Privacy Policy

Last updated: September 2026

This Privacy Policy informs you, pursuant to Art. 13 and Art. 14 of Regulation (EU) 2016/679 (General Data Protection Regulation – GDPR / DSGVO) and applicable national rules (in particular the BDSG), about the processing of personal data in connection with Templass (Website, quote requests, Looking Glass and related tooling, customer Panel where used, and DDoS mitigation services where contracted).

1. Controller

The controller responsible for data processing is:

Templass, operated by Ali Rayan
Sole trader / Kleinunternehmen (§ 19 UStG)
Welserstraße 3
87463 Dietmannsried
Germany

VAT ID: DE462682632

Public contact for privacy & support: [email protected]

This is the only public contact address published for privacy and Website enquiries on templass.com. Please send privacy requests to [email protected].

No data protection officer (DPO) has been appointed (Kleinunternehmen; the statutory appointment obligation under § 38 BDSG / Art. 37 GDPR does not, in our assessment, apply).

Further legal information: Imprint · Terms of Service · this Privacy Policy at Privacy Policy.

2. General information on processing

2.1 Scope of processing

We process personal data only to the extent necessary to provide a functional Website, to handle quote and pre-contractual enquiries, to operate related Templass tooling (including the Looking Glass at lg.templass.com), to operate or link to the customer Panel where accounts exist, to perform contracted DDoS mitigation / remote mitigation services, to comply with legal obligations, or where we have a legitimate interest that is not overridden by your interests or fundamental rights.

2.2 Legal bases

Unless otherwise stated in the following sections, we rely on:

• Art. 6(1)(b) GDPR – performance of a contract or pre-contractual measures (e.g. quote handling, written acceptance, Panel account where used, provisioning, billing under a contracted mitigation service);
• Art. 6(1)(c) GDPR – compliance with legal obligations (e.g. commercial and tax retention);
• Art. 6(1)(f) GDPR – legitimate interests (e.g. IT security, abuse prevention, operation and protection of Website and mitigation infrastructure, Cloudflare Tunnel and Captcha / bot protection, rate limiting, improving service stability), unless overridden by your interests or fundamental rights.

We use consent under Art. 6(1)(a) GDPR only where we actually obtain it. On the Website we do not claim first-party tracking cookies. Theme preferences are stored on-device via localStorage (not a cookie). Access protection via Cloudflare Captcha / challenge may set technically necessary cookies or similar identifiers as described by Cloudflare.

2.3 Scope of the offering (brief overview)

Templass provides always-on remote DDoS mitigation billed on clean delivered bandwidth (not attack volume). Connectivity to your origin is typically via GRE or cross-connect. Network identity includes ASN AS208743. Mitigation infrastructure is operated in own colocation at Equinix FR5, Frankfurt, with edge capacity in the “Over 1 Tbps” class (edge class, not a per-customer commit). The Service is shared mitigation infrastructure and is not a CDN.

Commercial engagement is quote-driven: interested parties submit a quote request; a customer relationship for mitigation arises through written acceptance / provisioning. Where a customer Panel is used for Templass Service, it is the Templass Panel at panel.templass.com.

Related online offerings may include:

Indicative clean-bandwidth pricing may appear on the Website as whole-volume tiers (e.g. 0–299 Mbps at €0.45/Mbps, 300–509 at €0.41/Mbps, 510–999 at €0.39/Mbps, 1000+ at €0.33/Mbps), with a monthly floor of max(tiered charge, €39) that is not stacked on top of usage. Binding commercial terms are in the signed quote / written acceptance.

3. Website, hosting, and access protection

3.1 Provision of the Website and server log files

When you access our publicly reachable Website (templass.com and pages published there), the Looking Glass (lg.templass.com), and related Templass properties, the respective hosting, DNS, tunnel, and security services process technically necessary connection data, typically:

• IP address,
• date and time of the request,
• requested URL / resource,
• HTTP status code,
• amount of data transferred (bytes),
• referrer URL (if transmitted),
• user agent (browser/client information).

Purpose: technical delivery, stability, error analysis, abuse and security defence. Legal basis: Art. 6(1)(f) GDPR. Retention: hosting/access logs are generally deleted or anonymised within a short operational window (target: no later than 14 days), unless longer retention is required to investigate or defend against a concrete security incident.

