Privacy notice
Information about personal data on this website, in enquiries and when booking an appointment.
Last updated: 17 October 2026
Controller
The controller is Elias Christian Frick, Abt-Reher-Straße 8/1, 88326 Aulendorf, Germany. You can contact me with privacy questions or to exercise your rights.
Website access and hosting
Hosting is planned on a server provided by netcup GmbH, Emmy-Noether-Straße 10, 76131 Karlsruhe, Germany. Deployment is planned through Dokploy.
When a website is requested, the server processes technically necessary connection data, particularly your IP address, the requested page, the time and information sent by your browser. This is needed to deliver the website. The intended legal basis is Article 6(1)(f) GDPR. My legitimate interest is to provide a secure and reliable website for my services.
Still to be confirmed: the actual server location, enabled access and error logs, their data fields and retention periods, and processing by any upstream services. This draft does not claim that a data processing agreement with netcup has already been concluded.
Language selection and local storage
When you visit the root address, the website reads the language preferences reported by your browser to display German or English. This happens in your browser. The displayed page language is also recorded with the analytics events described below.
Selecting DE or EN stores only “de” or “en” under the key “site-language” in your browser’s local storage. It contains no unique visitor identifier, is not automatically sent to the server with every request and remains until you change the language again or delete the website’s browser data.
Storage supports the language preference you explicitly selected. Section 25(2)(2) TDDDG is the basis for this requested function. To the extent personal data is processed, the intended basis is Article 6(1)(f) GDPR, reflecting my interest in reliably displaying your chosen language. The language links also work when browser storage is blocked.
Fonts, analytics and embedded content
Fonts and other website files are loaded from the website’s own server. Loading the font does not connect to Google Fonts.
The website uses a self-hosted Umami instance at analytics.eliasfrick.com on the netcup server to measure traffic. It records pageviews, referring websites, campaign parameters, browser, operating system, device category, screen size, browser language and approximate location. The IP address is processed for the connection and location lookup; according to Umami, it is not stored in analytics data. Possible server logs require a separate review.
It also records clicks on workshop and email links and the opening of individual case studies, including the page language and workshop link position. A calendar click is not counted as a completed booking. Message content, visitor email addresses and booking details are not sent as event properties.
The standard analytics integration uses no tracking cookies, user-account identifiers assigned by this website or session recordings. Before transmission, the website removes URL fragments and all query parameters except utm_source, utm_medium, utm_campaign, utm_content and utm_term; all query parameters are removed from referrer URLs. Enabled Do Not Track and Global Privacy Control signals prevent analytics transmission.
Umami is only loaded after you allow analytics in the banner or cookie settings. Without a choice, or after rejection, no visits or clicks are sent to Umami. Earlier actions are not sent retrospectively. You can withdraw your consent for future processing at any time via “Cookie settings” in the footer.
The purpose is to understand traffic sources and use of this website. Processing is based on your consent under Article 6(1)(a) GDPR and, where information on your device is stored or accessed, Section 25(1) TDDDG. The specific retention and deletion arrangements for analytics data still need confirmation.
I use c15t at consent.eliasfrick.com on my netcup server to manage your choice. It stores your choice in the c15t cookie and local storage, with related technical storage entries as needed. The choice is valid for up to 365 days. The server documents the decision, time, language, policy version and a technical reference for consent records. The application does not store IP addresses or user agents in these records; technical server logs are separate. Necessary storage respects your choice under Section 25(2)(2) TDDDG. Records support the accountability obligation under Article 6(1)(c) in conjunction with Article 7(1) GDPR. The server-side retention period for consent records still needs to be established.
Email enquiries
If you email me, I process your sender address, message and supplied information to handle and reply to your enquiry. Please include only information needed for that purpose.
For enquiries about your own possible or existing contract, the legal basis is Article 6(1)(b) GDPR. General enquiries and communication with a business’s contact person are handled under Article 6(1)(f) GDPR, based on my interest in responding to business enquiries.
Providing information is voluntary. Without contact details and enough information, I may be unable to answer. The email provider, its processing and the actual deletion and retention arrangements still need to be added.
Booking through Google Calendar
Booking links lead to an external Google Calendar appointment page. The calendar is not embedded in this website. The external page is opened only when you follow a booking link; visiting this website alone does not load calendar content from Google.
Booking involves processing the contact and appointment information requested by the booking form. I use the information supplied to me to arrange, conduct and coordinate the workshop. Where you are the contracting party, the basis is Article 6(1)(b) GDPR. For a business’s contact person, the basis is Article 6(1)(f) GDPR and my interest in organising the requested appointment.
Google processes data on its website under its applicable privacy information. The Google account used, exact form fields, data protection roles, potential international transfers and safeguards, and booking retention periods still need checking. This section is not complete without those details.
Retention and recipients
The final notice must specify the actual retention periods or meaningful criteria for determining them for server logs, enquiries and bookings. These operational details are still outstanding; this draft does not invent fixed periods.
Planned or identifiable recipients include the hosting provider, the email service yet to be identified and the Google services involved in booking. Additional recipients, data processing agreements, data locations and any safeguards for transfers outside the European Economic Area must be verified before publication.
Your rights
Subject to the applicable legal conditions, you have rights of access, rectification, erasure, restriction of processing and data portability. You can withdraw consent at any time for future processing. Withdrawal does not affect the lawfulness of earlier processing.
Where processing relies on Article 6(1)(f) GDPR, you can object on grounds relating to your particular situation. You can object to processing for direct marketing at any time without giving particular reasons.
You may also complain to a data protection supervisory authority, particularly where you usually live, work or believe an infringement occurred. The competent authority for my business location is the State Commissioner for Data Protection and Freedom of Information Baden-Württemberg.
The website code does not use automated decision-making with legal or similarly significant effects or create visitor profiles.