Privacy

Controller

The controller within the meaning of the GDPR is:

Overview of processing

Personal data is processed only where necessary to operate this website, handle your enquiry, or pursue legitimate interests — or where you have given consent. There is no automated decision-making or profiling within the meaning of Art. 22 GDPR.

Hosting and server log files

This site is operated on servers of a hosting provider. When you access the site, the server may automatically collect log data (e.g. IP address, date/time of the request, resource requested, data volume, browser type/version). Processing serves secure, stable operation (legitimate interest under Art. 6(1)(f) GDPR) and technical error analysis. Log data is deleted by the provider according to its policies.

Refer to your hosting provider’s documentation and contract for details.

Contact by email or contact form

If you contact us by email or via the contact form, we process the data you provide (name, email, optional phone, message text) and technically necessary metadata to handle your request. Legal bases are Art. 6(1)(b) GDPR (pre-contractual/contractual communication) and Art. 6(1)(f) GDPR (legitimate interest in efficient handling and abuse prevention). The IP address of contact form submissions may be stored for security purposes.

Contact enquiries are stored in this application’s database for handling and traceability. Retention is usually until the request is completed; where a project relationship exists, records may be kept longer as required by commercial and tax retention rules (currently up to ten years).

Cookies and similar technologies

Cookies and local storage are used: technically necessary session cookies for form protection (CSRF) and — where you consent in the cookie banner — optional analytics tools. Accessibility preferences under “Display settings” are stored locally in your browser only. You can adjust your cookie choice at any time.

In addition, first-party page statistics (see below) set a pseudonymous visitor identifier unless you choose “Essential only” or where consent for statistics is not required.

First-party page statistics

For a privacy-conscious overview of site usage, access data is processed in our own database: page viewed, date/time, referrer, anonymised IP address (last octet removed), browser/device information, and a pseudonymous visitor identifier (cookie, validity approx. twelve months). Analysis is operator-side only; no third-party tracking services are used. Legal basis: Art. 6(1)(f) GDPR (legitimate interest in proportionate, in-house statistics without sharing data with third parties).

External web analytics (after consent)

If you choose “Statistics” or “Accept all” in the cookie banner, an external analytics tool (e.g. Google Analytics, Plausible, or self-hosted Matomo) may additionally be loaded. Without that consent, no such scripts are loaded. The active tool follows this site’s configuration.

Your rights

Where provided by law, you have rights of access, rectification, erasure, restriction, objection (in particular where processing is based on Art. 6(1)(f) GDPR), and data portability. Where processing is based on consent, you may withdraw consent with future effect.

Right to lodge a complaint

You may lodge a complaint with a supervisory authority. The competent authority in Lower Saxony is the State Commissioner for Data Protection (Landesbeauftragte für den Datenschutz Niedersachsen), Prinzenstraße 5, 30159 Hannover, Germany — https://lfd.niedersachsen.de.

Changes

This privacy notice may be updated when legal requirements, technical features, or processing activities change.