Privacy Policy

1. Controller

The controller responsible for data processing within the meaning of the EU General Data Protection Regulation (Datenschutz-Grundverordnung, DSGVO) is:

Fachhochschule Dresden – Private Fachhochschule GmbH
Güntzstraße 1, 01069 Dresden, Germany
Managing directors: Günter Kahle, Tom Kahle · Commercial register: Amtsgericht Dresden, HRB 26182
Project: HoloSpaceXR · Email: contact@holospacexr.com

For data protection matters concerning the university as a whole, you can also contact datenschutz@fh-dresden.eu.

2. What Data We Process

• Server log data: Every request to this website is logged by our hosting provider for operational and security purposes. This includes your IP address, date and time, the requested URL, the HTTP status, the referrer and your browser/user agent string.
• Contact form data: The name, email address and, optionally, the company you enter in our contact form.
• Account data: If you create an account: your email address, a display name you choose, a securely hashed password, your account role and the creation timestamp.
• Session and file data: Meeting sessions you create and, for team accounts, files you upload via the file manager (e.g. 3D models), together with the account they belong to.
• Language preference: The interface language you select, stored in your browser.

3. Purposes and Legal Bases

• Providing and displaying this website — Art. 6(1)(f) DSGVO (legitimate interest in presenting our research project).
• Server logs, IT security, abuse and error detection, stability — Art. 6(1)(f) DSGVO (legitimate interest in operating a secure and functional service).
• Processing your contact request and contacting you about our tester programme — Art. 6(1)(a) DSGVO (consent, given via the checkbox in the form).
• Account management, login, sessions and file manager — Art. 6(1)(b) DSGVO (performance of a contract / pre-contractual measures).
• Transactional emails such as contact confirmation, account confirmation and password reset — Art. 6(1)(a) and (b) DSGVO.

Providing your data is not legally required, but without it the contact form and the account area cannot be used. We do not carry out automated decision-making or profiling within the meaning of Art. 22 DSGVO.

4. Contact Form and Tester Programme

When you submit our contact form, the data you enter is transmitted over an encrypted connection to our own application server (api.holospacexr.com) and stored there so that we can get back to you about participation in the test phase. After submitting, you will receive a confirmation email at the address provided.

You can withdraw your consent at any time with effect for the future by sending an email to us; withdrawal does not affect the lawfulness of processing carried out before the withdrawal. We will then delete your inquiry.

5. User Account, Sessions and File Manager

Registration is optional and only required for the internal areas of the project. Authentication, password storage and password reset are handled by Supabase; we never see or store your password in plain text.

If your account has team permissions, you can create meeting sessions and upload files (e.g. 3D models) via the file manager. This content is stored on our application server together with the account that created it and is not publicly accessible.

6. Cookies and Local Storage

This website does not use advertising cookies, analytics or any third-party tracking technologies. We do not embed social media plugins, fonts loaded from external servers, or advertising networks.

We only use storage that is strictly necessary to provide the service you requested (Section 25(2) no. 2 TDDDG / ePrivacy exemption), which is why no cookie consent banner is shown:

• Authentication cookies (set by Supabase, names beginning with sb-): keep you logged in and protect your session. They are only set once you log in and are removed when you log out.
• locale: stores the interface language you selected, so the site opens in that language on your next visit. It is stored in your browser for up to 12 months and contains no identifier.

7. Hosting, Processors and Third-Party Services

We do not sell your data and we do not share it with third parties for their own purposes. We do, however, rely on the following service providers, who process data on our behalf under data processing agreements pursuant to Art. 28 DSGVO:

• Vercel Inc. (340 S Lemon Ave #4133, Walnut, CA 91789, USA) — hosting and delivery of this website and its serverless functions. For security and operational purposes, technical data such as IP addresses, request metadata and browser information is processed by Vercel. The server-side rendering of this website currently runs in a Vercel region outside the EU. Vercel is based in the USA; transfers are safeguarded by EU Standard Contractual Clauses and Vercel's certification under the EU–U.S. Data Privacy Framework. See the Vercel Privacy Policy.
• Cloudflare, Inc. (101 Townsend St., San Francisco, CA 94107, USA) — authoritative DNS for the domain holospacexr.com and, in addition, reverse proxy, content delivery and attack protection for our application server (api.holospacexr.com). Requests to the API are therefore routed via Cloudflare, which processes your IP address, connection metadata and the content of those requests. Transfers to the USA are safeguarded by EU Standard Contractual Clauses. See the Cloudflare Privacy Policy.
• Supabase Inc. (970 Toa Payoh North, Singapore / Supabase Pte. Ltd.) — authentication and account database. Our Supabase project is hosted in the EU (Frankfurt/Ireland region). See the Supabase Privacy Policy.
• STRATO GmbH (Otto-Ostrowski-Straße 7, 10249 Berlin, Germany) — the server that receives, processes and stores contact requests, sessions and uploaded files (api.holospacexr.com). Data is stored on servers located in Germany. See the STRATO Privacy Policy.
• NWDL mail server (server.nwdl.org) — sending confirmation and notification emails.

This website is built with Astro, an open-source framework. Astro runs on our own infrastructure and does not itself collect or transmit any data about you. Fonts, scripts and images are delivered exclusively from our own domain, so no request is made to third-party servers when you visit a page.

8. Retention Periods

• Contact form data: stored until your inquiry has been dealt with or you request deletion.
• Account data: stored for as long as your account exists; deleted after an account deletion request.
• Sessions and uploaded files: stored until you delete them or your account is deleted.
• Server log data: retained only as long as necessary for security and troubleshooting, and deleted or anonymised thereafter in accordance with our providers' retention policies.

Longer retention only occurs where we are legally required to keep specific data.

9. Your Rights

Under the DSGVO you have the right to:

• request access to the personal data we hold about you (Art. 15);
• request rectification of inaccurate data (Art. 16);
• request erasure of your data (Art. 17);
• request restriction of processing (Art. 18);
• receive your data in a portable format (data portability, Art. 20);
• object to processing based on legitimate interests (Art. 21);
• withdraw consent at any time with effect for the future (Art. 7(3)).

We provide this process for all users, irrespective of their region, and we do not charge any fees for fulfilling data deletion requests. On request we will promptly delete your contact data, your account and the content associated with it, unless we are strictly required by law to retain specific data. We will comply with deletion requests without undue delay and no later than 30 days, and will inform you once the deletion is complete.

To exercise your rights, please contact:

📧 contact@holospacexr.com

You also have the right to lodge a complaint with a data protection supervisory authority, in particular in the EU member state of your habitual residence, place of work, or the place of the alleged infringement (Art. 77 DSGVO). The authority responsible for us is the Saxon Commissioner for Data Protection and Transparency.

10. Data Security

All traffic to this website and to our API is encrypted via HTTPS/TLS. Passwords are never stored in plain text. Access to account and file data is protected by row-level security rules and short-lived signed URLs, and credentials for our backend API are only ever used server-side and never exposed to your browser.

11. Children

HoloSpaceXR is not directed at children under the age of 16. If you become aware that a child has provided us with personal data, please contact us and we will delete it.

12. Changes to This Policy

As HoloSpaceXR is an ongoing research and validation project, we may update this privacy policy to reflect changes to the service or to legal requirements. The current version always applies, and the date at the top of this page indicates when it was last revised.

13. Contact

If you have any questions, privacy concerns, or wish to formally request access to or deletion of your data, please contact us via:

📧 contact@holospacexr.com