Privacy policy

1. Controller

No data protection officer has been appointed, as the legal requirements for doing so are not met.

2. Hosting and delivery of the website

This website is delivered via Cloudflare Workers, provided by Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107, USA. When you visit the site, Cloudflare processes technically necessary data: IP address, date and time, requested URL, referrer, browser and operating system details. Without this data the site cannot be delivered or protected against attacks. The legal basis is Art. 6(1)(f) GDPR, our legitimate interest in secure and stable delivery.

We have a data processing agreement with Cloudflare (Art. 28 GDPR). Cloudflare is certified under the EU-US Data Privacy Framework; transfers to the USA are based on the European Commission's adequacy decision (Art. 45 GDPR), supplemented by standard contractual clauses. Error and access logs of the worker are kept for at most seven days.

3. Cookies and consent

Only one cookie is necessary: cc_consent stores your choice in the cookie banner for twelve months (Section 25(2) no. 2 TDDDG, Art. 6(1)(f) GDPR). All other services in this policy are only loaded after you have agreed in the banner (Section 25(1) TDDDG, Art. 6(1)(a) GDPR). No analytics or advertising script is requested before you agree.

You can withdraw or change your consent at any time with effect for the future: open cookie settings. When you withdraw consent we delete the cookies of the affected services in your browser and reload the page.

4. Contacting us

If you contact us by email, phone or the contact form, we process your details (name, email address, message and time) to answer your request. The legal basis is Art. 6(1)(b) GDPR where a contract or pre-contractual steps are concerned, otherwise Art. 6(1)(f) GDPR. We delete the request once it has been dealt with, unless statutory retention obligations apply.

The contact form is received by our worker at Cloudflare and forwarded to our mailbox via Cloudflare Email Routing; it is not stored in the process. To protect against automated spam we use Cloudflare Turnstile on the contact page. Turnstile checks technical characteristics of your browser (e.g. IP address, browser details) to tell whether a human is using the form and does not set tracking cookies for this. The legal basis is Art. 6(1)(f) GDPR, our interest in a form free from abuse; provider and third-country transfer as in section 2.

Audience measurement with Matomo

With your consent we use Matomo, open-source software running on our own server in Germany, to measure how the site is used (pages viewed, time on site, source, shortened IP address). The data does not leave our server and is not passed on to third parties. The legal basis is your consent (Art. 6(1)(a) GDPR, Section 25(1) TDDDG). Raw data is deleted after 13 months at the latest.

Microsoft Clarity

With your consent we use Microsoft Clarity by Microsoft Ireland Operations Limited, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, Ireland. Clarity records how visitors interact with the site (mouse movements, clicks, scrolling) and creates heatmaps and session analyses; input in form fields is masked. Clarity sets cookies (_clck, _clsk, CLID) for up to one year. Data may be transferred to Microsoft in the USA; Microsoft is certified under the EU-US Data Privacy Framework. The legal basis is your consent (Art. 6(1)(a) GDPR, Section 25(1) TDDDG). More: privacy.microsoft.com.

Your rights

You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and the right to object to processing based on Art. 6(1)(f) GDPR on grounds relating to your particular situation (Art. 21). You can withdraw consent at any time with effect for the future (Art. 7(3)). Simply write to the email address above.

You can also lodge a complaint with a data protection supervisory authority. The authority responsible for us is the Bayerisches Landesamt für Datenschutzaufsicht (BayLDA), Promenade 18, 91522 Ansbach, www.lda.bayern.de.

No automated decision-making, including profiling, within the meaning of Art. 22 GDPR takes place.

Last updated: 9 November 2026 · Legal notice