Draft. Factually accurate, not yet reviewed by a lawyer.
The operator details are still incomplete (name, street, postalCode, city, email, editoriallyResponsible). They live in src/lib/legal/operator.ts and must be filled in before this goes live.
Privacy notice
Controller
Without an account
The public pages work without signing in and without an account. No cookies beyond the technically necessary ones are set, and no analytics run. The server logs each request with the IP address, the time, the address requested and the browser identification.
With an account
- Sign-in and accounts run through Clerk, which holds the email address, credentials and session information.
- Our own database holds exactly one row per user: the arrangement of the workspace, stored under the Clerk identifier. No history, no behavioural tracking, no trading data.
- Session cookies are strictly necessary so that a sign-in persists. No consent under section 25 TDDDG is required for those, and we set no others.
Legal bases
Account and workspace: Article 6(1)(b) GDPR, performance of the contract. Server logs and abuse prevention: Article 6(1)(f) GDPR, legitimate interest in secure operation.
Recipients
- Clerk Inc., United States, for accounts and sign-in. The transfer relies on the European Commission’s adequacy decision for the EU-US Data Privacy Framework.
- Railway Corp. as the hosting provider. The application and database run in Amsterdam, Netherlands.
- GitHub Inc. receives technical fault reports from our watchdog. These contain job names and error text, never user data.
Retention
Account data and the workspace remain until the account is deleted. Deleting the account also removes the stored workspace. Server logs are kept only briefly, for operation and security.
Data from official publications
Paddock processes information about elected officials that the law requires them to publish themselves. The basis is Article 6(1)(f) GDPR together with the media privilege in Article 85 GDPR: reporting on official asset and trade disclosures is the purpose of this service. We show only what the publishing authority itself published, and link every entry to the original document.
Your rights
You have the right to access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction (Art. 18), data portability (Art. 20) and objection (Art. 21 GDPR). An informal message to the address above is enough. You may also lodge a complaint with a data protection supervisory authority (Art. 77 GDPR).