Controller and privacy contact

Controller

Graham Miranda UG (haftungsbeschränkt)

Address

Hasselfelder Str. 23
38889 Blankenburg (Harz)
Deutschland

Privacy contact

hi@support.grahammiranda.com

hi@support.grahammiranda.com

Website visits

The server processes technical connection data including IP address, time, requested address, browser information and response status to deliver, troubleshoot and protect the portal. Where necessary, this relies on Article 6(1)(f) GDPR, with the legitimate interest of secure, reliable operation. Fonts and images load from the site’s own server. The theme loads no analytics, advertising, map or social media scripts.

Hosting, CDN and server locations

Website hosting and application: OVH SAS (AS16276), Frankfurt am Main, Germany (EU/EEA). Content delivery and DNS: Cloudflare, Inc. (United States), operating a global edge network; HTTP traffic for this portal is proxied through Cloudflare in full (strict) TLS mode. Cloudflare is an active participant in the EU-U.S. Data Privacy Framework (verified in the Data Privacy Framework List, next re-certification 15 September 2027) and offers EU Standard Contractual Clauses as a fallback; a data processing agreement is held with Cloudflare.

Server log retention

Server access and error logs are rotated automatically once a week, compressed, and retained for five rotation cycles, i.e. up to about five weeks, after which they are deleted.

Tickets, accounts and attachments

SupportCandy processes the account and contact details needed for your request, subject, description, service category, conversation and files you voluntarily attach. Verified permissions control access. Necessary contractual or pre-contractual support relies on Article 6(1)(b) GDPR. Enquiries by a contact acting for a business may rely on Article 6(1)(f), with the interest of addressing and documenting the request. Statutory retention relies on Article 6(1)(c).

Share only necessary information and remove unrelated persons’ data from attachments. Do not put passwords, one-time codes or full payment details in general messages. If private credentials are necessary, agree a separate secure process in the verified ticket. This theme does not transmit ticket content to an AI service.

When a ticket is submitted, SupportCandy additionally stores the IP address of the requesting connection together with technical timestamps. This serves abuse and fraud prevention and the traceability of security-relevant incidents (Article 6(1)(f) GDPR, legitimate interest in secure operation). The IP address is stored for as long as the ticket record exists.

Retention of tickets, attachments and separate private credentials

Ticket records, conversations and attachments remain stored in the support system until an agent deletes the ticket, or until the data subject exercises their right to erasure. The IP address recorded with each ticket is stored for the lifetime of the ticket record. No separate automatic expiry is configured.

Contact form and email

The contact form processes name, email, topic and message to answer your enquiry. It passes these to the configured email system without creating its own message archive. Mailboxes and technical providers may retain messages and logs. Contractual or pre-contractual requests rely on Article 6(1)(b); other enquiries may rely on Article 6(1)(f), with the interest of answering your request.

Abuse protection uses salted identifiers derived from IP and email, rather than storing these identifiers in plain text, with a temporary counter. The counter expires after 15 minutes; WordPress cleanup removes expired records. Name and email are needed to identify and answer the enquiry. The form cannot be processed without them. Marketing consent is not required.

Email provider and recipient countries

Support mailbox and outbound delivery: FiberState, LLC / RackNerd cPanel host at fiber16-r.iaasdns.com (206.168.149.2), Los Angeles, California, United States. Inbound and outbound support email, including ticket notification email, is stored and processed on that server in the United States. No adequacy decision applies and no data processing agreement with Standard Contractual Clauses is concluded yet.

Correspondence retention

Support correspondence received by email is retained in the support mailbox and, when a ticket is created, in the support system. The mailbox retains processed messages until they are manually removed.

Public search and guide suggestions

Search terms and a new ticket’s subject may be sent to the same server to suggest published guides only. Message bodies, email, attachments and private credentials are not read for suggestions. Searches may appear in server logs. Do not enter confidential information in search fields.

Browser storage and optional services

Language is selected with the gm-lang URL parameter, without a language cookie. Your chosen colour mode is stored as gm-support-theme until you remove it. Privacy choices are stored as gm-support-consent with a version and timestamp to apply your selection. Required WordPress and SupportCandy session, login or security cookies depend on their actual configuration.

Section 25 TDDDG governs device storage and access. An exception under paragraph 2 may apply where strictly necessary for a service you expressly request. Optional external content is blocked by default and requires informed consent before loading. These local privacy controls do not manage every third-party plugin added later.

