Privacy policy

About this translation

This is a courtesy translation. In case of any discrepancy, the German version of this privacy policy is the legally binding one.

1. Summary

We collect only the data we need to answer your enquiry and carry out the installation appointment. We do not sell data, we run no cross-site tracking, and we set no advertising cookies.

• Without your consent we load no external services — the booking calendar stays blocked until then.
• Fonts are served from our own server. No connection to Google Fonts is established.
• Our analytics work without cookies and without cross-device recognition.
• Contact form enquiries are deleted no later than six months after the end of the correspondence, unless a statutory retention period applies.
• You can withdraw any consent at any time with a single click.

2. Controller

The controller for data processing on this website within the meaning of Art. 4 (7) GDPR is:

We are not required to appoint a data protection officer, as the conditions of Art. 37 GDPR and § 38 BDSG are not met. For any privacy matter, please use the email address above.

3. Legal bases

We process personal data exclusively on one of the following bases:

Art. 6 (1) (a) GDPR — consent

For optional cookies, loading external services and voluntarily receiving offers by email. Consent can be withdrawn at any time.

Art. 6 (1) (b) GDPR — contract and pre-contractual steps

For handling your enquiry, arranging the appointment, performing the installation and invoicing.

Art. 6 (1) (c) GDPR — legal obligation

For retaining invoices and tax-relevant records under German commercial and tax law.

Art. 6 (1) (f) GDPR — legitimate interests

For secure and stable operation of the website, defence against attacks and spam, and asserting our own legal claims.

§ 25 (2) no. 2 TDDDG

For storing strictly necessary information on your device — your language, appearance and cookie choices.

4. Hosting and server log files

This website is hosted by Vercel Inc., 340 S Lemon Ave #4133, Walnut, CA 91789, USA, and delivered via their content delivery network. Server regions are configured for Europe (Frankfurt am Main), so requests are generally processed within the EU.

A data processing agreement pursuant to Art. 28 GDPR is in place with Vercel. Where data does reach the USA, the transfer is safeguarded by the EU Standard Contractual Clauses under Art. 46 (2) (c) GDPR; Vercel is additionally certified under the EU-U.S. Data Privacy Framework.

Each request automatically generates technical access data in log files. This processing is technically necessary to deliver the page; the legal basis is Art. 6 (1) (f) GDPR. The following is recorded:

• truncated IP address of the requesting device
• date and time of the request
• requested URL and HTTP status code
• amount of data transferred
• referrer URL, where transmitted
• browser type, browser version and operating system

These data are not merged with other sources and are deleted automatically after 30 days at the latest. They are evaluated only on an ad-hoc basis for troubleshooting or where there are indications of abuse.

5. Cookies and consent management

We use only a small, clearly defined set of storage operations on your device. No advertising cookies, tracking pixels or cross-device recognition are used.

Optional categories — statistics and external services — are loaded only after your active consent. Until then, no script from these providers is executed and no connection to their servers is made. You can change or withdraw your choice at any time via “Cookie settings” in the footer; a withdrawal takes effect from the moment it is declared.

6. Contact form and enquiries

If you contact us via the form, by email, by phone or by messenger, we process the information you provide in order to answer your enquiry and prepare a quotation.

The legal basis is Art. 6 (1) (b) GDPR, as the processing serves the preparation of a contract; for purely informational enquiries, Art. 6 (1) (f) GDPR. The form additionally obtains consent under Art. 6 (1) (a) GDPR.

To protect against automated bulk enquiries we use an invisible field (honeypot) and a server-side limit on requests per IP address. A truncated, non-reversible hash of your IP address is held in memory for a maximum of 60 minutes. The legal basis is Art. 6 (1) (f) GDPR.

We delete your enquiry once it has been fully dealt with and no statutory retention obligations apply — at the latest six months after the last contact. If a contract is concluded, tax retention periods of six and ten years apply.

7. Sending notifications (Resend)

For the technical delivery of confirmation and notification emails we use Resend, Inc., 2261 Market Street #5039, San Francisco, CA 94114, USA. The provider processes the recipient address, subject, content and delivery status of the message.

Resend is contractually bound as a processor under Art. 28 GDPR. Transfer to the USA is safeguarded by the EU Standard Contractual Clauses under Art. 46 (2) (c) GDPR. The legal basis for the processing is Art. 6 (1) (b) GDPR. Delivery logs are deleted after 30 days.

