Privacy Policy

The controller responsible for the processing of personal data on this website within the meaning of the General Data Protection Regulation (GDPR) is:

This website is hosted by Vercel Inc., 440 N Barranca Avenue #4133, Covina, CA 91723, USA. On every visit, Vercel processes the data your browser transmits, in particular IP address, date and time, the page requested and browser identification (user agent) (server log files). This is technically necessary to deliver the website and operate it securely.

Legal basis: Art. 6(1)(f) GDPR (legitimate interest in providing the website securely and reliably).

Vercel processes this data as a processor under its Data Processing Addendum, which applies to customers on the Pro and Enterprise plans; this website runs on the Pro plan. For the transfer to the USA, Vercel states that it participates in the EU-U.S. Data Privacy Framework; the agreement also contains the European Commission’s Standard Contractual Clauses (Decision 2021/914). Insofar as Vercel processes usage data and metadata from operating its services for its own purposes, such as log data including the location derived from the IP address, Vercel states that it is itself a controller; Vercel’s privacy policy (vercel.com/legal/privacy-policy) applies to this.

Retention: We do not store this data ourselves. In the runtime logs (records of function invocations) we can view at Vercel, it remains visible for one day on the Pro plan. How long Vercel keeps data for its own purposes is determined by Vercel; Vercel does not state a fixed period.

This website sets no cookies. If you open the start address without a language code, the website chooses the language version based on the language setting your browser sends.

If you choose a light or dark design with the switch, your browser stores this choice in local storage (entry “theme”). The entry remains until you delete it in your browser. On every page view, the page checks in your browser whether such an entry exists; it is not transmitted to us.

We count clicks on our buy links without cookies and without any information about you (section 6).

Legal basis: the entry serves only to show you the display you have chosen (Section 25(2) no. 2 TDDDG); insofar as personal data is processed, Art. 6(1)(f) GDPR.

If you write to us by email or using the contact form, we process the information in your message, in particular your email address, name (optional in the form), content and, for the form, the language of the page from which you submitted it, in order to answer your enquiry. The form passes your details via our hosting provider Vercel to Microsoft 365, which delivers them as an email to our mailbox. The website does not store the message and does not write its content to its logs.

Our mailbox is operated with Microsoft 365 (Exchange Online).

Legal basis: Art. 6(1)(f) GDPR (legitimate interest in answering enquiries); if your enquiry relates to concluding or performing a contract with us, Art. 6(1)(b) GDPR.

Retention: We delete your message as soon as it is no longer needed for handling your enquiry, at the latest after three years, unless statutory retention obligations apply.

If you subscribe to the newsletter, we process your email address and the language of the page on which you subscribe (it determines whether you receive the German, English or Spanish list) in order to send you release announcements. Providing your email address is voluntary; without it we cannot send you release announcements. Subscription uses double opt-in: you first receive a confirmation email and are only added to the list after clicking the confirmation link.

Legal basis: your consent, Art. 6(1)(a) GDPR. You can withdraw it at any time with effect for the future (Art. 7(3) GDPR), using the unsubscribe link in every newsletter or by writing to hello@geiststudies.com.

The form passes your email address and the language of the page via our hosting provider Vercel (section 2) to Brevo; the website does not store them and does not write them to its logs. We use Brevo GmbH, Köpenicker Straße 126, 10179 Berlin, Germany, as a processor for subscription, the mailing list and delivery, under its data processing agreement. According to Brevo, the data is hosted with OVH in France and Germany and with Google Cloud in Belgium. Some sub-processors are also located outside the EU, according to Brevo's list in the USA (including Cloudflare for network services, Zendesk for customer support, and Brevo Inc.) and in India (Brevo CRM Solutions Limited, customer support and maintenance). For the USA, Brevo cites the EU-US Data Privacy Framework and Standard Contractual Clauses, for India Standard Contractual Clauses, and for Zendesk additionally Binding Corporate Rules (BCR). The list is in Annex 2 of Brevo's data processing agreement (brevo.com/legal/termsofuse). Insofar as Brevo processes data for its own purposes, such as statistics on the use of its services, Brevo states that it is itself a controller; Brevo's privacy policy (brevo.com/legal/privacypolicy) applies to this.

Brevo records for our emails, including the confirmation email, whether they are opened and which links are clicked. For this purpose, every email contains an invisible image that your email program loads from a Brevo server when you open the email, and links first lead via a Brevo server; Brevo receives the IP address of the requesting device in the process. If your email program does not load images automatically, Brevo generally does not record the opening; clicks on links still go via Brevo. We have switched on Brevo's anonymous tracking. For newsletters, according to Brevo, opens and clicks are then not linked to your contact, and information that could identify you, such as your email address and IP address, is anonymised. For the confirmation email, Brevo still shows opens and clicks on your contact even with anonymous tracking, with the time but without the IP address and without the clicked link. We only evaluate aggregate figures. We use them to see whether our emails arrive and are read and which links are clicked. Links to our books additionally go via our own redirect (section 6). The legal basis is again your consent (Art. 6(1)(a) GDPR).

Retention: your address remains on the list until you unsubscribe. After that, we keep it marked as unsubscribed at Brevo so that you receive no further newsletters; on request we delete it completely.

Links to our books that carry a source tag, for example from a YouTube video, the newsletter or a book, go through a redirect on this website (addresses starting with /go/) or to a book page whose buy buttons then use this redirect. Without a source tag, the buy buttons link to Amazon directly; we do not count those clicks.

For each redirect, we count how often a link is clicked per month, broken down by book, Amazon marketplace, format and source. This shows us which mentions of our books lead to clicks on the buy links. The counters are kept by the database service Upstash and have no expiry date. For each click, the website also writes a log line with book, marketplace, format, source, target and time to the runtime logs at Vercel (section 2). Neither the counters nor the log line contain your IP address or any other information about you; the request itself is covered by section 2.

Once a volume is available on Amazon, the redirect leads to its product page on Amazon, where Amazon’s privacy notice applies. Until then, it leads to the book’s page on this website.

You have the right of access (Art. 15 GDPR), rectification (Art. 16 GDPR), erasure (Art. 17 GDPR), restriction of processing (Art. 18 GDPR) and data portability (Art. 20 GDPR). You can withdraw any consent you have given at any time with effect for the future (Art. 7(3) GDPR). To do so, write to hello@geiststudies.com.

Right to object: where we process your data on the basis of Art. 6(1)(f) GDPR, you may object to this processing at any time on grounds relating to your particular situation (Art. 21(1) GDPR). To do so, also write to hello@geiststudies.com.

You have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR), in particular in the Member State of your habitual residence, place of work or place of the alleged infringement. The authority responsible for our seat in Berlin is: