Privacy policy

The German version (Datenschutz) prevails in case of doubt.

1. Controller

Willi Wiedergold, Astrid-Lindgren-Straße 10, 53844 Troisdorf, Germany · Email: hello@hollsteen.com

No data protection officer is appointed (not legally required).

2. Principle

Hollsteen is a free web app with data from public SEC filings. You can use it without registering. We use no third-party analytics or tracking tools and set no cookies for tracking; see the section on visitor statistics below. We embed no third-party content and load no fonts from third-party servers (IBM Plex is served from our own server).

3. Hosting and server log files

The website is hosted by Render Services, Inc., 525 Brannan Street, Suite 300, San Francisco, CA 94107, USA (data center: Frankfurt am Main). When you visit, the server processes technically necessary data: IP address, date and time, requested URL, referrer, browser identifier (user agent) and status code. Purpose: delivering the pages, security and error analysis. Legal basis: Art. 6(1)(f) GDPR (legitimate interest in a secure, working service). Retention: 7 days (hosting plan; see render.com/docs/logging).

A data processing agreement (Art. 28 GDPR) is in place with Render (Concluded via Render's Terms of Service (DPA incorporated, EU Standard Contractual Clauses included)); it is part of Render's terms of service (render.com/terms, render.com/dpa). As Render is a US company, access from the US cannot be ruled out. Render Services, Inc. is certified under the EU-U.S. Data Privacy Framework, including the UK Extension and the Swiss-U.S. DPF (DPF list entry). Transfers rely on the adequacy decision (Art. 45 GDPR) and, alternatively, on the EU Standard Contractual Clauses included in Render's DPA (Art. 46(2)(c) GDPR, render.com/dpa).

To count visits we use our own server-side statistics without cookies and without third parties: per page view we store only the date, the page, the referring website's domain (e.g. google.com), a coarse device class and, for some clicks, the event name; to estimate daily unique visitors we form a hash from IP address and browser identifier with a random key that changes daily and is never stored, so it cannot be traced back to you, and IP addresses are neither stored nor logged. Legal basis is our legitimate interest in understanding how the site is used (Art. 6(1)(f) GDPR); the aggregated counts are kept for at most 120 days.

4. Cookies and local storage

We set no cookies and use no local storage. If a login is introduced later, only a technically necessary session cookie will be set (§ 25(2) no. 2 TDDDG); this policy will be updated beforehand.

5. Contact by email

If you write to us, we process your email address and message to answer your request (Art. 6(1)(b) or (f) GDPR) and delete them once the request is settled and no statutory retention applies. Email provider: Apple (iCloud Mail).

6. External links

Links to sec.gov and other sites open third-party services subject to their own privacy policies. Merely viewing our pages does not connect to those servers.

7. Your rights

You have the right of access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and to object to processing based on Art. 6(1)(f) GDPR (Art. 21). Contact hello@hollsteen.com.

You may lodge a complaint with a data protection supervisory authority, e.g. the one responsible for us: Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen (LDI NRW).

8. No automated decision-making

No automated decision-making, including profiling, takes place.

Last updated: Oct 15, 2026