Privacy Policy
1. Controller
The controller responsible for processing personal data in connection with this website is:
Arseny Bobrov
HQ
Bornheimer Str. 127
53119 Bonn
Email: ab@bibertec.de
If you have any questions regarding privacy or the processing of your personal data, you can contact us using the details above.
2. General information
This privacy policy explains how personal data is processed when you visit the biberblog website or, where applicable, use its protected editor functionality.
Personal data means any information relating to an identified or identifiable natural person.
We process personal data only where this is necessary to provide and secure the website, fulfil contractual or legal obligations, or where another legal basis under the General Data Protection Regulation (“GDPR”) applies.
3. Website hosting
This website is hosted using services provided by:
Vercel Inc. 440 N Barranca Avenue #4133 Covina, CA 91723 United States
When you access this website, technical information required to deliver the website may be processed by Vercel. This may include, in particular, your IP address, information about your browser and device, the requested page or resource, the date and time of the request, technical request information and approximate location information derived from the IP address.
Vercel states that it processes information relating to traffic to customer websites, including end-user IP addresses, location information derived from IP addresses and system configuration information. (Vercel)
The processing is necessary for the secure, reliable and efficient delivery of the website, including protection against abuse and attacks and the diagnosis of technical problems. The legal basis is Article 6(1)(f) GDPR. Our legitimate interest is the secure and reliable operation of this website.
Where personal data is transferred to recipients outside the European Economic Area, appropriate safeguards are used where required. Vercel’s current Data Processing Addendum provides, among other mechanisms, for the use of the European Commission’s Standard Contractual Clauses for relevant transfers. (Vercel)
Data is retained only for as long as necessary for the respective technical, security or legal purpose. Retention may also depend on the configuration and services provided by Vercel.
4. Cookies and local device storage
For ordinary visitors, biberblog does not require marketing or advertising cookies.
A technically necessary session cookie is used when an authorised user logs into the biberblog editor. The cookie is used exclusively to authenticate the editor session and to protect editor functions such as publishing and image uploads.
The cookie is configured as an HttpOnly, Secure and SameSite cookie and uses a sliding expiration period of approximately one year. It does not contain the editor password.
The storage of this cookie is necessary to provide the editor functionality expressly requested by the authorised user. No consent is therefore required for this technically necessary storage under Section 25(2) TDDDG. (Gesetze im Internet)
5. Editor authentication
biberblog uses one editor password per website. There are no individual user accounts, user profiles or role management.
The editor password is not stored in plain text. It is hashed using Argon2id, and only the password hash is stored in the server environment. After successful authentication, the browser receives the signed session cookie described above.
Authentication data is processed for the purpose of restricting access to the editor and protecting the website against unauthorised changes. The legal basis is Article 6(1)(f) GDPR. Our legitimate interest is the security and integrity of the website and its content.
6. Image uploads in editor mode
Authorised editors may upload images through the biberblog editor.
During editing, uploaded original images are temporarily stored in a private Vercel Blob store. The image data is uploaded directly from the editor’s browser to Vercel Blob using a short-lived authorised upload URL.
Temporary uploads that are no longer required are deleted by the editor where possible and abandoned temporary uploads are automatically cleaned up. biberblog’s current implementation uses an approximate 24-hour lifetime for orphaned temporary uploads.
When an image is published, it is cropped and processed on the server, converted to WEBP and stored as part of the published website. The temporary source upload is deleted after a successful publication.
Editors should only upload images for which they have the necessary rights and, where images contain identifiable individuals or other personal data, an appropriate legal basis for publication.
7. Publishing through GitHub
biberblog stores published website content in the website’s Git repository rather than in a separate CMS database.
When an authorised editor publishes changes, the changed content and processed images are committed to the website’s GitHub repository and subsequently deployed through Vercel. A single publication may include changes across several pages.
Published website content may therefore also be retained in the Git version history. Where published content contains personal data, removing it from the current website version does not necessarily remove it immediately from historical Git commits.
Personal data should consequently only be placed in published website content where there is an appropriate legal basis for its publication.
8. External links
This website contains links to external websites, in particular GitHub.
When you follow an external link, you leave this website. The respective third-party provider is responsible for any personal data processed on its website. We have no control over the processing activities of external websites.
Simply displaying an external link on this website does not itself transmit data to the linked provider. A connection to the external provider is generally established only when you follow the link.
9. Analytics and advertising
This website does not use advertising trackers, behavioural profiling or marketing cookies.
If analytics or other tracking technologies are introduced in the future, this privacy policy will be updated before or when those technologies are used.
10. Legal bases
Depending on the processing activity, personal data may in particular be processed on the basis of:
Article 6(1)(b) GDPR where processing is necessary for a contract or pre-contractual measures; Article 6(1)(c) GDPR where processing is necessary to comply with a legal obligation; and Article 6(1)(f) GDPR where processing is necessary for our legitimate interests or those of a third party and those interests are not overridden by your interests, rights or freedoms.
Where consent is requested for a specific processing activity, the legal basis is Article 6(1)(a) GDPR. Consent may be withdrawn at any time with effect for the future.
11. Recipients of personal data
Depending on how you use the website, personal data may be processed by service providers involved in operating the website, in particular Vercel as the hosting and deployment provider.
For editor and publishing functionality, GitHub may additionally process published content and related repository data.
Service providers are used only to the extent required for the respective service and subject to the applicable data-protection requirements.
12. Your rights
Subject to the requirements of the GDPR, you may have the right to obtain information about personal data we process about you, request rectification of inaccurate data, request erasure of your data, request restriction of processing, object to processing based on legitimate interests, and receive data you have provided to us in a portable format where the statutory requirements for data portability are met.
You also have the right to withdraw consent at any time where processing is based on consent. Withdrawal does not affect the lawfulness of processing carried out before the withdrawal.
The relevant rights are set out in particular in Articles 15 to 21 GDPR. (EUR-Lex)
To exercise your rights, contact us using the contact details provided in Section 1.
13. Right to lodge a complaint
You have the right to lodge a complaint with a competent data protection supervisory authority if you believe that the processing of your personal data infringes applicable data protection law.
You may in particular contact the supervisory authority responsible for your habitual residence, your place of work, the place of the alleged infringement or the supervisory authority responsible for us.
14. Automated decision-making
We do not use personal data collected through this website for automated decision-making, including profiling, within the meaning of Article 22 GDPR.
15. Security
We take appropriate technical and organisational measures to protect personal data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure or access.
The website is delivered over encrypted HTTPS connections. Authentication credentials and other secrets used by biberblog are stored server-side and are not exposed to ordinary website visitors.
16. Changes to this privacy policy
We may update this privacy policy if the website, the services used to operate it or the applicable legal requirements change.
The current version is always available on this website.
Last updated: 6 October 2026