Privacy policy

Franz Pappelbaum — Pappelbaum Design
Ihmelsstraße 11, 04315 Leipzig
Phone: 0176 44272141 · Email: franz@pappelbaum-design.de

This website is operated on servers of Hetzner Online GmbH (Industriestr. 25, 91710 Gunzenhausen, Germany). A data processing agreement pursuant to Art. 28 GDPR is in place with Hetzner.

When the site is accessed, the server automatically processes technical access data (IP address, date and time, page accessed, browser identifier). These logs serve security and error analysis (legal basis: Art. 6(1)(f) GDPR — legitimate interest in secure operation) and are deleted after 14 days at the latest.

Fonts are loaded locally from this server (no connection to Google Fonts or other font services). Preview images of reference and demo websites are generated and cached on the server — your browser loads them exclusively from this server, not from third parties.

To understand which pages work well, I count page views, clicks on the “Webseite bestellen” (order a website) button and progress through the briefing questionnaire — exclusively as anonymous daily totals (e.g. “Page X was viewed 12 times today”). No cookies are set, nothing is stored in the browser, no IP address and no browser identifier are stored, and no visitor profiles or recognition features are created. The counting runs entirely on my own server; a personal reference cannot be established at any time. The legal basis for this purely statistical processing is Art. 6(1)(f) GDPR (legitimate interest in improving the offering); since no information on the end device is accessed, no consent pursuant to § 25 of the German Telecommunications Digital Services Data Protection Act (TDDDG) is required.

If you send a website briefing via the enquiry form, I process the data you provide there (name, email address, details about your business and project, optionally uploaded files such as logos). The sole purpose is to handle your enquiry and prepare the contract (legal basis: Art. 6(1)(b) GDPR — pre-contractual measures taken at your request).

Storage period: If no contract is concluded and you don't get back in touch, your enquiry is archived after 60 days and completely deleted after 90 days. After a termination, your project data is kept for 30 days (in case you come back or want to export your content) and deleted afterwards. Statutory retention obligations (e.g. for invoices) remain unaffected.

I use AI tools to support the building of websites. Your personal data (name, address, contact details, files) is not transmitted to AI services in the process — beforehand, an automated procedure replaces it with neutral placeholders, which are only filled back in locally.

To protect the forms against automated abuse, I use Cloudflare Turnstile (Cloudflare, Inc., USA). Turnstile checks whether an entry comes from a human and, for this purpose, processes technical characteristics of the browser as well as the IP address. No advertising or tracking cookies are set. The legal basis is Art. 6(1)(f) GDPR (legitimate interest in protection against spam and abuse). Cloudflare is certified under the EU-US Data Privacy Framework; in addition, standard contractual clauses are in place.

As a customer, you log in without a password via a magic link: you receive an email with a one-time, time-limited login link. It is sent via IONOS SE (Elgendorfer Str. 57, 56410 Montabaur, Germany) as processor.

After login, the customer dashboard sets a technically necessary session cookie that keeps you logged in (storage period: 30 days). There are no marketing, analytics or third-party cookies — which is why there is no cookie banner either. Legal basis: Art. 6(1)(b) GDPR (performance of the contract) or § 25 para. 2 no. 2 TDDDG (strictly necessary).

Content stored in the dashboard (messages, files, change requests) is processed exclusively for the performance of the contract. Uploaded files can only be accessed by you (after login) and by me.

Payments are processed via Stripe (Stripe Payments Europe, Ltd., 1 Grand Canal Street Lower, Dublin, Ireland). In doing so, Stripe processes the data required for the payment (name, email, payment details) partly under its own responsibility — details in Stripe's privacy policy. I myself do not store any credit card or bank account details. Legal basis: Art. 6(1)(b) GDPR.

If you send me an email, I process your details in order to answer the message (Art. 6(1)(b) or (f) GDPR). Emails run via IONOS (server location Germany).

You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and to object to processing based on legitimate interests (Art. 21). You can withdraw consent you have given at any time with effect for the future.

An informal email to franz@pappelbaum-design.de is all it takes. You also have the right to lodge a complaint with a data protection supervisory authority — the authority responsible for me is the Saxon Data Protection Commissioner (Sächsischer Datenschutzbeauftragter, datenschutz.sachsen.de).

Last updated: July 2026. I will adapt this policy if the technology or the legal situation changes.