Privacy Policy

1 Controller

2 Hosting

Legal basis: Art. 6(1)(f) GDPR (legitimate interest in providing the website).

3 Server log files

When you visit this website, the hosting provider automatically records the following data in server log files: IP address, date and time, page accessed, browser type and version, operating system, referrer URL.

This data is not merged with other data sources. Legal basis: Art. 6(1)(f) GDPR. The legitimate interest lies in the security and stability of the website.

4 Cookies & consent management

This website uses cookies and similar technologies where technically necessary for operation or where you have given your consent.

Categories

Consent management (CookieScript)

CookieScript is used to manage consent. CookieScript stores your consent decision in your browser and automatically handles Google Consent Mode v2.

You can withdraw or change your consent at any time by clicking "Cookie settings" in the footer.

Legal basis for storing your consent decision: Art. 6(1)(c) GDPR in conjunction with Art. 7 GDPR (obligation to demonstrate consent).

5 Contact form (Formspree)

When you use the contact form, the data you enter (name, email, optional company, subject, message) is transmitted to Formspree and forwarded to me by email. Formspree processes data on servers in the USA based on Standard Contractual Clauses (Art. 46 GDPR). A Data Processing Agreement (DPA) is in place with Formspree.

The transmitted data is used solely to handle your enquiry and is deleted once processing is complete, unless a statutory retention period applies.

Legal basis: Art. 6(1)(b) GDPR (pre-contractual measures) or Art. 6(1)(f) GDPR.

6 Google Tag Manager

GTM is used to manage JavaScript tags centrally. GTM itself sets no cookies and does not process personal data independently. Its data-protection relevance comes from the tags it loads (see the relevant sections below).

GTM respects Consent Mode v2: tracking tags are only activated after consent has been given.

Legal basis: Art. 6(1)(f) GDPR (legitimate interest in efficient tag management).

7 Google Analytics 4 (GA4)

GA4 uses cookies and similar technologies to collect, among other things, the following data:

• Page views, session duration and bounce rate
• Device information (browser type, operating system, screen resolution)
• Approximate location (country/region — no precise IP address)
• Referrer information (where visitors come from)
• Conversion events (e.g. form submissions)

The IP address is anonymised before transmission. GA4 is only fully activated after active consent (Consent Mode v2). A Data Processing Agreement (Art. 28 GDPR) is in place with Google. Data may be transferred to the USA (see Section 12).

Legal basis: Art. 6(1)(a) GDPR (consent).

Further information: support.google.com/analytics

8 Google Ads & conversion tracking

Google Ads Conversion Tracking sets a conversion cookie after defined actions (e.g. form submission) — valid for 30 days, contains no personal data.

In addition, Enhanced Conversions is used: user-provided data (e.g. email address) is hashed using SHA-256 before transmission.

Conversion tracking is only activated after consent (Consent Mode v2 implemented). Data may be transferred to the USA (see Section 12).

Legal basis: Art. 6(1)(a) GDPR (consent).

9 Google Search Console

Search Console is a webmaster tool and does not set any cookies on this website. Only aggregated search data is evaluated — no conclusions about individual persons are possible.

Legal basis: Art. 6(1)(f) GDPR (legitimate interest in search engine optimisation).

10 Google Fonts

This website loads fonts via the Google Fonts API. Your IP address is transmitted to Google servers in the process. Google Fonts does not set cookies for identification purposes according to current understanding.

Legal basis: Art. 6(1)(f) GDPR. Data may be transferred to the USA (see Section 12).

11 Gumroad (Digital products & payment)

Digital products are sold and delivered via shop.meixner-tobias.com and links to tobiasmeixner.gumroad.com. Checkout and payment processing are handled entirely by Gumroad, Inc. Gumroad acts as the Merchant of Record and is responsible for order fulfilment including VAT compliance.

When purchasing, Gumroad processes the following data: name, email address, payment details (credit card or PayPal, processed by Stripe or PayPal), IP address, and purchase history. Data is stored on servers in the USA.

Gumroad is certified under the EU–US Data Privacy Framework. Standard Contractual Clauses (SCC) pursuant to Art. 46(2)(c) GDPR are also in place.

Legal basis: Art. 6(1)(b) GDPR (contract performance). For any marketing cookies set by Gumroad: Art. 6(1)(a) GDPR (consent).

12 Data transfers to the USA

Several services used on this website (in particular Google services and Formspree) transfer data to the USA. Since the EU–US Data Privacy Framework (DPF, in force since July 2023), the USA is considered a safe third country for certified organisations.

Google LLC and GitHub Inc. are certified under the EU–US Data Privacy Framework. Standard Contractual Clauses (SCC) pursuant to Art. 46(2)(c) GDPR are also in place as an additional safeguard.

13 Your rights as a data subject

You have the following rights with regard to personal data concerning you:

• Access (Art. 15 GDPR) – You may request information about the personal data I hold about you.
• Rectification (Art. 16 GDPR) – You may request the correction of inaccurate data.
• Erasure (Art. 17 GDPR) – You may request the deletion of your data, provided no statutory retention obligation applies.
• Restriction (Art. 18 GDPR) – You may request a restriction on the processing of your data.
• Data portability (Art. 20 GDPR) – You may request your data in a commonly used format.
• Objection (Art. 21 GDPR) – You may object to processing based on legitimate interests.
• Complaint – You have the right to lodge a complaint with a data protection supervisory authority. For residents of Bavaria (Germany): Bayerisches Landesamt für Datenschutzaufsicht (BayLDA), Promenade 18, 91522 Ansbach, Germany.

To exercise your rights, please contact: contact@meixner-tobias.com

14 Withdrawal of consent

Any consent given may be withdrawn at any time with effect for the future. This applies in particular to consent for analytics and marketing cookies.

Cookie consent can be adjusted or withdrawn at any time via the "Cookie settings" link in the footer.

To withdraw other types of consent, an informal message by email to contact@meixner-tobias.com is sufficient.

15 Changes to this policy

This privacy policy will be updated when the website or the services used change, or when legal requirements change. The current version date is shown at the top of the page.