WebCore FOUNDRY
Home / Legal Register
Chronological Compliance Schedule

Data lifecycle, client rights & security audits

This register documents how WebCoreFoundry — registered at Fohlenweide 83, 16767 Leegebruch, Germany — handles personal data across retention windows, processing stages, client requests, and periodic security reviews. Effective date: 1 September 2026. Last revised: 23 September 2026.

Controller contact: [email protected] · +49 151 92038471

Compliance Schedule Timeline

Ordered stages of the data handling lifecycle as applied to enquiries, contracts, and retained records.

  1. Stage 01 · Collection

    Inquiry intake

    Name, email, phone, company, and project notes provided through the Project Kickoff form or direct email to [email protected] are collected solely to respond to your request and prepare a proposal.

    Retention trigger: date of first message

  2. Stage 02 · Processing

    Proposal & contract handling

    While a proposal is open, contact details are processed under GDPR Art. 6(1)(b) (pre-contract measures). Signed statements of work, invoices, and accounting records are processed under Art. 6(1)(c) (legal obligation) under German commercial and tax law.

    Active window: inquiry through project closure + statutory duties

  3. Stage 03 · Retention

    Data retention windows

    • Unconverted inquiries: deleted or anonymized after 6 months of inactivity.
    • Contract & invoice records: retained 10 years (§147 AO, §257 HGB).
    • Project source code & docs owned by the client: transferred at handover; working copies removed after 90 days unless a retainer applies.
    • Server & application logs: rolling window of 30 days, then aggregated or purged.
    • Cookie consent choice: stored locally in your browser until cleared (see Cookie Policy).

  4. Stage 04 · Client Rights

    Requests you can file

    Under GDPR Chapters III–IV you may request access, rectification, erasure, restriction, portability, and objection to processing, and you may withdraw consent at any time without affecting prior lawful processing. Write to [email protected]; we respond within 30 days and may request identity verification. You may also lodge a complaint with your supervisory authority (competent authority for Brandenburg: Landesbeauftragte für den Datenschutz und für das Recht auf Akteneinsicht Brandenburg).

  5. Stage 05 · Security Audits

    Review cadence

    • Quarterly dependency and vulnerability scans across production repositories.
    • Semi-annual access-review of admin credentials and least-privilege roles.
    • Annual tabletop incident-response exercise and policy refresh.
    • Per release secret scanning, lint, and automated test gates in CI.
    • Personal data is hosted in the EU where feasible; any transfer relies on adequacy decisions or Standard Contractual Clauses.

Section A · Effective 1 September 2026

Privacy Policy (GDPR & CCPA)

Controller. WebCoreFoundry, Fohlenweide 83, 16767 Leegebruch, Germany, is the data controller for personal data described here. Contact: [email protected].

Categories of data. Contact identifiers (name, email, phone), professional details (company, role), correspondence content, technical logs (IP address, user agent, timestamps), and billing records required for contracts.

Purposes & legal bases. Responding to inquiries and delivering contracted engineering work (Art. 6(1)(b)); meeting tax and commercial record-keeping duties (Art. 6(1)(c)); securing the website and preventing abuse (Art. 6(1)(f) with balancing tests on file); optional analytics or marketing only with consent (Art. 6(1)(a)).

Recipients. Processed data may be shared with hosting and email providers acting as processors under written agreements, payment processors for invoices, and professional advisors or authorities where law requires. We do not sell personal information.

CCPA / CPRA notice. California residents may request disclosure, correction, or deletion of personal information and may opt out of any “sale” or “sharing” as defined by the CCPA — we do not sell or share personal information for cross-context behavioral advertising. Requests may be sent to [email protected] and will be honored without discrimination; authorized agents may submit requests with proof of authorization.

Retention. Follows the Chronological Compliance Schedule above. When a purpose ends and no legal duty requires further storage, data is deleted or irreversibly anonymized.

Security. TLS in transit, encryption at rest where supported, role-based access, least privilege, audit logging, and scheduled security audits (Stage 05). No method of transmission is risk-free; material breaches are handled under our incident procedure and notified to authorities within 72 hours when GDPR requires it.