3.2 Hosting (Skrime VPS), DNS, Cloudflare Tunnel and Captcha

The Website and related applications run on a Skrime VPS (self-managed Docker stack). Skrime processes connection and operational data as needed to host the machine. DNS providers process query and related metadata as needed to resolve templass.com, www.templass.com, and related hostnames.

Cloudflare, Inc. is used for Cloudflare Tunnel (secure connectivity / exposure of selected services) and Captcha / challenge (bot protection) where Website or Looking Glass access is protected, including Cloudflare Turnstile on the Website quote form where configured. In that context Cloudflare processes connection and security-related data (e.g. IP address, request metadata, challenge interactions, and technically necessary cookies or similar identifiers for the challenge).

• Purpose: secure delivery, tunnel connectivity, bot and abuse protection.
• Legal basis: Art. 6(1)(f) GDPR.
• Third country: Cloudflare, Inc. is based in the USA; transfers are addressed in Section 14.

This Privacy Policy does not claim Cloudflare WAF or CDN products beyond Tunnel and Captcha / challenge as described above.

3.3 No claimed first-party tracking cookies

The Website does not claim first-party tracking cookies. Technically necessary processing by hosting, DNS, Cloudflare Tunnel / Captcha, and related stacks remains unaffected.

4. Theme preference (localStorage)

To store your display preference (e.g. light/dark mode), the browser key templass-theme may be set in localStorage.

• This is not a cookie.
• Storage is exclusively on your device; we do not receive an automatic server transmission of this preference as a tracking signal.
• Legal basis: Art. 6(1)(f) GDPR (legitimate interest in a user-friendly presentation) or — where applicable — the technical necessity of the UI feature.
• You can delete the entry at any time via your browser settings.

5. Quote requests and email

5.1 Quote requests

If you submit a quote request via the Website form (or contact us by email at [email protected]), we process the information you provide, in particular:

• name,
• email address,
• use case,
• peak clean Mbps (estimated),
• connection type (gre or cross-connect),
• optional notes,
• and any further technical or commercial details you include.

The Website quote endpoint (POST /api/quote) validates the submission and logs it as structured data (JSON) for handling. Quote or notification emails are delivered via transactional SMTP where configured.

Purpose: handling your enquiry, preparing a quote, pre-contractual communication, provisioning follow-up. Legal basis: Art. 6(1)(b) GDPR (pre-contractual measures) and/or Art. 6(1)(f) GDPR (efficient communication and documentation of enquiries).

5.2 Email delivery (Namecrane Workspace SMTP)

Transactional quote-notification emails and mailbox traffic for the public contact address [email protected] are handled via Namecrane Workspace SMTP (mail host eu1.workspace.org). The [email protected] mailbox is hosted on that service. Namecrane processes recipient, sender, and message metadata as needed for mailbox operation and SMTP delivery.

Legal basis: Art. 6(1)(b) and/or (f) GDPR. Retention: We retain enquiries for as long as needed for handling and traceability, and thereafter in line with statutory retention periods or until legitimate interests in documentation expire (typically within ordinary correspondence periods; tax-relevant or contract-related matter may be longer — see Section 15).

6. Looking Glass

6.1 Use of the Looking Glass

Templass offers a Looking Glass at lg.templass.com as an informational / operational property. If you use the Looking Glass:

• you may submit a target IP address or hostname for probes (e.g. ping, traceroute, or similar diagnostics);
• we process your client IP address and related request metadata for delivery, rate limiting, abuse prevention, and security;
• access may be protected via Cloudflare Tunnel and/or Captcha / challenge as described in Section 3.2;
• probe results and timestamps may be logged temporarily for operations and abuse defence.

Purpose: network transparency, diagnostics, rate limiting, abuse prevention. Legal basis: Art. 6(1)(f) GDPR; where use is tied to a contractual relationship, additionally Art. 6(1)(b) GDPR.

6.2 GeoIP enrichment (Looking Glass)

Looking Glass tooling may enrich client or target location context using third-party GeoIP APIs, including providers such as ip-api.com and/or ipapi.co. Those providers receive the IP address (or related query) needed for the lookup and return approximate geolocation metadata.

Legal basis: Art. 6(1)(f) GDPR. Third country / provider terms: depending on the GeoIP provider’s operating model; see their privacy information and Section 14 where transfers apply.

