Privacy Policy

1. Controller

The controller within the meaning of the General Data Protection Regulation (GDPR) for this website is:

2. The short version

We only process personal data where it is necessary to deliver this website, to answer your enquiries and to understand in aggregate how the site is used. This website sets no cookies, shows no advertising, does not embed social media plugins and does not build user profiles. All fonts are served from our own domain.

3. Hosting and delivery (Cloudflare)

This website is delivered via the global network of Cloudflare, Inc., 101 Townsend Street, San Francisco, CA 94107, USA. Whenever a page or file is requested, Cloudflare necessarily processes the connection data your browser transmits: IP address, date and time of the request, the requested URL, the referrer URL, browser type and version, operating system, and the amount of data transferred. This data is used to deliver the website, to keep it stable and to protect it against attacks. It is kept in log files only for a short period and is not combined with other data sources.

Legal basis: Art. 6 (1) (f) GDPR. Our legitimate interest is the secure, fast and reliable provision of this website. A data processing agreement in accordance with Art. 28 GDPR is in place with Cloudflare. For transfers to the USA, see section 10.

4. Video delivery (bunny.net)

Some videos on this website are delivered by the content delivery network of BunnyWay d.o.o., Dunajska cesta 165, 1000 Ljubljana, Slovenia (bunny.net). When such a video is loaded, bunny.net processes your IP address and technical connection data (such as browser type and time of the request) in order to deliver the file. bunny.net is based in the European Union.

Legal basis: Art. 6 (1) (f) GDPR. Our legitimate interest is the fast and reliable delivery of video content. A data processing agreement in accordance with Art. 28 GDPR is in place with BunnyWay.

5. Contact form and email

If you contact us via the contact form, we process the data you enter — your name, email address, company, the topics you select and your message — in order to handle your enquiry. The form is transmitted in encrypted form to our own website, which runs on Cloudflare (see section 3), and the resulting email is sent to us via the email service Resend, operated by Plus Five Five, Inc., 2261 Market Street #5039, San Francisco, CA 94114, USA. Both providers process the form contents and technical connection data including the IP address solely for this purpose. We do not store your enquiry on the website itself.

If you write to us by email, we process your email address and the contents of your message. Our mailboxes are hosted by Microsoft Ireland Operations Limited, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, Ireland (Microsoft 365).

Legal basis: Art. 6 (1) (b) GDPR where your enquiry relates to a contract or steps prior to entering into a contract, otherwise Art. 6 (1) (f) GDPR (our legitimate interest in answering enquiries). Data processing agreements in accordance with Art. 28 GDPR are in place with the providers named above. For transfers to the USA, see section 10.

We delete enquiries once they have been dealt with conclusively and no statutory retention obligations apply. Business correspondence is subject to statutory retention periods of six years and, where relevant for tax purposes, up to ten years (§ 257 HGB, § 147 AO).

6. Web analytics (Umami Cloud)

To understand in aggregate how this website is used, we use Umami Cloud, a service of Umami Software, Inc., USA. Umami works without cookies and does not store or read any information on your device. It does not recognise visitors across websites or devices and creates no user profiles.

When a page is viewed, the following is recorded: the page visited, the referrer, browser, operating system, device type, language, and an approximate location (country/region) derived from the IP address. The IP address itself is not stored. To count visits, Umami computes a non-reversible hash from the IP address, browser information and website together with a regularly changing salt value, so that visitors cannot be identified or recognised over longer periods.

The analytics data is processed and stored in Umami Cloud's EU data region. As the provider is based in the USA, section 10 applies in addition.

Legal basis: Art. 6 (1) (f) GDPR. Our legitimate interest is privacy-friendly reach measurement to improve this website. As no information is stored on or read from your device, consent under § 25 TDDDG is not required. A data processing agreement in accordance with Art. 28 GDPR is in place with the provider. If your browser sends a “Do Not Track” signal, your visit is not recorded at all. You can also object to this processing at any time (see section 12).

7. Cookies and storage on your device

This website does not set any cookies. The only information stored on your device is a single technical entry in your browser's session storage, which notes that the intro animation of the home page has already been played so that it is not shown again on every page change. The entry contains no personal data, is not transmitted to us and is deleted automatically when you close the browser tab.

Legal basis: § 25 (2) no. 2 TDDDG. The storage is strictly necessary to display the website in the way you have requested it.

8. Links to other websites

This website contains plain links to other websites, for example to our LinkedIn profile or to the social media profiles of clients. No data is transmitted to these providers until you click such a link. Once you do, the privacy policy of the respective provider applies.

9. Encryption

For security reasons, this website uses TLS encryption. You can recognise an encrypted connection by “https://” in your browser's address bar.

10. Transfers to third countries (USA)

Cloudflare, Resend (Plus Five Five, Inc.) and Umami are operated by companies based in the USA, which means that personal data may be processed there. Transfers are based on the adequacy decision of the European Commission for the EU-US Data Privacy Framework (Art. 45 GDPR) where the respective provider is certified under it, and otherwise on the Standard Contractual Clauses of the European Commission (Art. 46 (2) (c) GDPR) as appropriate safeguards. You can request a copy of these safeguards from us using the contact details in section 1.

11. Your rights

Under the GDPR you have the following rights with regard to your personal data:

• Right of access (Art. 15 GDPR)
• Right to rectification (Art. 16 GDPR)
• Right to erasure (Art. 17 GDPR)
• Right to restriction of processing (Art. 18 GDPR)
• Right to data portability (Art. 20 GDPR)
• Right to object (Art. 21 GDPR, see section 12)
• Right to withdraw consent at any time with effect for the future (Art. 7 (3) GDPR), where processing is based on consent

To exercise your rights, an informal message to verena (at) gezeiten-design.com is sufficient.

You also have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR), in particular in the EU member state of your habitual residence, your place of work or the place of the alleged infringement. The authority responsible for us is:

12. Right to object (Art. 21 GDPR)

Where we process your personal data on the basis of Art. 6 (1) (f) GDPR, you have the right to object to this processing at any time on grounds relating to your particular situation. We will then no longer process the data concerned unless we can demonstrate compelling legitimate grounds which override your interests, rights and freedoms, or the processing serves the establishment, exercise or defence of legal claims.

To object, an informal message to verena (at) gezeiten-design.com is sufficient.

13. Obligation to provide data, automated decisions

You are neither legally nor contractually obliged to provide us with personal data. Without the technical connection data described in section 3, however, the website cannot be delivered, and without your contact details we cannot answer an enquiry. We do not use automated decision-making, including profiling, within the meaning of Art. 22 GDPR.

14. Changes to this privacy policy

This privacy policy was last updated in September 2026. We will adapt it whenever the website or the legal requirements change. The current version is always available on this page.