Privacy / Datenschutz

Controller

Dr. Thomas Prüm
An der Welle 3
60322 Frankfurt am Main
Germany
admin@cre-structured-credit.com

No data protection officer has been appointed; the statutory thresholds of § 38 BDSG are not met.

The short version

This site and the app are a personal collection of notes. There are no user accounts, no registration, no newsletter, no cookies, no analytics, no tracking pixels, no advertising and no third-party content loaded from other servers. Fonts are served from this server rather than from a font provider. What remains is what any web server records in order to deliver a page, and — in the app — a copy of the content held locally on your own device.

Website

Server log files. Each time a page is retrieved, the hosting provider's web server records the retrieving IP address, the date and time of the request, the resource requested, the HTTP status code, the volume of data transferred, the referring URL where one is transmitted, and the browser and operating system identification. This is technically necessary in order to deliver the page and to maintain the security and stability of the server.

Legal basis: Article 6(1)(f) GDPR. The legitimate interest lies in the operation, security and troubleshooting of the site. The data are not merged with other sources and are not used to identify individual visitors.

Hosting. The site is hosted by IONOS SE, Elgendorfer Str. 57, 56410 Montabaur, Germany (Amtsgericht Montabaur, HRB 24498). IONOS processes the data described above on the controller’s behalf on the basis of a data processing agreement pursuant to Article 28 GDPR. The servers are located in the European Union.

In the log files that IONOS makes available to the controller, IP addresses are shortened; they are retained for a maximum of eight weeks and are then deleted. Any further processing of connection data by IONOS for the security and operation of its own infrastructure takes place on IONOS’s own responsibility and is described in its privacy information.

Fonts. The typeface used for headings and for the wordmark is delivered from this server. No connection to Google Fonts or to any other external font service is established, and no IP address is transmitted to a third party for that purpose.

Cookies and local storage. The site sets no cookies and writes nothing to local or session storage. A web app manifest is provided so that the site can be added to a home screen; this involves no processing of personal data.

Outbound links. Pages link to legislative sources, regulators and third-party publications. Following such a link takes you to a site whose operator alone is responsible for its data processing.

The CRE SCR app

What the app retrieves. On launch, and periodically in the background, the app downloads two files from this server — content.json and updates.json. These are the same notes that appear on the website. The request reaches the web server described above and is recorded in its log files in the same way as a page retrieval, including the IP address of the device.

What stays on the device. The downloaded content is stored in the app's cache directory so that the notes remain readable offline, together with the version identifier of the content last seen. Both are removed when the app is deleted. Neither is transmitted anywhere.

What the app does not do. It has no accounts and no login. It contains no analytics, no crash reporting and no advertising framework. It requests no access to contacts, location, camera, microphone, photos or calendar. It creates no user profile and takes no automated decisions. In Apple's App Privacy terminology the app is declared as Data Not Collected.

Notifications. If you permit notifications, the app compares the version identifier of the published content with the one last seen and posts a local notification when it has changed. This happens entirely on the device. There is no push server, no device token is generated or transmitted, and no third party is involved. Permission can be withdrawn at any time in the iOS settings.

App Store. Downloading and updating the app takes place through Apple's App Store. Apple processes the data associated with that on its own responsibility; the controller receives only aggregated, anonymous statistics and no information identifying individual users. See Apple's privacy policy for details.

Contact by email

If you write to the address given above, your message and the data it contains — your email address, and whatever you choose to include — are processed in order to deal with your enquiry. Legal basis: Article 6(1)(f) GDPR, and Article 6(1)(b) GDPR where the enquiry is directed at entering into a contract. Messages are deleted once the matter is concluded and no retention obligation applies. Professional confidentiality obligations under the Bundesrechtsanwaltsordnung remain unaffected.

Ordinary email is not an encrypted medium. Please do not send confidential material without prior agreement on a suitable channel.

Your rights

You have the right to obtain information about the personal data concerning you (Article 15 GDPR), to have inaccurate data rectified (Article 16), to have data erased (Article 17), to obtain restriction of processing (Article 18), to data portability (Article 20) and to object to processing based on Article 6(1)(f) GDPR (Article 21). To exercise any of these, write to the address above.

You also have the right to lodge a complaint with a supervisory authority (Article 77 GDPR). The competent authority for the controller is Der Hessische Beauftragte für Datenschutz und Informationsfreiheit, Postfach 3163, 65021 Wiesbaden.

There is no statutory or contractual obligation to provide personal data. Neither the website nor the app takes automated decisions within the meaning of Article 22 GDPR, and neither profiles its users.

Changes

This notice will be amended where the site or the app changes in a way that affects the processing described. The version in force is the one published here.

Last reviewed: 13 September 2026. See also Imprint and Disclaimer.