Privacy

Controller

Website and hosting

Requests to this website involve connection data such as IP address, time, requested URL, browser and device information. These support website delivery, fault diagnosis and security (Article 6(1)(f) GDPR; our interest in a secure, functioning service). Cloudflare (Cloudflare, Inc., USA) provides hosting, delivery, database and file storage. Processing may also occur outside the EU. Cloudflare describes safeguards and standard contractual clauses in its privacy and data-processing documentation. An EU database location alone does not guarantee exclusively European processing.

Inquiries and contracts

We process the business and contact details, project preferences, material readiness, preferred dates and confirmations you submit to review the inquiry and prepare a possible contract (Article 6(1)(b) GDPR). For contacts acting for a legal entity, Article 6(1)(f) supports handling business inquiries. Required fields help us assess your inquiry and contact you; the form cannot be submitted without them. An inquiry does not form a contract. Acceptance and scheduling are assessed personally, rather than decided solely by automated processing.

Project portal and email

The portal processes materials, files, approvals, revisions and project messages needed for your project. Emails provide receipts, status and access notifications, and contract or invoice communications through STRATO. Email addresses and the details needed for each message are processed by the email provider. Do not enter passwords in the public form. Project information is not used for newsletter marketing.

Browser storage and security

The inquiry form stores its draft in your browser localStorage so you can continue an input session you started. Remove it through the discard-draft function or your browser site-data settings; it is removed after successful submission. Sign-in and project access use technically necessary session and access data. To limit abusive requests, the application stores short-lived HMAC identifiers derived from the IP address rather than a plain IP in the inquiry database (Article 6(1)(f) GDPR). Hosting providers may still process connection data.

Retention and recipients

We review necessity while handling an inquiry and when placing it on hold or closing it. If no contract follows, we delete it after necessary follow-up is complete; data no longer needed is deleted without undue delay. Any necessary further follow-up has a documented purpose and deletion review date. Legal obligations or the necessary protection of claims justify only the required scope and period, with a separate reason and review date. Original inquiries, processing history and delivery logs are deleted from the database after administrative review, not automatically on a fixed day. Sent emails, mailboxes and manually exported backups require separate cleanup; provider logs and backups follow their respective deletion procedures. Required contract and tax records follow applicable statutory retention criteria (Article 6(1)(c) GDPR). Technical providers and any appointed tax adviser receive only data needed for their purpose.

Your rights

Subject to legal conditions, you may request access, correction, deletion, restriction and data portability. You may object to processing based on legitimate interests for reasons relating to your particular situation. Any consent can be withdrawn for the future. Contact kontakt@joanwebstudio.de. You may complain to a data-protection authority, including the Bavarian State Office for Data Protection Supervision (BayLDA).