Privacy Policy

This English version is provided for convenience. Only the German versionGerman version is legally binding.

The controller responsible for processing personal data on this website is:

Sven Heynhold
Heynhold Web & Media – HWM Agentur

Email:

info@hwm-agentur.deinfo@hwm-agentur.de

Phone:

+49 (0) 163 5745562+49 (0) 163 5745562

You can contact us directly with any data protection concerns and to exercise your rights.

Our website is provided via Vercel. The provider is Vercel Inc., 440 N Barranca Avenue #4133, Covina, CA 91723, USA. Vercel operates the infrastructure for delivering and securing the website.

When you visit the site, technically necessary connection data is processed. This includes in particular your IP address, time and target of the request, amount of data transferred, HTTP status and information transmitted by the browser about the browser, operating system and, where applicable, the previously visited page (referrer). This data may be recorded in operational and security logs.

The processing serves to deliver the website, keep it stable, analyse errors and prevent misuse. The legal basis is Art. 6(1)(f) GDPR. Our legitimate interest lies in secure and reliable operation. Without transmitting the data required for the connection, the website cannot be accessed.

Vercel and the infrastructure service providers it uses receive the data required for provision. Vercel describes the processing in its Data Processing AddendumData Processing Addendum and its privacy noticeprivacy notice.

[To be completed before publication: the actual retention period of access, error and security logs, including any log exports set up. Review the data processing agreement under Art. 28 GDPR applicable to the Vercel plan in use and confirm its inclusion.]

Vercel uses an international infrastructure. Personal data may therefore also be processed outside the European Union or the European Economic Area, in particular in the USA.

Vercel states that it participates in the EU-US Data Privacy Framework. Insofar as its requirements are met for the transfer in question, the European Commission's adequacy decision serves as the basis under Art. 45 GDPR. For other covered transfers, Vercel's Data Processing Addendum provides for EU standard contractual clauses under Art. 46 GDPR. Information on these safeguards is available via the Vercel documents linked above or from us on request.

When you contact us, we process the contact details you provide, the content of your request and any attached documents. Emails also generate technical delivery information. We use this information to handle your request and communicate with you.

For requests relating to a contract or pre-contractual measures, the legal basis is Art. 6(1)(b) GDPR. We handle other requests on the basis of Art. 6(1)(f) GDPR; our legitimate interest is answering incoming requests. Providing the information is voluntary. Without sufficient information or a way to contact you, we may not be able to handle your request.

We use email and telecommunications service providers to transmit and manage communications. Within our company, only people who need access to handle the request are given it.

[To be completed before publication: provider of the email mailbox with name, address and privacy notice; where applicable, processing outside the EEA and the related transfer safeguards.]

We delete the correspondence once the request is complete and the data is no longer needed. Statutory retention obligations, for example for business correspondence or accounting records, as well as retention required to assert or defend legal claims, remain taken into account. In these cases, we restrict further use to the respective purpose.

Through the contact form, the project planner and appointment booking, we process the information you enter there: name and email address; for the project planner, also your selection of project type, features, scope, timeline and budget range; for appointment booking, the chosen date, the preferred format of the call and, for an on-site appointment, the address you provide. We only process optional fields such as company, phone number and message if you fill them in.

For requests relating to a contract or pre-contractual measures, the legal basis is Art. 6(1)(b) GDPR. We handle other requests on the basis of Art. 6(1)(f) GDPR; our legitimate interest is answering incoming requests.

After submitting, you receive a confirmation by email, and we receive a notification of receipt.

We delete the information once the request is complete and it is no longer needed. Statutory retention obligations remain taken into account.

We store the information submitted via the forms in a database at Supabase. The provider is Supabase, Inc., 970 Toa Payoh North #07-04, Singapore 318992.

The database is accessed exclusively via our servers. Visitors to the website have no access. Within our company, only people who need access to handle requests are given it; this access is password-protected and limited to named accounts.

The legal basis is Art. 6(1)(b) or (f) GDPR, depending on the respective request.

Further information can be found in Supabase's privacy policySupabase's privacy policy and the Data Processing AddendumData Processing Addendum.

[To be completed before publication: chosen region of the Supabase project and the resulting storage location; confirm conclusion of the data processing agreement under Art. 28 GDPR; for a region outside the EEA, add the transfer safeguards under Art. 44 et seq. GDPR.]

To receive our newsletter, we need your email address. We do not ask for any further information.

Subscription uses the double opt-in procedure. After you sign up, we send you an email with a confirmation link. Only when you open this link do we add your address to the mailing list. If you do not confirm within 48 hours, the link expires. You will not receive a newsletter until you confirm.

To prove consent under Art. 7(1) GDPR, we store the time of subscription and confirmation, the source of the subscription, the shortened IP address and the browser identifier. The IP address is shortened by the last address block so that it can no longer be directly attributed to a person.

