Privacy Policy

1. Controller

Responsible for data processing on this website:

Frank Liebe
Stettinerstr. 9
24223 Schwentinental, Germany
Email: frankliebe@gmx.com

2. General Information

We take the protection of your personal data very seriously. All data is processed in accordance with the General Data Protection Regulation (GDPR) and the German Federal Data Protection Act (BDSG). This privacy policy provides a complete and transparent description of what data we collect, why we collect it, how long we retain it, and what rights you have.

3. Contact Form

When you submit our contact form, the following data is processed:

• Name
• Email address
• Company (optional)
• Website (optional)
• Subject
• Topic of inquiry
• Urgency
• Message
• Anonymized IP hint / User-Agent (for abuse detection)

Legal Basis: Art. 6 para. 1 lit. a GDPR (consent) and Art. 6 para. 1 lit. b GDPR (pre-contractual measures).

Retention Period: 30 days after response or archival, then automatically deleted.

Recipients: Website administrator only. No sharing with third parties.

4. Visitor Analytics & Statistics (Opt-in)

This website collects anonymized usage data — only after your explicit consent in the cookie banner — to operate and improve the website. No personal data is stored permanently; in particular, no IP address is saved in our database.

4.1 Visitor Log

Upon each page visit (only with consent), we store:

• Visited path (e.g. /)
• Referrer URL (where you came from)
• Anonymous session ID (randomly generated, not personal)
• Browser language
• Screen resolution (e.g. 1920×1080)
• Truncated User-Agent (max. 200 characters, for device classification)
• Geo-location data: city and country via GeoIP lookup (see 4.3)
• Visitor type: human or crawler

Legal Basis: Art. 6 para. 1 lit. a GDPR (consent).
Retention Period: 90 days, then automatically deleted.

4.2 Section Heatmap & Click Tracking

With your consent, we also record which sections of the website you have viewed, whether and how often you clicked within a section, and how long you remained in a section (dwell time in milliseconds). This data helps us improve the website structure.

• Section name (e.g. "hero", "services", "contact")
• Event type: view or click
• Dwell time in milliseconds (only for views > 500 ms)
• Anonymous session ID
• Visited path

Legal Basis: Art. 6 para. 1 lit. a GDPR (consent).
Retention Period: 180 days, then automatically deleted.

4.3 GeoIP Lookup via ip-api.com

To provide geographic visitor statistics (country, city), the visitor's IP address is forwarded server-side to the service ip-api.com (Pro Web Media Ltd., United Kingdom). ip-api.com returns only city, country, and coordinates — the IP address itself is not stored by us. The lookup occurs only for human visitors (not crawlers) and only when analytics consent has been granted.

Third-country transfer: ip-api.com processes requests on EU/UK servers. No transfer to the USA takes place.
Legal Basis: Art. 6 para. 1 lit. a GDPR (consent).
ip-api.com Privacy Notice: https://ip-api.com/docs/legal

5. Google reCAPTCHA v3

This website uses Google reCAPTCHA v3 (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland) to protect forms from spam and abuse. reCAPTCHA is only loaded after your explicit consent in the cookie banner.

Data Processed: IP address, user agent, usage behaviour (analyzed invisibly in the background).

Third-country transfer: Data may be transferred to Google LLC in the USA. Google is certified under the EU-US Data Privacy Framework.

Legal Basis: Art. 6 para. 1 lit. a GDPR (consent).
Google Privacy Policy: https://policies.google.com/privacy
Google Terms of Service: https://policies.google.com/terms

6. Security Measures (Art. 32 GDPR)

We implement the following technical and organisational measures (TOMs):

• Role-based access & Row-Level Security (only admins can view analytics data)
• XSS and injection protection on all forms
• Rate limiting and automatic IP blocking on attack attempts
• Anonymous logging — no IP addresses stored in the database
• Automatic deletion of logs after 90 / 180 days
• Cookie consent management: analytics and reCAPTCHA only after opt-in

7. Cookies & Consent

This website sets no third-party tracking cookies without your consent. In the cookie banner you can choose between:

• Necessary: Technically required functions (always active, no external transfer)
• Analytics & Visitor Tracking: Anonymous visitor log, section heatmap and GeoIP lookup (opt-in)
• reCAPTCHA v3: Spam protection for forms via Google (opt-in)

You can withdraw your consent at any time via the "Cookie Settings" link in the footer.

8. Your Rights (Art. 15–21 GDPR)

You have the right to:

• Access your stored data (Art. 15 GDPR)
• Rectify inaccurate data (Art. 16 GDPR)
• Erase your data (Art. 17 GDPR)
• Restrict processing (Art. 18 GDPR)
• Data portability (Art. 20 GDPR)
• Object to processing (Art. 21 GDPR)
• Withdraw consent with effect for the future (Art. 7 para. 3 GDPR)

For GDPR requests, contact: frankliebe@gmx.com (subject: "GDPR Request"). We will respond within 30 days.

9. Data Processors and Sub-processors

The following services process data on our behalf:

• Base44 – Backend-as-a-Service (data storage, function execution). Privacy: https://base44.com/
• Google Ireland Limited – reCAPTCHA v3 (spam protection, only with consent). Privacy: https://policies.google.com/privacy
• ip-api.com (Pro Web Media Ltd.) – GeoIP lookup for location statistics (only with consent, IP not stored). Privacy: https://ip-api.com/docs/legal

10. Right to Lodge a Complaint

You have the right to lodge a complaint with a supervisory authority.

Competent Authority: Independent Centre for Privacy Protection Schleswig-Holstein (ULD)
Holstenstraße 98, 24103 Kiel, Germany
Phone: +49 (0) 431 988-1200
Email: mailbox@datenschutz.schleswig-holstein.de

11. Changes to This Privacy Policy

We reserve the right to update this privacy policy as needed. The current version is always available on this page. Last updated: May 2026.