Privacy policy

The controller for data processing on this website is:

No data protection officer has been appointed, as the conditions of Article 37 GDPR and section 38 of the German Federal Data Protection Act are not met.

The hosting provider is Google Cloud EMEA Limited, Dublin. It processes on my behalf the data generated when the website is accessed, in particular the data listed in the section “Server log files”.

The website and its database run at the server location europe-west4 (Eemshaven, NL). So that pages load quickly, the provider keeps ready-made pages in its global delivery network. Your request is therefore received by the nearest location of that network, which may lie outside the European Union, for example if you open the site from outside Europe; your IP address is processed there. The stored pages themselves contain no personal data.

The live demo on the home page is run by a separate service with the same provider at the same location. Only the position of the selected slot is transmitted. Your IP address and any other information about you do not reach this service.

The legal basis is Article 6(1)(f) GDPR. The legitimate interest lies in providing the website in a technically secure, fast and reliable manner. A data processing agreement under Article 28 GDPR is in place with the provider.

Every time a page is accessed, the server automatically records the data your browser transmits: the address requested, the date and time, the volume of data transferred, the status message, the browser type and operating system, the referring page and the IP address.

The purpose is the technical delivery of the page and the detection of attacks. The legal basis is Article 6(1)(f) GDPR; the legitimate interest lies in secure operation. The data is not merged with any other data and no user profiles are created.

The data is deleted after 30 days.

When you use the contact form, I process only the details you enter there: name, email address, the topic you selected and your message, and your phone or WhatsApp number if you give one. There are no other fields.

The phone number is optional. I use it only to call you or reply on WhatsApp if you wish. When I reply on WhatsApp, the message goes through the WhatsApp service, whose privacy policy applies in addition.

The purpose is solely to handle your enquiry. The legal basis is Article 6(1)(b) GDPR where the enquiry is aimed at concluding or preparing a contract, otherwise Article 6(1)(f) GDPR based on the legitimate interest in answering enquiries.

The form asks you to confirm that you have read this statement. This is not consent within the meaning of Article 6(1)(a) GDPR and is not used as such; the processing is based on the grounds above. The confirmation is recorded together with the time the enquiry was received.

Your enquiry is stored in the database at the server location europe-west4 (Eemshaven, NL) so that I can process it. It is deleted automatically six months after it was received, or earlier at your request or once it has been dealt with.

Each new enquiry also reaches me as an email containing your details, in my Google Workspace mailbox. I delete this email and any further correspondence about your enquiry as soon as I no longer need them, at the latest six months after our last exchange, unless the paragraph after next requires longer retention.

An automatic confirmation of receipt is sent to the email address you entered. It states the topic you chose, your name in the greeting and, if given, your phone number, but not your message.

If the enquiry leads to a business relationship, the retention periods under German commercial and tax law apply: six years for business correspondence (Section 257(1) No. 2 and (4) of the German Commercial Code), ten years for accounting records (Section 147(1) and (3) of the German Fiscal Code). During these periods, processing is limited to retention.

To protect against automated requests, the website limits how often, per connection, the contact form can be submitted, the live demo triggered or an access code entered. The contact form additionally contains a field that is invisible to you and a check value that your browser receives from the server while you fill it in. It contains no information about you and only shows that the form was filled in on this website.

Your IP address is not stored for this limitation. It is combined with a random value regenerated on every server start to form a check value from which the address cannot be derived. That check value resides only in memory, is discarded after one hour at most and is lost on every restart. In the same way, a check value is formed from the email address you enter, so that no address receives more than two acknowledgements per day; it is discarded after 24 hours at most.

The legal basis is Article 6(1)(f) GDPR. The legitimate interest lies in protecting the mailbox and the services against automated access.

Your data is neither sold nor passed on for advertising purposes. The only recipients are the following service providers, acting on my behalf and on my instructions under Article 28 GDPR:

Google Cloud EMEA Limited, Dublin: operating the website and the database, server location europe-west4 (Eemshaven, NL).

Google Workspace: my email mailbox, where the notification of your enquiry arrives.

Brevo GmbH, Köpenicker Str. 126, 10179 Berlin: delivery of that notification and of the confirmation of receipt sent to you.

Transfers to countries outside the European Union and the European Economic Area are not intended but cannot be ruled out: Google and Brevo use further service providers, including group companies in the United States, and requests from outside Europe are received by the delivery network described in section 3 at a nearby location.

Such transfers are based on the European Commission’s adequacy decision on the EU-U.S. Data Privacy Framework (Article 45 GDPR), where the recipient is certified under it, and otherwise on the European Commission’s standard contractual clauses (Article 46(2)(c) GDPR), which form part of the data processing agreements.

During an ordinary visit, this website sets no cookies and stores nothing in your browser. No analytics tools are used, no advertising networks are embedded, no user profiles are created and no cross-device recognition takes place.

Technically necessary cookies are the exception. As long as the website can only be reached with an access code before its publication, the cookie “__Host-bendacloud-zugang” remembers for at most 30 days that you have entered the code. Three more concern only the operator: “__Host-bendacloud-oauth” holds a single-use check value for at most ten minutes while the operator signs in with Google, “__Host-bendacloud-admin” keeps the operator signed in to the internal area for at most eight hours, and “__Host-bendacloud-krone” shows a symbol in the page header during that time. None of them contains any information about you.

The legal basis for storing these cookies is Section 25(2) No. 2 of the German TDDDG, and for the associated processing Article 6(1)(f) GDPR. They are strictly necessary to provide the access you have expressly requested. No consent is required, which is why this website shows no consent prompt.

All fonts are built into the website and served from the same server as the pages. No connection to Google Fonts or any other third-party provider is established when the page loads, and no IP address is transmitted to third parties.

This website embeds no content from third-party providers: no maps, no videos, no social media buttons and no third-party scripts.

References to other websites, for example to the reference projects or to social media profiles, are plain links. Only when you click one does your browser open the third-party page; that page is governed by its operator’s privacy policy.

Using the contact form is voluntary. You are under no statutory or contractual obligation to provide the details. Without a name, email address and message, however, I cannot process or answer your enquiry; the phone number is not needed for that. No other disadvantage arises for you.

The data in the section “Server log files”, by contrast, is generated as a technical necessity as soon as you open the page.

No automated decision-making, including profiling within the meaning of Article 22 GDPR, takes place. Your enquiry is read and answered by a person.

You have the right of access to the data stored about you (Article 15 GDPR).

You have the right to rectification of inaccurate data and completion of incomplete data (Article 16 GDPR).

You have the right to erasure (Article 17 GDPR), unless a statutory retention obligation prevents it.

You have the right to restriction of processing (Article 18 GDPR).

You have the right to data portability (Article 20 GDPR), where processing is based on a contract or consent and carried out by automated means.

Your right to object under Article 21 GDPR is set out separately in the next section.

Exercising them is free of charge for you.

Where I process your data on the basis of Article 6(1)(f) GDPR, you may object to this processing at any time on grounds relating to your particular situation. This concerns hosting with the server log files, protection against misuse and enquiries that are not aimed at a contract.

I will then no longer process the data unless I can demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms, or the processing serves the establishment, exercise or defence of legal claims.

Irrespective of the rights above, you may lodge a complaint with a data protection supervisory authority, in particular in the Member State of your residence, your place of work or the place of the alleged infringement (Article 77 GDPR).

I adapt this statement when the data processing changes or the legal situation requires it. The version published on this page is the one that applies.

Last updated: 14 November 2026.