Template. Replace every value in [brackets] in src/data/company.ts and have this text reviewed by a lawyer. Then set legalReviewed: true to remove this notice.

legal / privacy

Privacy Policy

Last updated: [DD Month YYYY]. This policy explains which personal data we process when you visit this website or contact us, why we do it, and which rights you have under the EU General Data Protection Regulation (GDPR).

Who is responsible

We are not legally required to appoint a data protection officer. For any privacy question, write to the address above.

Summary

• This website sets no cookies and uses no tracking or analytics tools.
• Fonts and all other files are served from our own server. Visiting the site sends no data to Google or other third parties.
• We only process the data you send us through the contact form or by email, to answer your request.

Hosting and server logs

This website is hosted by [Hosting provider, legal name, address] on servers in the European Union. When you open a page, the server automatically records technical data in log files: your IP address, date and time of the request, the page requested, the referring page, the browser and operating system, and the amount of data transferred.

We need this data to deliver the website, to keep it stable and secure, and to detect attacks. The legal basis is our legitimate interest in a secure and working website (Art. 6 (1) (f) GDPR). Log files are deleted after [7] days, unless a security incident requires us to keep them longer. We have a data processing agreement with the hosting provider (Art. 28 GDPR).

Contact form and email

When you use the contact form, we process your name, email address, company (optional), the service you are interested in, your budget range (optional), your message and the language of the page you write from. When you email us, we process your email address and the content of your email.

We use this data only to answer your request and, if it leads to a project, to prepare a proposal. The legal basis is the preparation of a contract (Art. 6 (1) (b) GDPR) and our legitimate interest in answering enquiries (Art. 6 (1) (f) GDPR). Providing the data is voluntary, but we cannot reply without a valid email address.

Form submissions are delivered to us through [form service or own server, provider name and location], with which we have a data processing agreement. Emails are handled by [email provider, location].

To stop automated mass submissions, the form accepts at most five messages per hour from one connection. For this we keep a salted, non-reversible hash of your IP address and the times you sent a message for one hour, then delete them (legal basis: Art. 6 (1) (f) GDPR, our legitimate interest in protecting the form from abuse).

Clients and projects

If you become a client, we process contact and contract data, project communication and billing data to carry out the contract (Art. 6 (1) (b) GDPR) and to meet our legal obligations, for example tax and commercial record-keeping (Art. 6 (1) (c) GDPR). When we process personal data on your behalf, for example your customers' data in a website or app we run for you, we sign a separate data processing agreement (Art. 28 GDPR).

Cookies and tracking

This website does not store cookies and does not use analytics, advertising or social media tracking. If you choose a light or dark theme with the theme button, your browser keeps that choice in its local storage; it never leaves your device. Details are in our cookie policy. If we add such tools in the future, we will ask for your consent first and update this policy.

Fonts and external content

The fonts on this website are hosted on our own server, so no connection to external font providers is made. We do not embed videos, maps or social media posts. Links to other websites only take effect when you click them; from then on, the privacy policy of the other website applies.

Recipients and transfers

We share personal data only with service providers that help us run this website and our business (hosting, email, form delivery, accounting), with our tax advisor, and with authorities where the law requires it. All service providers are bound by data processing agreements or professional secrecy.

Members of our team or individual service providers may work from countries outside the EU and the European Economic Area. Where personal data is transferred to such a country and the European Commission has not confirmed an adequate level of protection, we use the EU Standard Contractual Clauses (Art. 46 (2) (c) GDPR) and limit access to what is needed for the task. You can request a copy of these safeguards using the contact details above.

How long we keep data

• Server log files: [7] days.
• Enquiries that do not lead to a project: deleted 12 months after our last contact.
• Contract and billing records: as long as German commercial and tax law requires, usually 6 to 10 years (§ 257 HGB, § 147 AO).

Your rights

You have the right to:

• access the personal data we hold about you (Art. 15 GDPR);
• have incorrect data corrected (Art. 16 GDPR);
• have your data deleted (Art. 17 GDPR) or its processing restricted (Art. 18 GDPR);
• receive your data in a common, machine-readable format (Art. 20 GDPR);
• withdraw any consent you have given, with effect for the future (Art. 7 (3) GDPR).

Right to object (Art. 21 GDPR): where we process your data on the basis of our legitimate interests, you can object at any time for reasons arising from your particular situation. We will then stop, unless we can show compelling legitimate grounds or need the data to establish, exercise or defend legal claims.

To use any of these rights, email [privacy@your-domain]. You also have the right to complain to a data protection supervisory authority, in particular the one responsible for our registered office: Der Hessische Beauftragte für Datenschutz und Informationsfreiheit (HBDI), Wiesbaden.

Security

This website is served only over an encrypted connection (TLS), which you can recognise by the “https://” in the address bar. We protect the data we hold with technical and organisational measures appropriate to the risk.

Changes

We update this policy when our website or the law changes. The date at the top shows the current version.