Privacy policy

1. Controller

No data protection officer has been appointed, as the legal requirements for doing so are not met.

2. Hosting and delivery of the website

This website is delivered via Cloudflare Workers, provided by Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107, USA. When you visit the site, Cloudflare processes technically necessary data: IP address, date and time, requested URL, referrer, browser and operating system details. Without this data the site cannot be delivered or protected against attacks. The legal basis is Art. 6(1)(f) GDPR, our legitimate interest in secure and stable delivery.

We have a data processing agreement with Cloudflare (Art. 28 GDPR). Cloudflare is certified under the EU-US Data Privacy Framework; transfers to the USA are based on the European Commission's adequacy decision (Art. 45 GDPR), supplemented by standard contractual clauses. Error and access logs of the worker are kept for at most seven days.

3. Cookies and consent

Only one cookie is necessary: cc_consent stores your choice in the cookie banner for twelve months (Section 25(2) no. 2 TDDDG, Art. 6(1)(f) GDPR). All other services in this policy are only loaded after you have agreed in the banner (Section 25(1) TDDDG, Art. 6(1)(a) GDPR). No analytics or advertising script is requested before you agree.

You can withdraw or change your consent at any time with effect for the future: open cookie settings. When you withdraw consent we delete the cookies of the affected services in your browser and reload the page.

4. Contacting us

If you contact us by email, phone or the contact form, we process your details (name, email address, message and time) to answer your request. The legal basis is Art. 6(1)(b) GDPR where a contract or pre-contractual steps are concerned, otherwise Art. 6(1)(f) GDPR. We delete the request once it has been dealt with, unless statutory retention obligations apply.

Google Analytics 4

With your consent we use Google Analytics 4 by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Google sets cookies (_ga, _ga_*) for up to two years and records usage data such as pages viewed, time on site, approximate origin, device and browser details. IP addresses are shortened in the EU. Data may be transferred to Google LLC in the USA; Google is certified under the EU-US Data Privacy Framework. The legal basis is your consent (Art. 6(1)(a) GDPR, Section 25(1) TDDDG). Data is deleted after 14 months. More: policies.google.com/privacy.

Microsoft Clarity

With your consent we use Microsoft Clarity by Microsoft Ireland Operations Limited, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, Ireland. Clarity records how visitors interact with the site (mouse movements, clicks, scrolling) and creates heatmaps and session analyses; input in form fields is masked. Clarity sets cookies (_clck, _clsk, CLID) for up to one year. Data may be transferred to Microsoft in the USA; Microsoft is certified under the EU-US Data Privacy Framework. The legal basis is your consent (Art. 6(1)(a) GDPR, Section 25(1) TDDDG). More: privacy.microsoft.com.

Your rights

You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and the right to object to processing based on Art. 6(1)(f) GDPR on grounds relating to your particular situation (Art. 21). You can withdraw consent at any time with effect for the future (Art. 7(3)). Simply write to the email address above.

You can also lodge a complaint with a data protection supervisory authority. The authority responsible for us is the Bayerisches Landesamt für Datenschutzaufsicht (BayLDA), Promenade 18, 91522 Ansbach, www.lda.bayern.de.

No automated decision-making, including profiling, within the meaning of Art. 22 GDPR takes place.

Last updated: 29 October 2026 · Legal notice