such as a notice that a review is ready or a confirmation that your account was deleted. They are delivered by my email provider, Infomaniak Network SA (Les Acacias, Geneva, Switzerland), which processes them on my behalf, and never go through the newsletter system. The legal basis is Art. 6(1)(b) GDPR. On the transfer to Switzerland, see section 7.

I write about further courses and training dates. Who gets these emails depends on how you came to me, and I keep the two cases apart:

You bought something from me (a training, a cohort seat or a PRO plan): I may tell you about my own, similar courses at the email address you gave me for that purchase. This is permitted by § 7(3) of the German Act Against Unfair Competition (UWG); the legal basis under data protection law is my legitimate interest in telling customers about similar offers (Art. 6(1)(f) GDPR). I tell you about your right to object in the email that comes with your booking and in every newsletter after that.
In every other case, in particular if you only enrolled in a free course, you get the newsletter only if you have explicitly asked for it (Art. 6(1)(a) GDPR). There are exactly two places to ask: the confirmation link in the welcome email of your first enrollment, and the switch in your Archilab settings. Neither is bundled with accepting terms or enrolling, and a free enrollment never counts as consent.

You can stop the newsletter at any time and free of charge: with the unsubscribe link in every newsletter (one click on the page it opens, no login needed), with the switch in your Archilab settings, or by writing to me. It takes effect immediately. Once you have objected or withdrawn your consent, that is stored and no automatic process ever reverses it, not even a later booking. Only you can opt back in.

How the newsletter is sent. The contact list is kept in Mautic, on my own server in Germany. It holds your name, email address, language, which of my courses you are enrolled in or have finished, and your newsletter preference with the date and source of each change. The emails are delivered by Amazon Web Services' email service (Amazon SES), which processes them on my behalf in the USA. Only your name and email address and the message itself reach Amazon; nothing about your submissions, reviews or learning progress does. On the transfer, see section 7.

Opens and clicks. Mautic records whether you open a newsletter and which links you click, and Archilab notes which campaign brought you back. I use this to see which emails are useful.

5 Contacting me and booking an open seminar

If you write to me by email or call me, I process what you tell me and your contact details to answer you. The legal basis is Art. 6(1)(b) GDPR if your message is about a contract or a booking, otherwise my legitimate interest in answering you (Art. 6(1)(f) GDPR). My mailbox is hosted by Infomaniak Network SA in Switzerland, which processes your emails on my behalf.

If you book an open seminar, I process your registration data (name, company, billing address, email) to run the seminar and invoice it (Art. 6(1)(b) GDPR) and keep the invoice as tax law requires (Art. 6(1)(c) GDPR). Where a seminar is held with an external trainer or at a partner's venue, they receive the registration data they need to run it. Results of tests and assignments in a seminar are evaluated only in anonymised form, only to improve the training, and never passed on.

6 Who receives your data

Only the providers named in this policy receive personal data from me, each only what its task needs:

Hanko GmbH, Germany – login (processor)
Anthropic PBC, USA – AI review of submissions (processor)
Paddle.com Market Ltd, United Kingdom – sale and payment of paid plans (controller in its own right)
Infomaniak Network SA, Switzerland – my mailbox, and delivery of Archilab's service emails (processor)
Plausible Insights OÜ, Estonia – usage statistics for mbohlen.de (processor)
Amazon Web Services EMEA SARL, Luxembourg, with processing in the USA – delivery of the newsletter (processor)
External trainers and venues – running an open seminar you booked (controllers in their own right)

Every processor works only on my instructions under a data processing agreement (Art. 28 GDPR). Mautic, Gitea, the database and the web servers are my own and give nobody else access. I do not sell or rent personal data. I disclose it to authorities only where the law obliges me to.

7 Transfers outside the EU

Two of the recipients process data in the USA: Anthropic (the content of a submission you ask to have reviewed) and Amazon SES (name, email address and the newsletter itself). Both transfers are safeguarded by the EU-US Data Privacy Framework, under which the European Commission found the protection in the USA adequate for certified companies (Art. 45 GDPR), and additionally by the European Commission's Standard Contractual Clauses (Art. 46(2)(c) GDPR). While data is in the USA, US authorities may be able to access it. I chose these providers deliberately and keep what reaches them to a minimum.

The United Kingdom, where Paddle is based, and Switzerland, where Infomaniak is based, both have an adequacy decision of the European Commission (Art. 45 GDPR).

8 How long data is kept

I keep personal data only as long as I need it for the purpose I collected it for, or as long as the law obliges me to keep it. After that I delete it. Data that is still held in a backup is kept apart from any further processing and is deleted when the backup is overwritten.

Server logs: one year.
The lang cookie: one year, or until you delete it in your browser.
Usage statistics: Plausible keeps only totals, which contain no personal data.
Page views linked to your newsletter contact: the identifier on your device is kept for one year; the page views linked to your contact are deleted together with the contact.
Your Archilab account: your account data, enrollments, progress, submissions, the feedback you received and your Git repositories are kept as long as your account exists. When you have your account deleted, I delete them, and your contact is removed from the newsletter system as well.
AI reviews: Anthropic receives the content of a submission only to write the review and deletes it within 30 days. If its automated safety systems flag a request as violating its usage policy, it may keep it for up to two years. The review itself is part of your Archilab data.
Purchases: what I receive from Paddle about your plan is kept as long as your account exists. Paddle keeps your payment and billing data under its own privacy policy.
The newsletter: your contact is kept as long as you receive the newsletter or have an Archilab account. Your newsletter preference, including an objection, is kept as long as your account exists. That is deliberate: an objection has to outlive the campaign that triggered it, or I would write to you again. If you object and have no account, I keep only your email address and the objection, so that I can honour it.
Emails and calls: as long as it takes to answer you. If your message concerns a contract or a booking, I keep it as long as tax and commercial law require.
Open seminars: your registration data is kept until the seminar has been held and paid for. The invoice is kept as long as tax law requires, currently eight years (§ 147 of the German Fiscal Code, AO).

9 Your rights

You have the right

to know which data about you I process, and to get a copy (Art. 15 GDPR),
to have wrong data corrected (Art. 16 GDPR),
to have your data deleted (Art. 17 GDPR), unless I have to keep it by law,
to have its processing restricted (Art. 18 GDPR),
to receive the data you gave me in a common machine-readable format (Art. 20 GDPR),
to withdraw any consent at any time, with effect for the future (Art. 7(3) GDPR).

Right to object (Art. 21 GDPR). Where I process your data on the basis of my legitimate interest (Art. 6(1)(f) GDPR), you can object at any time on grounds relating to your particular situation; I then stop unless I have compelling legitimate grounds. You can object to the newsletter at any time, without giving a reason, and I then send you no more newsletters.

To exercise any of these rights, write to me at the address in section 1. It costs you nothing.

You also have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR), for example the one where you live, or the one responsible for me: Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen, Kavalleriestraße 2–4, 40213 Düsseldorf, Germany, ldi.nrw.de.

10 Do you have to provide data?

You don't have to provide any data to read the website. To use Archilab you need an account with an email address, and to book a seminar I need your registration data; without them I cannot provide the service. Everything else is voluntary.