imprint.
Provider
Daniel Bonerz
Ringgartenstr. 65
64625 Bensheim
Germany
Contact
E-mail: hello@uptrait.me
Responsible for content per § 18 (2) MStV
Daniel Bonerz, Ringgartenstr. 65, 64625 Bensheim, Germany
Dispute resolution
We are neither willing nor obliged to participate in dispute resolution proceedings before a consumer arbitration board (§ 36 VSBG).
Liability for content and links
As a service provider we are responsible for our own content on these pages under general law (§ 7 (1) DDG). We are not obliged to monitor transmitted or stored third-party information or to investigate circumstances indicating illegal activity (§§ 8–10 DDG). Our site contains links to external websites over whose content we have no control; the respective provider is responsible for the content of linked pages. No unlawful content was identifiable at the time of linking.
privacy.
1. Controller
Daniel Bonerz, Ringgartenstr. 65, 64625 Bensheim, Germany · hello@uptrait.me
A data protection officer has not been appointed, as the statutory conditions requiring one are not met.
2. Hosting and server log files
This website is hosted by IONOS SE, Elgendorfer Str. 57, 56410 Montabaur, Germany. When you visit the site, the hosting provider automatically collects server log files: IP address, date and time of access, requested resource, referrer URL, browser type and operating system. This processing is based on our legitimate interest in the secure and stable provision of the website (Art. 6 (1) (f) GDPR). IONOS keeps this log data for a maximum of eight weeks and records visitors' IP addresses in the log files in anonymised form; the log files are deleted thereafter. A data processing agreement per Art. 28 GDPR has been concluded with IONOS.
3. Contact form and e-mail
If you use the contact form, we process the reason for your enquiry, your name, your organisation, your e-mail address and — if you provide one — your message. Your IP address is processed in addition, to limit automated submissions. The legal basis is Art. 6 (1) (b) GDPR where the enquiry relates to a contract or to steps taken prior to entering into one, otherwise our legitimate interest in answering enquiries and protecting the form against abuse (Art. 6 (1) (f) GDPR).
Enquiries are stored in the website's database and are also sent by e-mail to us and to one further person within our team who handles enquiries. We delete an enquiry once it has been dealt with and there is no further need to retain it, unless statutory retention obligations apply. IP addresses recorded for abuse prevention are deleted after one hour.
If you write to us by e-mail directly, we process the data contained in your message on the same basis and for the same purpose.
4. E-mail dispatch
E-mails sent by this website — notifications, access credentials and replies triggered by the contact form — are not dispatched by the web host itself but handed over to an external mail relay: Brevo GmbH, Köpenicker Str. 126, 10179 Berlin, Germany. For this purpose the recipient address, the sender address, the subject and the content of the respective message are transmitted to Brevo. Brevo additionally records dispatch metadata for delivery logging, in particular IP address, date and time of dispatch and recipient.
Brevo processes this data solely on our behalf and on our instructions. A data processing agreement per Art. 28 GDPR is in place; it forms part of Brevo's terms of use, which we accepted on registering. Brevo's mail infrastructure is hosted within the European Union (France, Germany and Belgium). Brevo does, however, use affiliated companies and service providers outside the European Union for support, maintenance and content delivery — in particular in the United States, Canada and India. Those transfers are covered by standard contractual clauses per Art. 46 (2) (c) GDPR and, where applicable, by an adequacy decision of the European Commission. The current list of sub-processors is published by Brevo as part of its terms of use.
The legal basis is our legitimate interest in reliable delivery (Art. 6 (1) (f) GDPR), and Art. 6 (1) (b) GDPR where the dispatch serves a contractual relationship.
5. Investor access
Access to the investor area is not open to registration. We grant it individually in response to an enquiry. When we do, we create a personal access record containing your name, your organisation and your e-mail address, together with a cryptographic hash of your access link and of your password — neither the link nor the password is stored in plain text. You receive both by e-mail; the access expires after 60 days and can be withdrawn by us at any time.
While the access is in use we record the time of first and most recent use, the number of times the material was opened, and the IP address at first use. Failed password attempts are counted, together with the IP address, for one hour, in order to block repeated guessing. The material itself displays your name and organisation as a visible watermark, so that any copy remains attributable.
The legal basis is Art. 6 (1) (b) GDPR for establishing and administering the access, and Art. 6 (1) (f) GDPR for the access log and the abuse prevention, based on our legitimate interest in protecting confidential material. Access records are deleted when the access relationship ends, unless statutory retention obligations apply.
6. Cookies
The public pages of this website set no cookies and use no analytics or tracking.
The investor area sets two cookies that are strictly necessary for it to work. Both are limited to the path of the investor area, are not readable by scripts and are not used for any form of analysis:
ug_t — records which access is being used, so that the access link disappears from the address bar after the first visit. It holds a cryptographic hash of the link, not the link itself. Lifetime: 24 hours.
ug_s — proves that the password has been entered. It holds that same hash, an expiry time and a signature, so that it cannot be forged. Lifetime: 8 hours.
Both cookies are deleted when you sign out. Because they are strictly necessary for a service you have explicitly requested, they require no consent (§ 25 (2) no. 2 TDDDG).
7. Your rights
- Access to your personal data (Art. 15 GDPR)
- Rectification (Art. 16 GDPR) and erasure (Art. 17 GDPR)
- Restriction of processing (Art. 18 GDPR)
- Data portability (Art. 20 GDPR)
- Objection to processing based on Art. 6 (1) (e) or (f) GDPR (Art. 21 GDPR)
- Withdrawal of consent at any time with effect for the future (Art. 7 (3) GDPR)
You also have the right to lodge a complaint with a supervisory authority (Art. 77 GDPR). The authority responsible for us: Der Hessische Beauftragte für Datenschutz und Informationsfreiheit, Gustav-Stresemann-Ring 1, 65189 Wiesbaden, Germany.
8. Security
This website uses TLS encryption. Personal data is transmitted encrypted; we apply technical and organisational measures per Art. 32 GDPR to protect it against loss, misuse and unauthorised access.
9. Changes
We update this privacy policy whenever the processing on this website changes. Version: September 2026.