Privacy Policy

1. Data Controller

The data controller is the natural or legal person who alone or jointly with others determines the purposes and means of the processing of personal data (e.g. names, email addresses, etc.).

2. Hosting and Content Delivery Network

Hetzner

This website is hosted by Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany. The servers are located in Germany. When you visit our website, Hetzner automatically collects information in server log files (browser type, operating system, referrer URL, IP address, time of access).

Legal basis: Art. 6 (1) (f) GDPR (legitimate interest in the reliable and secure provision of the website).

More information: Hetzner Privacy Policy

Cloudflare (CDN)

We use the Content Delivery Network (CDN) of Cloudflare, Inc., 101 Townsend St, San Francisco, CA 94107, USA. Cloudflare routes traffic between your browser and our server through its global network. Cloudflare may process your IP address and connection data in the process.

Legal basis: Art. 6 (1) (f) GDPR (legitimate interest in the secure and performant provision of the website).

Cloudflare is a certified participant in the EU-US Data Privacy Framework. More information: Cloudflare Privacy Policy

3. SSL/TLS Encryption

This website uses SSL or TLS encryption, recognizable by the lock icon in the browser bar and the "https://" protocol. This ensures that data you transmit to us cannot be read by third parties.

4. Cookies

This website uses only technically necessary cookies. No tracking, analytics or marketing cookies are used.

The following cookies are set:

• XSRF-TOKEN — Protection against Cross-Site Request Forgery attacks. Lifetime: 2 hours. Technically necessary.
• nick-heymann-session — Session management (e.g. for forms). Lifetime: 2 hours. Technically necessary, HttpOnly.

Legal basis: Art. 6 (1) (f) GDPR. These cookies are strictly necessary for the operation of the website. Consent is not required for these (§ 25 (2) TDDDG).

5. Contact Form

When you send us a message via the contact form, the following data is collected and stored in our database:

• Name
• Email address
• Project type (optional)
• Message
• Time of inquiry

Additionally, a notification email is sent to us (via Fastmail SMTP) and a confirmation email to the email address you provided. We do not share this data with third parties without your consent.

Purpose: Processing your contact inquiry and communication.

Legal basis: Art. 6 (1) (b) GDPR (pre-contractual measures) or Art. 6 (1) (f) GDPR (legitimate interest in processing inquiries).

Storage period: Your data will be deleted once the purpose of storage no longer applies (e.g. after completion of the inquiry), unless legal retention periods prevent this. You may request deletion of your data at any time.

6. Chatbot

A chatbot is available on this website through which you can send us messages. The following data is collected and stored in our database:

• Name (if provided)
• Email address (if provided)
• Message

For messages via the chatbot, an email notification is sent to us (via Fastmail SMTP).

Purpose: Answering your questions and communication.

Legal basis: Art. 6 (1) (f) GDPR (legitimate interest in efficient communication with prospective clients).

7. Newsletter

When you subscribe to our newsletter, your email address is stored in our database. The newsletter is only sent after you confirm your registration via double opt-in (you receive a confirmation email with a link that you must click).

Purpose: Sending information about our services and offers.

Legal basis: Art. 6 (1) (a) GDPR (consent).

Withdrawal: You can unsubscribe from the newsletter at any time. An unsubscribe link is included in every newsletter. After unsubscribing, your email address will be deleted immediately.

8. Exit Intent Form

When you are about to leave the website, a form may appear inviting you to leave your email address. Providing your information is voluntary.

Data collected: Email address. Stored in our database.

Purpose: Contacting you and sending relevant information.

Legal basis: Art. 6 (1) (a) GDPR (consent through active input).

9. Payment Processing (Stripe)

For payment processing, we use the service Stripe (Stripe, Inc., 354 Oyster Point Blvd, South San Francisco, CA 94080, USA). When making a booking, you will be redirected to Stripe for payment processing. Stripe receives the data necessary for the payment (e.g. name, email address, payment information, invoice amount).

We do not store any credit card or bank data ourselves. Payment processing is handled exclusively through Stripe's secure infrastructure.

Legal basis: Art. 6 (1) (b) GDPR (contract fulfillment).

