Privacy policy

1. Controller

The controller for data processing on this website is:
Fabian Westhäußer
Burckhardtstraße 65
70374 Stuttgart
Germany
Email: fabian@westhaeusser.com

2. Hosting and server logs

This website is hosted on a VPS operated by IONOS SE, Elgendorfer Straße 57, 56410 Montabaur, Germany. When you visit the website, the server processes technically necessary access data, including IP address, date and time, requested address, transferred data volume, HTTP status code, referrer URL, browser, and operating system.

We process this data to deliver the website and maintain its security and stability, including investigating misuse. The legal basis is Art. 6(1)(f) GDPR. Server logs are deleted after 30 days unless they are required longer to investigate a security incident.

3. Contact form and other contact

When you use the contact form or contact us by email or telephone, we process the information you provide. The contact form collects your name, email address, and message. We use this information solely to answer your enquiry and document the communication.

The legal basis is Art. 6(1)(f) GDPR. Where an enquiry relates to entering into or performing a contract, Art. 6(1)(b) GDPR also applies. Contact-form requests are delivered by email through IONOS SE as a processor. We delete the data once the enquiry is fully resolved, unless statutory retention duties or legitimate evidential interests require further storage.

Providing your details is neither a statutory nor contractual requirement and is not necessary to enter into a contract. However, we cannot answer your enquiry through the contact form without the fields marked as required.

4. Audience measurement with a self-hosted Plausible instance

For privacy-friendly, aggregated audience measurement we use the Plausible Analytics software. We run it as our own instance (Plausible Community Edition) on our own server at IONOS SE in Spain (Logroño). No analytics provider receives any data: the statistics never leave our own infrastructure.

Our instance is configured so that it uses no cookies, no local storage, and no persistent identifiers. It does not create user profiles or track individual visitors across websites.

For statistics we process information such as visited pages, referrers, approximate country, browser, operating system, and device type. The IP address and user agent are used solely for a daily, non-reversible technical count and are not stored. The processor operating this instance is IONOS SE, the same processor as for the rest of the website.

This processing serves our legitimate interest in understanding and improving this website’s use and technical quality, pursuant to Art. 6(1)(f) GDPR. Because our instance stores no information on your device and reads no information stored there, section 25(1) TDDDG does not apply, and we do not use a consent banner for this measurement.

Plausible Community Edition is free software licensed under the GNU Affero General Public License v3 (AGPL-3.0). We run it unmodified; the complete source code of the software we use is published by its developers at github.com/plausible/analytics .

5. Recipients

Where necessary to operate this website, we use IONOS SE for hosting, email delivery, and operating the analytics instance. There are no other recipients of personal data. Where required, we enter into data-processing agreements with processors under Art. 28 GDPR.

6. Retention periods

We delete personal data as soon as the purpose of storing it no longer applies and neither a statutory retention duty nor a legitimate evidential interest stands in the way. The periods stated above apply to the individual processing activities, for example 30 days for server logs.

Statutory retention duties apply in particular under section 147 AO: to commercial letters (section 147(1) no. 2, (3) AO; 6 years) and to invoices and accounting records (section 147(3) AO; 8 years; this period was shortened from ten to eight years with effect from 1 January 2025). Once the applicable period expires, the data is deleted unless storage remains necessary to perform a contract.

7. Transfers to third countries

The processing activities described in this statement take place exclusively on servers within the European Union: the website and email delivery in Germany, and the self-hosted Plausible instance in Spain. No personal data is transferred to a country outside the EU or the EEA in the course of them. Should such a transfer become necessary in future, it will take place only under the conditions of Art. 44 et seq. GDPR, in particular on the basis of a European Commission adequacy decision or appropriate safeguards such as the standard contractual clauses.

8. Your rights

Subject to the GDPR’s conditions, you have the right to access, rectification, erasure, restriction of processing, data portability, and to object to processing based on Art. 6(1)(f) GDPR. You may withdraw consent at any time with future effect. To exercise your rights, contact us at the email address above.

You also have the right to lodge a complaint with a data-protection supervisory authority. Our competent authority is the Baden-Württemberg Commissioner for Data Protection and Freedom of Information .

9. Automated decisions

We do not make automated decisions, including profiling, within the meaning of Art. 22 GDPR.

Last updated: August 2026