Optional communication and recipients

Local quick help searches public guides only. It does not connect a person or use an external AI service. A configured external chat opens only after your explicit choice. Authorized staff handle your request. Technical providers receive only necessary data in their respective roles; required processing agreements must be concluded. Additional notification, shop or email modules must be disclosed according to their actual configuration.

External chat, if used

None. No live-chat provider is connected; the theme shows built-in quick-help links only.

International processing

The theme does not detect a visitor’s country automatically. Transfers outside the EEA require an assessment and disclosure of actual recipients, countries and valid safeguards. The theme makes no claim that a provider holds certification or an adequacy status. Additional applicable local rights remain unaffected.

Verified position as of 1 October 2026: Cloudflare, Inc. (USA) provides content delivery and DNS. Cloudflare is listed in the US Department of Commerce Data Privacy Framework List as an active participant for the EU-U.S. DPF (status “Active”, next re-certification 15 September 2027); for transfers outside the DPF Cloudflare offers EU Standard Contractual Clauses. The support mailbox hi@support.grahammiranda.com is operated by FiberState, LLC / RackNerd in Los Angeles, California, USA (206.168.149.2). For that provider there is no adequacy decision and no completed data processing agreement with Standard Contractual Clauses; the transfer of support correspondence to the United States currently relies on Article 49(1)(b) GDPR (necessity for the performance or negotiation of the contract with you). A data processing agreement including EU Standard Contractual Clauses is being obtained.

International transfers and verified safeguards

Processing is not confined to the EU/EEA. (1) Content delivery and DNS run through Cloudflare, Inc. (USA); the transfer is covered by Cloudflare's certification under the EU-U.S. Data Privacy Framework (Data Privacy Framework List, active), with EU Standard Contractual Clauses as a fallback. (2) The support mailbox is operated by FiberState, LLC / RackNerd in the United States, so support correspondence and email notifications are transferred to and stored in the US; for this transfer there is no adequacy decision and no completed data processing agreement with Standard Contractual Clauses yet. The transfer currently relies on Article 49(1)(b) GDPR (necessity for the performance or negotiation of the contract with the data subject); a data processing agreement including EU Standard Contractual Clauses is being obtained. You can ask us for the current status of these safeguards at any time.

Deletion and backups

Data is deleted once its purpose ends, unless legal duties or necessary claims require retention. The periods above must match actual systems. Deletion in SupportCandy does not automatically delete mailbox copies, external notifications or backups. Their expiry and deletion procedures must be defined separately.

Backup retention and deletion

Backups are handled at server level by the hosting operator; this WordPress installation does not create or store its own backup copies. Note: the server-level backup job is currently failing, so no functioning offsite backup exists and no backup retention period can be stated as fact.

Notice for visitors outside the EU

This support portal is operated by a company established in Germany and is therefore subject to the General Data Protection Regulation (GDPR) and German data protection law. Those rights apply wherever you are located, and you may exercise them regardless of your place of residence.

Where local law outside the EU/EEA grants additional or different rights — for example in the United States, the United Kingdom, Switzerland or Canada — those statutory rights are unaffected. We do not collect personal data for advertising or profiling purposes, do not sell personal data, and do not operate cross-site tracking. No device fingerprinting is performed; the language choice uses the gm-lang URL parameter only, without a cookie or location detection.

Privacy requests may be sent to the privacy contact address above regardless of where you are located. We handle them within the applicable statutory periods.

Your rights

To request deletion of your account or data (Article 17 GDPR), open a ticket with the category “Account & data deletion” or write to the privacy contact above. We verify your identity before deleting data and confirm the deletion; statutory retention obligations remain unaffected.

Subject to legal conditions, you have rights to access, rectification, erasure, restriction and portability. You may object to processing based on legitimate interests under Article 21 GDPR. Consent can be withdrawn at any time for future processing. Contact the privacy address above; we may reasonably verify identity before disclosure.

You may complain to a supervisory authority under Article 77 GDPR, particularly where you live, work or believe an infringement occurred. The authority below covers the company’s location. This portal makes no solely automated decisions with legal or similarly significant effects.

hi@support.grahammiranda.com

State Commissioner for Data Protection, Saxony-Anhalt

Delete your account and data