Privacy Policy

1. Controller

2. General information on data processing

I only process personal data of visitors to this website insofar as this is necessary to provide a functioning website as well as my content and services. Depending on the processing, the legal bases are Art. 6(1)(a) (consent), (b) (performance of a contract or pre-contractual measures) and (f) (legitimate interest) GDPR.

3. No data protection officer

As a sole proprietor, I am not obliged to appoint a data protection officer under Art. 37 GDPR in conjunction with § 38 of the German Federal Data Protection Act (BDSG).

4. Hosting and server log files

This website is hosted by Vercel Inc., 340 S Lemon Ave #4133, Walnut, CA 91789, USA.

When you visit this website, the hosting provider automatically collects technical data (server log files) transmitted by your browser: IP address, date and time of the request, page requested, referrer URL, browser type and version, operating system, amount of data transferred and HTTP status code. This data is not combined with other data sources. The legal basis is Art. 6(1)(f) GDPR (legitimate interest in the technical provision, stability and security of the website).

Vercel only keeps these logs briefly for troubleshooting, currently for one hour, and then deletes them automatically. They are not stored for longer or passed on to third parties.

Transfer to a third country (USA)

Vercel Inc. is based in the USA, so processing takes place outside the EU and the EEA. According to its own information, Vercel is certified under the EU-US Data Privacy Framework (DPF). The transfer is therefore based on the European Commission’s adequacy decision of 10 July 2023 (Art. 45 GDPR).

5. Contact form and contact by email

When you click one of the “Request a free consultation” buttons, a contact form opens. Mandatory fields are your name, your email address and your message; the “What’s it about?” selection is optional. The form also contains a field that is invisible to you, which serves solely to fend off automated spam and is not filled in by you.

Your entries are transmitted in encrypted form (TLS) to my hosting provider Vercel and immediately forwarded from there as an email to my inbox. This processing takes place on servers in the USA (Washington, D.C. region; see section 4 on transfers to third countries). To send and receive this email, I use manitu GmbH, Welvertstraße 2, 66606 St. Wendel, Germany, with whom I have a data processing agreement under Art. 28 GDPR. Your enquiry is not stored in a database; it is then kept as an email in my inbox.

I use your details solely to answer your enquiry. The legal basis is Art. 6(1)(b) GDPR (pre-contractual measures), otherwise Art. 6(1)(f) GDPR (legitimate interest in answering enquiries). Providing your data is voluntary; however, I cannot process your enquiry without your name, email address and message.

I delete your enquiry as soon as it is no longer needed, at the latest twelve months after our last contact. If your enquiry leads to an assignment, the statutory retention periods apply (in particular six or ten years under § 257 of the German Commercial Code (HGB) and § 147 of the German Fiscal Code (AO)). You can request deletion at any time (see section 9).

Alternatively, you can email me directly at hallo@mehaflow.com. The same applies: I only process your details to answer your message.

6. Fonts

This website uses Google Fonts. However, the font files are downloaded automatically when the website is built and delivered directly from my own server or Vercel (self-hosting). Your browser does not connect to Google servers, and no IP address is transmitted to Google.

7. Cookies, consent and Google Tag Manager

Your consent (cookie banner)

On your first visit, a banner asks which categories of cookies and similar technologies you agree to. Optional categories are never preselected, and “Accept all” and “Reject all” are designed to be equal. As long as you have not made a decision, all optional categories are treated as rejected.

I store your decision in your browser’s local storage (localStorage, entry “mehaflow-consent”): the selected categories, the time, a randomly generated record ID and a version number. This ensures your decision is respected on further page views. The record ID is not transmitted to me or to third parties. The entry remains until you delete it (e.g. via your browser settings); if I change the categories, you will be asked again. The legal basis is § 25(2) no. 2 of the German Telecommunications Digital Services Data Protection Act (TDDDG) in conjunction with Art. 6(1)(f) GDPR.

You can change or withdraw your consent at any time with effect for the future via the “Cookie settings” link in the footer of every page.

Light and dark mode

If you use the slider in the menu bar to switch between light and dark mode, I store this choice in your browser’s local storage (entry “mehaflow-farbmodus”). This way the site appears the way you set it on your next visit. The entry only contains “light” or “dark”, is not transmitted to me or to third parties and remains until you delete it. If you have not set anything, the site follows your device settings and nothing is stored. The legal basis is § 25(2) no. 2 TDDDG in conjunction with Art. 6(1)(f) GDPR.

Categories

• Essential cookies: Make sure the website works and is secure. This includes storing your cookie choice. Cannot be deselected. Legal basis: § 25(2) no. 2 TDDDG (strictly necessary) in conjunction with Art. 6(1)(f) GDPR (legitimate interest).
• Analytics cookies: Show me how the website is used, for example which pages are visited, so I can improve it. Legal basis: § 25(1) TDDDG in conjunction with Art. 6(1)(a) GDPR (consent).
• Personalisation cookies: Allow content and settings to be adapted to how you use the site. Legal basis: § 25(1) TDDDG in conjunction with Art. 6(1)(a) GDPR (consent).
• Marketing cookies: Measure whether ads work and enable advertising tailored to you, for example on Facebook, Instagram or Google. Legal basis: § 25(1) TDDDG in conjunction with Art. 6(1)(a) GDPR (consent).

Google Tag Manager

This website uses Google Tag Manager from Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (“Google”). With Tag Manager, I manage small code snippets (tags) of other services, for example for analytics or advertising, in one central place. Tag Manager itself is an administration tool: only the services integrated through it collect data on your usage behaviour, and these are only triggered if you have consented to the respective category.

When Tag Manager loads, your browser retrieves a script file from Google servers. For technical reasons, your IP address and information about your browser are transmitted in the process. According to Google, Tag Manager itself only collects aggregated data on the triggering of tags, which contains no IP addresses and is deleted within 14 days; it does not record any information about the visitors to the website.

Tag Manager is only loaded after you have agreed to at least one optional category. The legal basis is your consent (§ 25(1) TDDDG in conjunction with Art. 6(1)(a) GDPR).

I also use Google’s consent mode. It tells the Google services integrated via Tag Manager which categories you have agreed to, so that they act accordingly. Before you decide, all optional categories are set to “denied”.

A transfer of data to Google LLC in the USA cannot be ruled out. Google LLC is certified under the EU-US Data Privacy Framework; the transfer is therefore based on the European Commission’s adequacy decision of 10 July 2023 (Art. 45 GDPR). You can find more information in Google’s privacy policy.

Meta Pixel

Only if you have consented to the “Marketing cookies” category, I use the Meta Pixel from Meta Platforms Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland (“Meta”) via Tag Manager. With the pixel, I measure whether my ads on Facebook and Instagram are effective and can build audiences for ads, for example people who have visited my website.

For this purpose, your browser loads scripts from Meta and transmits information about your visit to Meta, such as your IP address, information about your browser and device, the page visited, the time and the page you came from. Some of these scripts are loaded from Amazon Web Services servers in the USA. The cookie “_fbp” (usually stored for 90 days) and entries in local storage are created in your browser. I cannot attribute this data to a specific person; Meta, however, can link it to your Facebook or Instagram account and also use it for its own purposes in accordance with its data policy.

The legal basis is your consent (§ 25(1) TDDDG in conjunction with Art. 6(1)(a) GDPR); you can withdraw it at any time with effect for the future via “Cookie settings” in the footer. Meta and I are joint controllers for the collection of data on my website and its transmission to Meta (Art. 26 GDPR); any further processing is the sole responsibility of Meta. You can find the corresponding agreement in Meta’s Controller Addendum. Meta Platforms, Inc. (USA) is certified under the EU-US Data Privacy Framework; transfers to the USA are based on the European Commission’s adequacy decision (Art. 45 GDPR).

More information: Meta’s Privacy Policy, Meta’s Cookies Policy.

Google Analytics

If you have consented to the “Analytics cookies” category, I use Google Analytics 4 from Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (“Google”) via Tag Manager. This shows me how my website is used: which pages are visited, how long visitors stay, how they arrived, for example via a search engine or Instagram, and with what kind of device. I only evaluate this information in aggregated form in order to improve the website.

For this purpose, Google sets the cookies “_ga” and “_ga_JSQGQHV7YD” in your browser, with a lifetime of up to two years, and receives information about your visit: pages visited, time, approximate location, device type, browser and operating system, and the page you came from. According to Google, IP addresses are neither logged nor stored in Google Analytics 4. The “Google Signals” feature for cross-device analysis is deactivated. Data on individual visits and users is deleted after two months; after that, only aggregated statistics without reference to individual people remain.

The legal basis is your consent (§ 25(1) TDDDG in conjunction with Art. 6(1)(a) GDPR); you can withdraw it at any time with effect for the future via “Cookie settings” in the footer. Google processes the data on my behalf on the basis of Google’s data processing terms (Art. 28 GDPR). A transfer to Google LLC in the USA cannot be ruled out; it is based on Google LLC’s certification under the EU-US Data Privacy Framework and the European Commission’s adequacy decision (Art. 45 GDPR).

More information: How Google uses information from sites that use its services.

8. Social media links

The footer of this website contains links to Instagram and Facebook. These are plain hyperlinks, not embedded plugins or feeds. No data is transmitted to the respective providers when you click these icons; only once the linked page opens do their own privacy policies apply.

9. Your rights as a data subject

• Access to the data stored about you (Art. 15 GDPR)
• Rectification of inaccurate data (Art. 16 GDPR)
• Erasure of your data (Art. 17 GDPR)
• Restriction of processing (Art. 18 GDPR)
• Data portability (Art. 20 GDPR)
• Objection to processing based on Art. 6(1)(f) GDPR (Art. 21 GDPR)
• Withdrawal of consent with effect for the future (Art. 7(3) GDPR); the lawfulness of processing carried out before the withdrawal remains unaffected
• Complaint to a data protection supervisory authority (Art. 77 GDPR)

The authority responsible for me is:

10. Automated decision-making

No automated decision-making, including profiling within the meaning of Art. 22 GDPR, takes place on this website.

11. Data security

This website is delivered exclusively via an encrypted HTTPS connection (TLS).

12. Changes to this privacy policy

I update this privacy policy whenever the tools used or the legal situation change, in particular when I integrate further services via Tag Manager. The version currently published on this page applies.

Last updated: October 2026.