Section B · Effective 1 September 2026

Terms of Service

Scope. These terms govern services provided by WebCoreFoundry, Fohlenweide 83, 16767 Leegebruch, Germany, including backend architecture work, RESTful API development, real-time web applications, audits, and retainers, unless a signed statement of work states otherwise. Conflicts resolve in favor of the signed statement of work.

Proposals & payment. Prices and timelines in proposals remain valid for 14 days. Milestone invoices are due within 14 days of issue unless agreed otherwise. Payment links provided on this site are processed by our payment provider; late amounts may accrue statutory default interest (§288 BGB) and collection costs.

Cooperation. Client will provide timely access to systems, credentials (via secure channels), and feedback. Delays caused by missing access or late approvals extend delivery dates day-for-day.

Intellectual property. Upon full payment, exclusive rights to client-specific deliverables transfer to the client. WebCoreFoundry retains rights to pre-existing tools, libraries, and generic know-how, which are licensed to the client as needed to use the deliverables.

Warranty & liability. Deliverables conform materially to the agreed specification for 30 days after acceptance; reported defects are fixed without charge if reproducible and within scope. For intent and gross negligence, and for injury to life, body, or health, liability is unlimited. For ordinary negligence, liability is limited to foreseeable, typically occurring damage, capped at the contract value — except where Product Liability Act duties apply. We are not liable for indirect losses or lost profits.

Confidentiality. Each party protects the other’s non-public information with at least reasonable care for three years after the engagement ends.

Termination. Either party may terminate for material breach with 14 days’ written cure period. Upon termination, work in progress is handed over against payment of fees earned to date.

Governing law. German law excluding the UN CISG. Place of jurisdiction is the competent court for Leegebruch/Berlin, without depriving consumers of mandatory forum rules. Consumer dispute resolution: we are neither obliged nor willing to participate in consumer arbitration proceedings.

Section C · Effective 1 September 2026

Cookie Policy

Essential storage. We store a single preference key (cookie_accepted) in your browser’s localStorage when you activate the banner action, so the notice does not reappear on every visit. This is strictly necessary for the consent UX and does not track you across sites.

Session & security. If you use interactive features such as the kickoff form, transient session tokens may be set to protect against abuse and CSRF. They expire when the browser session ends.

Third-party embeds. The contact page embeds a Google Map via Google Maps. Loading that frame may allow Google to set cookies under Google’s own policies. The map is marked loading="lazy" so it initializes on demand. You can avoid it by contacting us by email or phone instead.

No ad profiles. We do not run third-party advertising or cross-site tracking cookies on this site.

Your controls. Block or delete cookies and localStorage via your browser settings at any time. Blocking the consent key only means the banner will reappear; core pages remain usable.

Section D · Effective 1 September 2026

Refund & Reimbursement Policy

Fixed-scope milestones. If WebCoreFoundry cancels an unpaid or pre-paid fixed-scope milestone before work starts, you receive a full refund to the original payment method within 10 business days.

Work already performed. If you cancel after work has begun, fees for work completed up to the cancellation date are non-refundable; any prepaid balance for unstarted milestones is returned pro rata. Completed milestones remain payable in full.

Retainers. Monthly reliability retainers may be cancelled before the next billing date. The current month is non-refundable once the service window has opened; unused hours do not roll over unless the statement of work says they do.

Defects. Reproducible defects against an accepted specification are remedied under the warranty in the Terms at no charge. Refunds are not a substitute for the cure process unless we fail to cure a material defect within a reasonable period after written notice.

Statutory rights. For consumers, mandatory statutory withdrawal rights (e.g., 14-day EU withdrawal for distance contracts where applicable) remain unaffected. Digital services begun with express prior consent before the withdrawal period ends may be forfeitable as provided by law (§356 Abs. 5 BGB).

How to request. Email [email protected] with the invoice number and reason. Approved refunds are issued to the original payment method; processing by the payment provider may take additional bank days.

Registered entity

WebCoreFoundry

Fohlenweide 83, 16767 Leegebruch, Germany
Email: [email protected]
Phone: +49 151 92038471

Start Project Pay Online
← Return to Overview