7. Customer Panel

7.1 Panel for Templass Service

Where a customer Panel is used for Templass Service, it is the Panel at panel.templass.com, operated by the same controller (Ali Rayan). The Website may link to or rely on that Panel.

7.2 Account and session data

If you have or create an account on the Panel, we process in particular:

• email address and password credentials (passwords stored in hashed form as implemented by the Panel),
• session cookies and related authentication / session identifiers,
• profile and contact details you provide,
• billing linkage and invoice-related metadata associated with your account (payment card or PayPal account data themselves are handled by the payment providers described in Section 8, not stored by Templass as full PANs).

Purpose: authentication, account administration, Service management, billing linkage, support. Legal basis: Art. 6(1)(b) GDPR; Art. 6(1)(f) GDPR for security of authentication and session integrity.

7.3 Panel connection data

Access to the Panel involves connection and security data as for other web offerings (Section 3), including any Cloudflare Tunnel / Captcha protection that applies to that hostname.

8. Payments

Where you pay for contracted Service, available methods include Stripe, PayPal, and EU / SEPA bank transfer, as stated in the Quote or invoice. There is no self-serve subscription checkout on this Website.

• Stripe and PayPal process payment data as independent controllers and/or processors according to their own terms and privacy policies. Card numbers and PayPal account credentials are handled by those providers; Templass does not store full payment card numbers (PANs).
• Bank transfer (EU / SEPA): we process the bank and remittance details reasonably needed for invoicing, reconciliation, and accounting.

Purpose: collection of fees, invoicing, accounting, fraud prevention. Legal basis: Art. 6(1)(b) GDPR; Art. 6(1)(c) GDPR for statutory bookkeeping where applicable; Art. 6(1)(f) GDPR for payment security and reconciliation. Third country: where Stripe or PayPal involve US or other third-country processing, Section 14 applies.

9. Network and mitigation processing

9.1 Technical necessity

Where you contract Templass for always-on remote DDoS mitigation, we necessarily process network traffic routed through our scrubbing / mitigation infrastructure (including own colocation at Equinix FR5, Frankfurt, ASN AS208743, and possibly further interconnection points). This includes in particular:

• IP packets and header information,
• source and destination IP addresses,
• ports, protocols, packet sizes, and related traffic metadata,
• signatures and patterns for detecting abusive or anomalous load,
• telemetry and operational logs derived therefrom (including clean-bandwidth measurement for billing).

Purpose: filtering and forwarding legitimate connections, defending against DDoS and abusive traffic, operations, capacity and quality control, clean-bandwidth billing (95th percentile clean Mbps over the billing period; attack traffic dropped at the edge is not billed as clean), and traceability of events for the customer. Legal basis: Art. 6(1)(b) GDPR and Art. 6(1)(f) GDPR.

9.2 No advertising use

This traffic-related processing is not for advertising and not for profiling for marketing purposes. It is technical processing to provide the protection service and to bill clean delivered bandwidth.

9.3 Data subjects and customer responsibility

Data subjects may include: customers or their contacts and — indirectly — end users (e.g. visitors, players, or clients) whose connections run through the protected service. Towards end users, the customer is typically the one offering the service; we process the traffic data described as a technical service provider for mitigation.

You as the customer remain — where applicable — responsible for your own information obligations towards your end users.

9.4 Retention of mitigation / attack telemetry

Attack and telemetry data are retained for as long as required for operations, billing traceability, and support, then deleted, anonymised, or aggregated, unless statutory retention obligations require otherwise.

10. Recipients and processors

Personal data are disclosed only where necessary for the stated purposes, a legal basis exists, and — where required — appropriate safeguards are in place (in particular processing under Art. 28 GDPR).

We do not sell personal data.

11. Categories of personal data (overview)

1. Identity and contact data (name, email),
2. Quote and commercial enquiry content (use case, capacity estimates, connection type, notes),
3. Communication content (email / support correspondence),
4. Billing and contract metadata; payment metadata handled by Stripe / PayPal or bank transfer details for SEPA,
5. Panel account and session data where a Panel account exists,
6. Technical usage and log data; Cloudflare Tunnel / Captcha security data,
7. Looking Glass probe inputs and client IP / rate-limit data (lg.templass.com),
8. Network traffic and telemetry data in the course of contracted mitigation,
9. On-device theme preference (templass-theme in localStorage).

