Privacy Policy

1 Controller

2 Hosting

Legal basis: Art. 6(1)(f) GDPR (legitimate interest in providing the website).

3 Server log files

When you visit this website, the hosting provider automatically records the following data in server log files: IP address, date and time, page accessed, browser type and version, operating system, referrer URL.

This data is not merged with other data sources. Legal basis: Art. 6(1)(f) GDPR. The legitimate interest lies in the security and stability of the website.

4 Cookies & consent management

This website uses cookies and similar technologies where technically necessary for operation or where you have given your consent.

Categories

Consent management (CookieScript)

CookieScript is used to manage consent. CookieScript stores your consent decision in your browser and automatically handles Google Consent Mode v2.

You can withdraw or change your consent at any time by clicking "Cookie settings" in the footer.

Legal basis for storing your consent decision: Art. 6(1)(c) GDPR in conjunction with Art. 7 GDPR (obligation to demonstrate consent).

5 Google Tag Manager

GTM is used to manage JavaScript tags centrally. GTM itself sets no cookies and does not process personal data independently. Its data-protection relevance comes from the tags it loads (see the relevant sections below).

GTM respects Consent Mode v2: tracking tags are only activated after consent has been given.

Legal basis: Art. 6(1)(f) GDPR (legitimate interest in efficient tag management).

6 Google Analytics 4 (GA4)

GA4 uses cookies and similar technologies to collect, among other things, the following data:

• Page views, session duration and bounce rate
• Device information (browser type, operating system, screen resolution)
• Approximate location (country/region — no precise IP address)
• Referrer information (where visitors come from)
• Conversion events (e.g. form submissions)

The IP address is anonymised before transmission. GA4 is only fully activated after active consent (Consent Mode v2). A Data Processing Agreement (Art. 28 GDPR) is in place with Google. Data may be transferred to the USA (see Section 12).

Legal basis: Art. 6(1)(a) GDPR (consent).

Further information: support.google.com/analytics

7 Google Ads & conversion tracking

Google Ads Conversion Tracking sets a conversion cookie after defined actions (e.g. form submission) — valid for 30 days, contains no personal data.

In addition, Enhanced Conversions is used: user-provided data (e.g. email address) is hashed using SHA-256 before transmission.

Conversion tracking is only activated after consent (Consent Mode v2 implemented). Data may be transferred to the USA (see Section 12).

Legal basis: Art. 6(1)(a) GDPR (consent).

8 Google Search Console

Search Console is a webmaster tool and does not set any cookies on this website. Only aggregated search data is evaluated — no conclusions about individual persons are possible.

Legal basis: Art. 6(1)(f) GDPR (legitimate interest in search engine optimisation).

9 Google Fonts

This website loads fonts via the Google Fonts API. Your IP address is transmitted to Google servers in the process. Google Fonts does not set cookies for identification purposes according to current understanding.

Legal basis: Art. 6(1)(f) GDPR. Data may be transferred to the USA (see Section 12).

10 Gumroad (Digital products & payment)

Digital products are sold and delivered via shop.meixner-tobias.com and links to tobiasmeixner.gumroad.com. Checkout and payment processing are handled entirely by Gumroad, Inc. Gumroad acts as the Merchant of Record and is responsible for order fulfilment including VAT compliance.

When purchasing, Gumroad processes the following data: name, email address, payment details (credit card or PayPal, processed by Stripe or PayPal), IP address, and purchase history. Data is stored on servers in the USA.

Gumroad is certified under the EU–US Data Privacy Framework. Standard Contractual Clauses (SCC) pursuant to Art. 46(2)(c) GDPR are also in place.

Legal basis: Art. 6(1)(b) GDPR (contract performance). For any marketing cookies set by Gumroad: Art. 6(1)(a) GDPR (consent).

11 Contact form

When you use the contact form, the following data is collected:

• Name (required)
• Email address (required)
• Phone number (optional)
• Company (optional)
• Service of interest (required)
• Message (required)

This data is used solely to process your enquiry. Transmission is encrypted via Cloudflare Workers and delivered to my email address via Resend (see Sections 12 and 13). Data is not passed on to third parties for any other purpose.

Legal basis: Art. 6(1)(b) GDPR (pre-contractual measures) and Art. 6(1)(f) GDPR (legitimate interest in processing enquiries).

12 Cloudflare Workers

The contact form on this website is processed via Cloudflare Workers, a serverless computing service by Cloudflare, Inc. When you submit the contact form, the data you entered is transmitted to a Cloudflare Worker, which processes it and forwards it to the email delivery service Resend.

Processing takes place on servers within the EU/EEA. Cloudflare, Inc. is certified under the EU–US Data Privacy Framework (DPF). Standard Contractual Clauses (SCC) pursuant to Art. 46(2)(c) GDPR are also in place.

Legal basis: Art. 6(1)(b) GDPR (pre-contractual measures) and Art. 6(1)(f) GDPR (legitimate interest in the secure transmission of contact data).

13 Resend (email delivery)

Resend by WorkOS Inc. is used to send emails after form submission — both a confirmation email to you and a notification to me. The data entered in the contact form (in particular name and email address) is transmitted to Resend for the purpose of email delivery.

Resend temporarily stores email logs to ensure deliverability. A Data Processing Agreement (Art. 28 GDPR) is in place with WorkOS Inc. Data may be transferred to the USA (see Section 14).

Legal basis: Art. 6(1)(b) GDPR (pre-contractual measures) and Art. 6(1)(f) GDPR (legitimate interest in reliable email delivery).

14 Data transfers to the USA

Several services used on this website (in particular Google services) transfer data to the USA. Since the EU–US Data Privacy Framework (DPF, in force since July 2023), the USA is considered a safe third country for certified organisations.

Google LLC, GitHub Inc., Cloudflare Inc. and WorkOS Inc. (Resend) are certified under the EU-US Data Privacy Framework. Standard Contractual Clauses (SCC) pursuant to Art. 46(2)(c) GDPR are also in place as an additional safeguard.

15 Your rights as a data subject

You have the following rights with regard to personal data concerning you:

• Access (Art. 15 GDPR) – You may request information about the personal data I hold about you.
• Rectification (Art. 16 GDPR) – You may request the correction of inaccurate data.
• Erasure (Art. 17 GDPR) – You may request the deletion of your data, provided no statutory retention obligation applies.
• Restriction (Art. 18 GDPR) – You may request a restriction on the processing of your data.
• Data portability (Art. 20 GDPR) – You may request your data in a commonly used format.
• Objection (Art. 21 GDPR) – You may object to processing based on legitimate interests.
• Complaint – You have the right to lodge a complaint with a data protection supervisory authority. For residents of Bavaria (Germany): Bayerisches Landesamt für Datenschutzaufsicht (BayLDA), Promenade 18, 91522 Ansbach, Germany.

To exercise your rights, please contact: [email protected]

16 Withdrawal of consent

Any consent given may be withdrawn at any time with effect for the future. This applies in particular to consent for analytics and marketing cookies.

Cookie consent can be adjusted or withdrawn at any time via the "Cookie settings" link in the footer.

To withdraw other types of consent, an informal message by email to [email protected] is sufficient.

17 Changes to this policy

This privacy policy will be updated when the website or the services used change, or when legal requirements change. The current version date is shown at the top of the page.