Stripe is a certified participant in the EU-US Data Privacy Framework. More information: Stripe Privacy Policy

10. WhatsApp Link

This website contains a link through which you can contact us via WhatsApp. When you click the link, you will be redirected to WhatsApp (Meta Platforms Ireland Limited, 4 Grand Canal Square, Dublin 2, Ireland).

We do not transmit any data to WhatsApp/Meta. Data transfer only occurs through your active click and subsequent use of WhatsApp. The WhatsApp Privacy Policy applies there.

Legal basis: Art. 6 (1) (a) GDPR (consent through active click).

11. Google Analytics 4

This website uses Google Analytics 4 (GA4), a web analytics service provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (Measurement ID: G-8N296X3CDT).

GA4 uses cookies to analyze website usage. Collected data includes page views, scroll depth, clicks on call-to-action elements and video playback, among others. Google Analytics is configured to anonymize IP addresses (IP masking). Your IP address is truncated within the EU/EEA before being transmitted to Google servers.

Additionally, for certain actions (e.g. contact form submission, newsletter signup), server-side events are sent via the GA4 Measurement Protocol. No IP address is transmitted to Google in this process.

Legal basis: Art. 6 (1) (f) GDPR (legitimate interest in analyzing user behavior to optimize the website).

Google is a certified participant in the EU-US Data Privacy Framework. More information: Google Privacy Policy. You can prevent data collection by Google Analytics by installing the browser opt-out add-on.

11a. Google Ads Conversion Tracking

This website uses Google Ads conversion tracking, a service provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. When you submit an enquiry via our contact form, a so-called conversion event is sent to Google. This allows us to measure how many users submitted an enquiry after clicking on one of our ads.

The data transmitted consists of technical information about the triggered event (e.g. whether an enquiry was submitted) and a cookie value set by Google. No content you entered in the form (name, message) is transmitted to Google.

Legal basis: Art. 6 (1) (f) GDPR (legitimate interest in measuring and optimising our advertising).

Google is a certified participant in the EU-US Data Privacy Framework. Further information: Google Privacy Policy.

12. Fonts (Local Hosting)

This website uses the fonts Space Grotesk and Inter. The fonts are installed locally on our server and loaded from there. No connection to external servers (e.g. Google) is made. Your IP address is not transmitted to third parties.

13. Social Media

Instagram

This website contains links to our Instagram profile (@nick.heymann). These are simple hyperlinks — no social media plugins or tracking pixels are embedded. When you click the link, you leave our website and are redirected to Instagram (Meta Platforms Ireland Limited). The Meta Privacy Policy applies there. Data transfer only occurs through your active click.

14. Video Hosting

Videos embedded on this website are hosted on our own server at Hetzner in Germany. No external video platforms (e.g. YouTube, Vimeo) are integrated. No data is transmitted to third parties when playing a video.

15. General Storage Period

Unless a more specific storage period has been stated in this privacy policy, your personal data will remain with us until the purpose for data processing no longer applies. If you assert a legitimate request for deletion or revoke consent, your data will be deleted unless there are other legally permissible reasons for storage (e.g. tax or commercial law retention periods).

16. Your Rights

Under the GDPR, you have the following rights:

• Access (Art. 15 GDPR) — You can request information about your data stored with us.
• Rectification (Art. 16 GDPR) — You can request the correction of inaccurate data.
• Erasure (Art. 17 GDPR) — You can request the deletion of your data, provided there are no legal retention obligations.
• Restriction of processing (Art. 18 GDPR) — You can request the restriction of processing of your data.
• Data portability (Art. 20 GDPR) — You can request that your data be transmitted to you or a third party in a machine-readable format.
• Objection (Art. 21 GDPR) — You can object to the processing of your data based on Art. 6 (1) (f) GDPR at any time.
• Withdrawal of consent (Art. 7 (3) GDPR) — You can withdraw any consent given at any time. The lawfulness of processing carried out prior to the withdrawal remains unaffected.

To exercise your rights, contact: [email protected]

17. Right to Lodge a Complaint with a Supervisory Authority

If you believe that the processing of your personal data violates the GDPR, you have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR).

The supervisory authority responsible for us is:
The Hamburg Commissioner for Data Protection and Freedom of Information
Ludwig-Erhard-Str. 22, 7th floor
20459 Hamburg, Germany
https://datenschutz-hamburg.de

Last updated: March 2026