12. Obligation to provide data

Providing certain data is required for particular functions:

• Without the quote form fields (or equivalent email content), we cannot prepare a meaningful quote.
• Without required technical configuration data, a contracted mitigation service cannot be provisioned.
• Without the technically necessary processing of traffic data (including IP addresses), DDoS protection in the form described is not possible.
• Looking Glass probes require a target and necessarily involve your client IP for rate limiting.
• Without Panel account credentials, Panel features that require login cannot be used.
• Without payment details via Stripe, PayPal, or bank transfer as applicable, contracted fees cannot be settled.

13. No automated decision-making

There is no automated decision-making including profiling within the meaning of Art. 22 GDPR that produces legal effects concerning you or similarly significantly affects you. Technical filtering and mitigation decisions in the network, Looking Glass rate limits, and Captcha / bot challenges serve solely security, operations, and contract-performance purposes.

14. Third-country transfers

Where providers have seats or processing locations in the USA or other third countries (in particular Cloudflare, Stripe, and/or PayPal where their processing involves such locations, and GeoIP providers where applicable), transfers take place only where

• an adequacy decision of the European Commission applies (where applicable, e.g. EU–US Data Privacy Framework for certified organisations), and/or
• appropriate safeguards under Art. 46 GDPR exist, in particular Standard Contractual Clauses (SCCs), and/or
• an exception under Art. 49 GDPR applies (only in individual cases).

15. Retention

• Quote and pre-contract correspondence: for as long as needed for handling and documentation; longer if a contract follows or statutory retention applies.
• Contract / invoice / accounting data (once contracted): according to commercial and tax retention periods (regularly up to 10 years, § 147 AO / § 257 HGB).
• Website hosting logs: generally ≤ 14 days, except in security incidents.
• Looking Glass rate-limit / probe logs: short operational window needed for abuse defence.
• Mitigation / attack telemetry: operationally limited period for operations, billing, and support; thereafter deletion, anonymisation, or aggregation.
• Panel account / session data: for the life of the account and as needed for security and billing.
• localStorage theme: until you delete it on the device.

16. Rights of data subjects

Subject to statutory requirements, you have the following rights:

• Access (Art. 15 GDPR),
• Rectification (Art. 16 GDPR),
• Erasure (Art. 17 GDPR),
• Restriction of processing (Art. 18 GDPR),
• Data portability (Art. 20 GDPR),
• Objection to processing based on Art. 6(1)(f) GDPR (Art. 21 GDPR) — an informal notice to [email protected] is sufficient,
• Withdrawal of consent (Art. 7(3) GDPR), where processing is based on consent; withdrawal takes effect only for the future.

To exercise your rights, contact: [email protected]. We may request suitable proof of identity.

17. Right to lodge a complaint with a supervisory authority

You have the right to lodge a complaint with a data protection supervisory authority, in particular in the Member State of your habitual residence, place of work, or place of the alleged infringement (Art. 77 GDPR).

The authority competent for us / mentioned as supervisory authority:
Der Bayerische Landesbeauftragte für den Datenschutz
Wagmüllerstraße 18
80538 München
Germany
Website: https://www.datenschutz-bayern.de

18. Security

Taking into account the state of the art, implementation costs, and the nature, scope, context, and purposes of processing as well as the varying likelihood and severity of risks, we implement appropriate technical and organisational measures (Art. 32 GDPR), in particular:

• transport encryption (TLS) for web offerings where configured,
• Cloudflare Tunnel and Captcha / challenge where access is protected,
• access restrictions for operational systems,
• network and infrastructure hardening of mitigation at own colocation (Equinix FR5),
• rate limiting and abuse controls on public tooling such as Looking Glass,
• hashed Panel credentials and session controls as implemented by the Panel.

Absolute security cannot be guaranteed. Please report suspicious activity to [email protected].

19. Minors

Our offerings are aimed primarily at operators, hosts, and networks (B2B-leaning), without claiming an exclusive restriction to businesses. We do not intentionally collect personal data from children. If you become aware that a minor has submitted data without parental/guardian consent, contact us so we can review and, where appropriate, delete the data.

20. Changes to this Privacy Policy

We reserve the right to adapt this Privacy Policy if the legal situation, services, or processing processes change. The current version is published at templass.com/privacy. For material changes we will — where appropriate and reasonable — provide additional notice (e.g. by email to known contacts).

Last updated: September 2026

[email protected]