Privacy policy

A. Visiting this website

Controller

The controller within the meaning of Art. 4(7) GDPR is Moritz Dietel und Moritz Haß GbR, represented by its partners Moritz Dietel and Moritz Haß, Am Waldrand 29, 24113 Kiel, Germany. Email: [email protected]. Full details in the imprint.

Hosting and server logs

Host and server location: Railway Corporation, 548 Market St PMB 68956, San Francisco, CA 94104, USA; server location: Amsterdam, Netherlands. The host processes the data on our behalf (Art. 28 GDPR).

Whenever a page is requested, the server processes the data your browser sends with the request: IP address, date and time, the page requested, the page you came from (referrer), browser type and version, and operating system. Without this data the website cannot be delivered.

The purpose is to deliver the website and keep it secure and stable, for example by fending off attacks. The legal basis is Art. 6(1)(f) GDPR; our legitimate interest is a working and secure website. The logs are deleted after at most 90 days.

Cookies and storage on your device

This website sets no cookies. It stores no information on your device, including in local or session storage, and reads none from it. Consent under § 25 TDDDG is therefore not required, and there is no cookie banner.

Fonts, external content and analytics

We serve the fonts from our own server; there is no connection to Google Fonts or any other font provider. We embed no maps, videos, social media content or third-party scripts. We use no analytics or tracking services and send no newsletter.

Contact by email and the forms

If you email us, use the form on the Book a demo page or the form on the Contact page, we process the details you give us. In the demo form these are your name, email address and university (required), and, if you wish, the course, the number of students and your message. In the contact form they are your name, email address and message (all required).

The purpose is to deal with your request, arrange a call and, where it follows, prepare an offer. The legal basis is Art. 6(1)(b) GDPR where your request is aimed at a contract, and otherwise Art. 6(1)(f) GDPR; our legitimate interest is answering requests.

Your details are voluntary. Without the required details we cannot deal with a request sent through a form. The forms store nothing on this website: they send your details to us as an email, through the delivery service Resend (see below).

Processors

These service providers process data on our behalf and on our instructions (Art. 28 GDPR):

• Hosting of the website and server logs: Railway Corporation, 548 Market St PMB 68956, San Francisco, CA 94104, USA; server location: Amsterdam, Netherlands
• Delivery of the emails from the forms: Plus Five Five, Inc. (Resend), 2261 Market Street #5039, San Francisco, CA 94114, USA

Transfers to third countries

Resend processes data in the USA. The transfer is based on the European Commission’s adequacy decision for the EU-U.S. Data Privacy Framework (Art. 45 GDPR), under which Resend is certified, and additionally on the EU Standard Contractual Clauses (Art. 46(2)(c) GDPR).

Railway’s servers are in the EU. Railway is based in the USA, however, so access from there cannot be ruled out. The EU Standard Contractual Clauses (Art. 46(2)(c) GDPR) apply to it.

Retention

• Server logs: deleted after at most 90 days.
• Requests: deleted once the request has been dealt with. If it leads to a contract, we keep the correspondence for as long as statutory retention duties, in particular under tax law, require (up to ten years).

Your rights

You have the right to:

• Access to the data we hold about you (Art. 15 GDPR)
• Correction of inaccurate data (Art. 16 GDPR)
• Erasure (Art. 17 GDPR)
• Restriction of processing (Art. 18 GDPR)
• Notification of a correction, erasure or restriction to recipients (Art. 19 GDPR)
• Data portability (Art. 20 GDPR)
• Objection to processing (Art. 21 GDPR, see below)

An email to [email protected] is enough. There is no automated decision-making, including profiling (Art. 22 GDPR).

Right to lodge a complaint

You may lodge a complaint with a data protection supervisory authority (Art. 77 GDPR). The authority responsible for us is the Unabhängiges Landeszentrum für Datenschutz Schleswig-Holstein (ULD), Holstenstraße 98, 24103 Kiel, www.datenschutzzentrum.de.

B. Using MMTrader on behalf of a university

When a university uses MMTrader in a course, we process the participating students’ data on its behalf. The university is then the controller under the GDPR. We are its processor under Art. 28 GDPR and process the data only on its instructions, under a data processing agreement with it.

This includes the university email address students join a session with, an optional display name, and their orders, trades, positions and results in the simulation. So that students can return to their seat after losing their connection, the simulation stores a technically necessary identifier in their browser (§ 25(2) no. 2 TDDDG). This applies only to the simulation, not to this website.

The university decides which data is processed, for which purposes and for how long. Students receive the information under Art. 13 GDPR for this processing from their university, and direct requests about their rights there. If such a request reaches us, we pass it on to the university and help it respond. Technical details for IT departments are on the Security and data page.