Unencrypted email can be intercepted in transit. We use transport encryption (TLS) where your provider supports it. For particularly sensitive information, please use the phone.

8. Online appointment booking (Cal.com)

For online appointment scheduling we embed the service of Cal.com, Inc., 2261 Market Street #4382, San Francisco, CA 94114, USA. The booking calendar is loaded only after your consent to the “External services” category; no connection to Cal.com is established beforehand.

Once loaded, Cal.com necessarily receives your IP address as well as browser and device information. If you book an appointment, your name, email address, chosen time, time zone and the details you provide about the job are also processed.

The legal basis for the embedding is your consent under Art. 6 (1) (a) GDPR in conjunction with § 25 (1) TDDDG; for processing the booking data, Art. 6 (1) (b) GDPR. A data processing agreement is in place and the third-country transfer is safeguarded by the EU Standard Contractual Clauses. Booking data are deleted after completion of the job and expiry of the warranty period.

9. Analytics (Vercel Analytics and Speed Insights)

Following your consent to the “Statistics” category, we use Vercel Analytics and Vercel Speed Insights to understand which pages are used and how quickly they load.

• No cookies are set and no identifiers are stored on your device.
• IP addresses are not stored; attribution uses a transient hash value that changes daily.
• There is no recognition across multiple websites or devices.
• Recorded data: page viewed, referrer, device category, country, browser and loading performance metrics (Core Web Vitals).

The legal basis is your consent under Art. 6 (1) (a) GDPR. The aggregated reports do not allow conclusions about individual persons and are deleted after 12 months. If you withdraw consent, the script is no longer executed from that moment on.

10. Fonts, maps and embedded content

All fonts used are served from our own server. Unlike the dynamic embedding of Google Fonts, this means no connection to third-party servers is ever established and no IP address is transmitted to Google.

We do not embed map services or video platforms by default. Should a map be embedded in future, it will only be loaded after prior consent via the “External services” category.

11. Recipients of your data

Data are shared only where necessary to perform the contract or required by law. Recipients are:

Your data are not sold, not rented and not passed to third parties for advertising purposes.

12. Transfers to third countries

Some of the service providers we use are based in the USA. Where data are transferred there, we rely on the Standard Contractual Clauses adopted by the European Commission under Art. 46 (2) (c) GDPR, supplemented by technical and organisational measures such as transport encryption, encryption at rest and data minimisation.

Please note that under US law, authorities may under certain conditions access data, and that the level of protection does not correspond to the European standard in every respect. You can refuse the consent-based services at any time; the website remains fully usable in all core functions.

13. Retention periods

14. Your rights

You have the following rights at any time and free of charge:

Access (Art. 15 GDPR)

You can find out which data we process about you, for what purpose and for how long.

Rectification (Art. 16 GDPR)

We correct inaccurate data without delay and complete incomplete data.

Erasure (Art. 17 GDPR)

We delete your data unless a statutory retention obligation applies.

Restriction (Art. 18 GDPR)

You can have processing restricted, for example while we verify accuracy.

Data portability (Art. 20 GDPR)

You receive the data you provided in a structured, machine-readable format.

Objection (Art. 21 GDPR)

You can object to processing based on legitimate interests.

Withdrawal (Art. 7 (3) GDPR)

You can withdraw any consent given, with effect for the future.

An informal message to wirdgemacht.franken@gmail.com is sufficient for any request. We respond within the period set by Art. 12 (3) GDPR, i.e. generally within one month.

15. Right to lodge a complaint

Under Art. 77 GDPR you have the right to lodge a complaint with a data protection supervisory authority. The authority responsible for us is:

Independently of this, you may contact the supervisory authority of your habitual residence or place of work.

16. Data security

All transmission is encrypted using TLS 1.3 with HTTP Strict Transport Security. We additionally apply a restrictive Content Security Policy, protection against clickjacking and MIME sniffing, and a restricted referrer and permissions policy.

Access to enquiries and job data is limited to the people who need it to carry out the work. Accounts are protected by two-factor authentication.

17. No automated decision-making

No automated decision-making or profiling within the meaning of Art. 22 GDPR takes place. Quotations and prices are calculated by people.

18. Changes to this policy

We update this privacy policy when our services, the providers we use or the legal situation change. The version published on this page applies; the date of the last change is shown at the top.