Privacy Policy

Controller (Art. 13 para. 1 lit. a GDPR)

The controller within the meaning of the GDPR is: Kester von Gerlach, reachable at kester (at) von-gerlach (punkt) com. This website is a private, non-commercial family website and is not operated commercially.

Data Collected and Purpose of Processing

We collect and process only the data necessary for operating the family website: email address and name upon registration, as well as optional profile information (photo, biography). Data is not shared with third parties and is not used for commercial purposes.

Legal Basis for Processing (Art. 6 GDPR)

The processing of your data is based on Art. 6 para. 1 lit. b GDPR (performance of a contract or pre-contractual measures) for account management and access to the members area, and on Art. 6 para. 1 lit. f GDPR (legitimate interests) for the operation and security of the website.

Hosting and Data Processing Agreement

This website is hosted by Vercel Inc. (340 Pine Street, Suite 701, San Francisco, CA 94104, USA). The database and authentication run on Supabase (Supabase Inc., San Francisco, USA). Both providers process data under a data processing agreement pursuant to Art. 28 GDPR and offer standard contractual clauses for transfers to the USA.

Contact by email

The “Traces” page no longer carries a contact form. Anyone who wishes to write to us does so directly at kester (at) von-gerlach (punkt) com. The message then travels through your own email provider into our mailbox; this website collects, stores and passes on no data of yours in the process. What you write to us we process solely in order to answer your enquiry; the legal basis is Art. 6 para. 1 lit. f GDPR (legitimate interest in answering enquiries). We delete the message once your matter has been fully dealt with, at the latest after 24 months.

Your Rights as a Data Subject

Under the GDPR, you have the following rights. To exercise them, please contact kester (at) von-gerlach (punkt) com:

• Art. 15Right of access – You may request information about the personal data stored about you at any time (Art. 15 GDPR).
• Art. 16Right to rectification – You may request the correction of inaccurate or incomplete data (Art. 16 GDPR).
• Art. 17Right to erasure – Under certain conditions, you may request the deletion of your data (Art. 17 GDPR).
• Art. 18Right to restriction of processing – You may request restriction of processing where certain conditions apply (Art. 18 GDPR).
• Art. 20Right to data portability – You have the right to receive your data in a structured, commonly used, machine-readable format and to transfer it to another controller (Art. 20 GDPR).
• Art. 21Right to object – You may object at any time (Art. 21 GDPR) to the processing of your data that is based on a legitimate interest (Art. 6 para. 1 lit. f GDPR).
• Art. 77Right to lodge a complaint – You have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR). The competent authority can be found at: https://www.bfdi.bund.de

For all enquiries regarding your rights: kester (at) von-gerlach (punkt) com – We respond within 30 days.

Cookies and Session Management

This website uses cookies that are technically necessary for signing in, for remembering the language and for two-factor confirmation. No advertising or marketing cookies are used, and no data is sold on. In addition, a cookieless analytics measurement runs (see the Analytics section). Technically necessary cookies are exempt from the consent requirement under § 25 para. 2 TDDDG.

Legal basis: Art. 6 para. 1 lit. b GDPR (performance of a contract) in conjunction with § 25 para. 2 no. 2 TDDDG. The four cookies are technically required for signing in, remembering the language and two-factor confirmation. As of: September 2026.

Local storage in the browser

Two items live in the browser’s local storage rather than in cookies, and are never transmitted to the server: the fact that the notice at the top was dismissed, and your personal shortlist in the family tree.

Analytics

Vercel Web Analytics and Speed Insights record page views and load times. Both work without cookies and without cross-device recognition, but process IP address and browser identification for aggregation. The evaluation is anonymous; individual people cannot be identified from it. The legal basis is the legitimate interest in a functioning, comprehensibly designed offering (Art. 6(1)(f) GDPR).

Members’ area

Behind the login lies a closed area for members of the family. Processed there are: the entries of one’s own profile (name, preferred name, occupation, profile picture), on request telephone number and address, submitted and approved events, comments on announcements, votes on proposed dates for the family gathering, and a login history recording the time, IP address and browser identification of the last twenty sign-ins. The legal basis is Art. 6(1)(b) GDPR for operating the access and Art. 6(1)(a) GDPR for voluntary entries – notably the listing in the family directory. None of it is publicly visible; the exclusion from search engines covers the whole area.

The family directory lists only those who expressly choose to be listed. Whoever consents appears with name, picture, email address, occupation, telephone number and address, visible to the other signed-in members, and every member can take those entries away as a vCard file. The events of the family calendar can likewise be downloaded as an ICS file; they carry the recorded location, which may be a private address. Name and profile picture also appear in the “family association” tab without this consent. The consent can be withdrawn at any time in one’s own profile; the entry then disappears from the list at once. Files already downloaded are, in the nature of things, beyond the reach of a withdrawal.

Emails go out from the members’ area: the invitation to register, the notice that a submitted event has been approved or declined, the answer to a request to link one’s account to a person in the family tree, and two circulars about the family gathering – the reminder of an open vote and the announcement of the date decided. They are sent through Resend (Resend Inc., 2261 Market Street, San Francisco, CA 94114, USA) as a processor; transmitted are the recipient’s address, the form of address and the content of the message. Anyone who does not wish to receive the two circulars may say so at <mail></mail>.

A member’s entries remain as long as the account exists. The account can be deleted by the member under “data protection” in the profile; profile, contact details, profile picture and the factors of two-factor authentication disappear with it. An entry with the email address remains in the administration’s audit log so that it stays traceable that and when a deletion took place. Persons and pictures of the family tree remain – they belong to the family, not to the individual account. The same page hands out a complete report under Art. 15 GDPR as a file at the press of a button.

Maps

On the pages that show a map (Estates, and the map in the members area) the map tiles are loaded directly from the servers of the OpenStreetMap Foundation. In doing so your browser transmits your IP address and browser identification to OpenStreetMap; a map cannot be displayed without this. The legal basis is our legitimate interest in illustrating these places (Art. 6 para. 1 lit. f GDPR). The map only loads when you open a page that contains one – on all other pages no connection to OpenStreetMap is made. The OpenStreetMap Foundation privacy policy: osmfoundation.org/wiki/Privacy_Policy