The legal basis is your consent under Art. 6(1)(a) GDPR. We base the storage of the proof data on Art. 6(1)(c) and (f) GDPR; our legitimate interest lies in being able to prove the consent given.

You can withdraw your consent at any time with effect for the future. The unsubscribe link at the end of every newsletter email is sufficient; alternatively, an informal message to us is enough. The lawfulness of processing carried out before withdrawal remains unaffected.

After you unsubscribe, we remove your address from the mailing list. We keep it as a block entry so that it is not contacted again. On request, we will also delete this entry completely.

The website does not use analytics or marketing cookies. No tracking pixels and no Vercel Speed Insights are embedded. To measure reach, we use Vercel Web Analytics, which works without cookies (see below). The site search processes your input in the browser and does not transmit it to a search service.

Fonts as well as the service videos and their preview images are delivered via our website. Blog images are provided via server-side image optimisation; your browser retrieves them via our domain. No external font providers or video players are embedded.

Your browser may cache files for display. Insofar as storing information on or accessing information from your device is strictly necessary to provide the website you have explicitly requested, § 25(2) No. 2 TDDDG applies. Any further processing of personal data is governed by the GDPR legal bases stated here.

To understand how our website is used, we use Vercel Web Analytics. The provider is Vercel Inc., 440 N Barranca Avenue #4133, Covina, CA 91723, USA, which also provides our website.

Vercel Web Analytics does not set cookies and does not store any information on your device. It records the page visited, the referring page, the time, approximate location at country level and information about the operating system, browser and device type. Visitors are distinguished by a hash of request data which, according to Vercel, is discarded after 24 hours. There is no recognition across several days or websites, and we do not receive any IP addresses.

We only see aggregated statistics, such as which pages are viewed how often and through which sources visitors come to us. The legal basis is Art. 6(1)(f) GDPR. Our legitimate interest lies in improving our offering and measuring the reach of our website.

The information in the hosting section applies to data transfers to the USA and to the data processing agreement. Further information can be found in Vercel's documentation on privacy in Web AnalyticsVercel's documentation on privacy in Web Analytics.

To protect our contact and newsletter forms from automated input and misuse, we use Cloudflare Turnstile. The provider is Cloudflare, Inc., 101 Townsend Street, San Francisco, CA 94107, USA.

Turnstile uses technically necessary signals to check whether an input probably comes from a human or an automated program. In particular, the IP address, characteristics of the TLS connection, browser information, the site key used and the requesting origin may be processed. The content of the form fields is not transmitted to Turnstile.

The processing serves the security of our website and the prevention of unwanted messages. The legal basis is Art. 6(1)(f) GDPR. Our legitimate interest lies in protecting our forms and technical systems from spam and automated misuse.

Further information can be found in the Cloudflare Turnstile privacy addendumCloudflare Turnstile privacy addendum.

Our links to Instagram, LinkedIn and the Google Business Profile are simple references. No social media feeds or social plugins are embedded. Only when you open such a link do you access the respective service. Its privacy notice applies to data processing there.

We process personal data only for as long as necessary for the stated purposes. If the purpose no longer applies and no statutory retention obligation or other permissible reason for retention stands in the way, the data is deleted. Where retention obligations exist, the legal basis is Art. 6(1)(c) GDPR. The respective duration depends on the type of records and the applicable statutory obligation.

The publicly provided website uses HTTPS to encrypt the connection between your browser and our hosting infrastructure.

We do not carry out automated decision-making with legal or similarly significant effects, including profiling under Art. 22 GDPR.

Subject to the respective legal requirements, you have the following rights:

• Access to information about the processing of your personal data and a copy of this data (Art. 15 GDPR).
• Rectification of inaccurate data and completion of incomplete data (Art. 16 GDPR).
• Erasure of your data (Art. 17 GDPR) or restriction of its processing (Art. 18 GDPR).
• Data portability, where processing is based on consent or a contract and carried out by automated means (Art. 20 GDPR).
• Withdrawal of consent given, with effect for the future. The lawfulness of processing until withdrawal remains unaffected (Art. 7(3) GDPR).

If we process your data on the basis of Art. 6(1)(f) GDPR, you can object at any time on grounds relating to your particular situation (Art. 21 GDPR).

We will then no longer process the data concerned unless we can demonstrate compelling legitimate grounds that override your interests, rights and freedoms, or the processing serves to assert, exercise or defend legal claims. You can object to processing for direct marketing at any time without giving specific reasons.

An informal message to the email address above is sufficient.

Under Art. 77 GDPR, you can lodge a complaint with a data protection supervisory authority, in particular in the member state of your habitual residence, your place of work or the place of the suspected infringement. The authority responsible for our registered office in North Rhine-Westphalia is:

Contact the LDI NRWContact the LDI NRW

As of 24 September 2026. We will update this policy if our website or the services used change.

Further company information can be found in the legal noticelegal notice.