As of: October 2026

1. Controller

The controller responsible for data processing on this website within the meaning of the General Data Protection Regulation (GDPR) is:

Taglauer und Künnecke GbR
©r2studio
Werkstrasse 10
85614 Kirchseeon
Germany

Phone: +49 171 223 1854
Email: hallo@r2studio.de

ReachOS is a product of ©r2studio.

2. General information on data processing

We process personal data of our users only to the extent necessary to provide a functional website and our content and services. The processing of personal data generally takes place only with consent or on the basis of a statutory permission.

3. Legal bases

Where we obtain consent for processing operations, Art. 6(1)(a) GDPR is the legal basis. For processing necessary for the performance of a contract or to take steps prior to entering into a contract, it is Art. 6(1)(b) GDPR. Where processing is necessary for compliance with a legal obligation, Art. 6(1)(c) GDPR applies. Where processing is necessary for the purposes of our legitimate interests and the interests of the data subject do not override them, Art. 6(1)(f) GDPR is the legal basis.

4. Hosting via Webflow

This website is hosted by Webflow. The provider is Webflow, Inc., 398 11th Street, 2nd Floor, San Francisco, CA 94103, USA.

When you access our website, Webflow processes technically necessary data, in particular the IP address, date and time of access, the page accessed, browser type and version, the operating system used and the referrer URL. This processing is necessary to deliver the website and to ensure its security and stability.

The legal basis is Art. 6(1)(f) GDPR. Our legitimate interest lies in the secure and efficient provision of our online offering. We have concluded a data processing agreement with Webflow pursuant to Art. 28 GDPR.

Webflow may transfer data to the USA. The transfer is based on the European Commission's adequacy decision on the EU-US Data Privacy Framework, insofar as the provider is certified, and additionally on the European Commission's standard contractual clauses.

5. Content delivery network, security and DNS via Cloudflare

We use services of Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107, USA. We use Cloudflare as a content delivery network (CDN), for DNS, for protection against attacks and abuse, and to speed up delivery of the website.

Requests to our website are routed through Cloudflare's servers. In doing so, Cloudflare processes in particular the IP address, time and type of the request, browser and device information, and security features used to detect bots and attacks. A technically necessary cookie (e.g. "__cf_bm") may be set for bot detection.

The legal basis is Art. 6(1)(f) GDPR. Our legitimate interest lies in the security, stability and performance of our online offering. We have concluded a data processing agreement with Cloudflare.

The transfer to the USA is based on the adequacy decision on the EU-US Data Privacy Framework, insofar as the provider is certified, and additionally on the European Commission's standard contractual clauses.

6. Server log files

The hosting provider automatically collects and stores information in so-called server log files, which your browser transmits automatically. We do not merge this data with other data sources. The data is deleted after the retention periods set by the provider have expired [check retention period].

7. Cookies and similar technologies

Our website uses only technically necessary cookies and similar technologies that are required for the operation and security of the website. The legal basis is Section 25(2) no. 2 TDDDG and Art. 6(1)(f) GDPR.

Should we use non-essential cookies or tracking technologies in the future, this will only happen with your prior consent pursuant to Section 25(1) TDDDG and Art. 6(1)(a) GDPR. You can withdraw any consent given at any time with effect for the future.

8. Contact by email or phone

If you contact us by email or phone, we process your details (e.g. name, contact data, content of the inquiry) to handle your request and for possible follow-up questions. The legal basis is Art. 6(1)(b) GDPR if your inquiry relates to a contract or pre-contractual measures, otherwise Art. 6(1)(f) GDPR. We delete the data as soon as it is no longer necessary for the purpose and no statutory retention obligations apply.

9. Contact form [if applicable]

When you use a contact form, we process the data you enter (e.g. name, email address, message) to handle the inquiry. The form data is processed via Webflow. The legal basis is Art. 6(1)(b) or (f) GDPR. The data is deleted as soon as the inquiry has been finally handled and no retention obligations exist.

10. User accounts and use of the platform [if applicable]

[Add this section as soon as ReachOS offers registration, login, payment processing, newsletter, analytics or AI functions. Each of these requires: categories of data processed, purpose, legal basis, service providers used, retention period.]

11. Recipients of data

Recipients of personal data are our processors, in particular Webflow, Inc. (hosting) and Cloudflare, Inc. (CDN, DNS, security), as well as, where applicable, tax advisors, authorities and other service providers, insofar as this is necessary to perform a contract or due to legal obligations.

12. Transfers to third countries

Some of the service providers named are based in the USA. The transfer takes place on the basis of the European Commission's adequacy decision on the EU-US Data Privacy Framework, insofar as the respective provider is certified, and additionally on the basis of standard contractual clauses pursuant to Art. 46 GDPR. You can request a copy of the safeguards using the contact details above.

13. Retention period

We process and store personal data only for as long as necessary for the respective purpose or as required by statutory retention periods. After that, the data is deleted or blocked.

14. Your rights

You have the following rights against us:

• Access to your stored data (Art. 15 GDPR)
• Rectification of inaccurate data (Art. 16 GDPR)
• Erasure (Art. 17 GDPR)
• Restriction of processing (Art. 18 GDPR)
• Data portability (Art. 20 GDPR)
• Objection to processing (Art. 21 GDPR)
• Withdrawal of consent given, with effect for the future (Art. 7(3) GDPR)

To exercise your rights, a message to hallo@r2studio.de is sufficient.

15. Right to object

Where we process data on the basis of legitimate interests (Art. 6(1)(f) GDPR), you have the right to object to the processing at any time on grounds relating to your particular situation. We will then no longer process the data unless we can demonstrate compelling legitimate grounds that override your interests, or the processing serves the establishment, exercise or defence of legal claims.

16. Right to lodge a complaint with a supervisory authority

You have the right to lodge a complaint with a data protection supervisory authority. The authority responsible for us is:

Bavarian State Office for Data Protection Supervision (BayLDA)
Promenade 18
91522 Ansbach

17. Data security

For security reasons, this website uses SSL/TLS encryption. You can recognize an encrypted connection by "https://" in your browser's address bar.

18. Currency and amendment of this privacy policy

This privacy policy is currently valid and dated October 2026. Further development of our website or changes in statutory requirements may make an amendment necessary.