Privacy

Last updated: 16 September 2026

This notice explains how personal data is processed when you visit this website, contact Netzfeder or arrange an appointment.

1. Controller and contact

Niklas Lamb, trading as Netzfeder
Enderstraße 18, 01277 Dresden, Germany
Email: info@netzfeder.de
Telephone: +49 1514 4886218

You can also use these contact details to exercise your data protection rights.

2. Website visits and hosting

The website and email delivery are hosted by ALL-INKL.COM – Neue Medien Münnich, proprietor René Münnich, Hauptstraße 68, 02742 Friedersdorf, Germany. Requests disclose information including your IP address, request time and destination, browser and operating system, and potentially the referring page. This information supports delivery, troubleshooting and security.

The legal basis is Article 6(1)(f) GDPR. The legitimate interest is providing a functioning, secure website. Technical logs are separate from contact form messages; the application does not write message contents to its logs.

Complete hosting logs, including IP addresses, are retained for three months and then deleted.

Provider information: ALL-INKL.COM privacy information.

3. Local content and external services

Fonts, the logo, styles and website scripts are served from our hosting. The website contains no analytics or advertising trackers integrated by Netzfeder. Reading pages does not require Cal.com or Cloudflare Turnstile. Each service loads only after your separate consent. Form entries are not stored in Local Storage or a website message database.

Voluntary activation of external content is based on Article 6(1)(a) GDPR and, where information is stored on or accessed from your device, section 25(1) of the German TDDDG. Device access strictly necessary to provide an explicitly requested service is subject to section 25(2) TDDDG. Consent is not saved as a permanent preference; external integrations are disabled again on a new page load.

You can remove the calendar using its close and withdraw button. “Reset consents” on the contact page reloads the page, ends the external integrations and leaves them disabled until you consent again. Unsent entries will be lost. This does not undo previous transfers. Withdrawal takes effect for the future and does not affect the lawfulness of earlier processing. You can also contact us by email about data already submitted.

4. Contact form, email and telephone

For form enquiries we process your name, email address and message. Company and telephone number are optional. The form cannot send without the required fields and successful spam protection. Alternatively, contact us directly by email or telephone without activating Turnstile or Cal.com.

For emails we process sender and recipient details, time, content and any attachments. Telephone contact may involve processing the transmitted number, call time and notes needed to handle your enquiry. Please do not submit passwords or particularly sensitive information through the form.

Article 6(1)(b) GDPR applies to a contract with you or steps taken at your request before entering a contract. For other enquiries and communication with a company's contact person, Article 6(1)(f) applies; the legitimate interest is responding to and handling business communication appropriately. Statutory retention obligations are based on Article 6(1)(c).

The form transmits your message to the hosting server over an encrypted connection. The server sends it to info@netzfeder.de using encrypted SMTP and includes your address for replies. A success message means the delivery service accepted the message. The website keeps no additional database copy. The enquiry remains in the mailbox and, where necessary, business records used to handle it. Transport encryption is not end-to-end email encryption.

5. Abuse prevention

The server validates input and limits form attempts. Identifiers derived from IP addresses using a secret key, timestamps and attempt counts are held in a protected hosting directory. The IP address is not stored there in plain text. A counter applies for 15 minutes. Expired entries are removed on the next form attempt; if there is no further attempt, they may remain until that cleanup. These counters contain no messages.

The basis is Article 6(1)(f) GDPR: our interest in preventing spam, overload and abusive sending.

6. Cloudflare Turnstile

After consent, Turnstile, provided by Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107, USA, checks technical signals such as IP address, browser identifier and connection characteristics. Cloudflare acts as a processor when protecting our website and also as an independent controller when improving bot detection. See the Turnstile privacy notice.

Our server verifies the resulting single-use token with Cloudflare. It sends neither your message nor an additional copy of your IP address. Our activation uses the consent basis in section 3. The check distinguishes automated requests from human requests; it does not assess your suitability as a customer. Email and telephone remain available if it rejects a request.

7. Appointments through Cal.com

The optional calendar is provided by Cal.com, Inc., 2261 Market Street #4382, San Francisco, CA 94114, USA. Loading transfers connection data. Booking involves contact details, appointment time, time zone and your booking entries. Cal.com processes booking data for the organiser; it explains its own provider purposes in its privacy policy.

Embedding is based on your consent as described in section 3. Subsequent handling of the appointment is based on Article 6(1)(b) or (f) GDPR according to the enquiry, as explained in section 4. A direct link also opens the external booking page. You can request an appointment by email or telephone instead.

The appointment link is intended for conversations in German. A business-use Google account is connected solely for calendar management. This involves appointment times, participant names and email addresses, and booking details needed for the calendar entry. The recipient is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Our appointment management relies on Article 6(1)(b) or (f) GDPR, depending on the enquiry. For Google’s processing, see Google’s privacy policy. This website does not embed Google Calendar directly.

8. Recipients and transfers outside the EEA

Recipients follow from the activities described above: the hosting and email provider; Cloudflare and Cal.com when activated; and potentially connected calendar services for appointments. Competent authorities or parties involved in pursuing legal claims may receive data where legally necessary. Disclosures must be necessary for the relevant purpose and legally permitted.

Cloudflare and Cal.com may process data in the USA and other countries outside the European Economic Area. Cloudflare identifies the EU-US Data Privacy Framework for relevant US transfers and standard contractual clauses for other cases. Cal.com identifies standard contractual clauses or an applicable adequacy mechanism. See Cloudflare's privacy policy and Cal.com's privacy policy. Consent to loading does not replace international transfer requirements.

Data processing agreements are in place with ALL-INKL, Cloudflare and Cal.com. For transfers by Google, the provider explains its transfer mechanisms, including applicable adequacy decisions and standard contractual clauses. Contact the controller for information and, where applicable, copies of the relevant safeguards.

9. Retention and deletion

Retention depends on the handling purpose, necessary evidence and statutory requirements. For enquiries that do not lead to work, the handling purpose ends once the question is resolved and no further substantive correspondence is expected. For appointment data, meeting delivery, follow-up and any associated work are relevant. Data no longer needed must be deleted; indefinite blanket retention is not intended.

Documents subject to statutory retention are kept for the applicable periods, particularly under section 147 of the German Fiscal Code (AO) and, where applicable, section 257 of the German Commercial Code (HGB): generally ten years for books and certain records, eight years for accounting vouchers and six years for relevant business correspondence. Start dates and extensions follow the applicable rule. These periods do not apply indiscriminately to every enquiry. Retention for establishing or defending legal claims is limited to the data and duration required.

Resolved enquiries that do not lead to work are deleted no later than three months after completion. Data used solely to organise an appointment is deleted no later than three months after the appointment and its follow-up have been completed. This covers the corresponding mailbox, Cal.com and connected calendar entries. Where particular records remain necessary for work, statutory retention or specific legal claims, the purpose-limited exceptions above apply. Deletion is managed operationally; it is not triggered automatically by this website. Backups and data processed by providers as independent controllers are subject to their respective deletion and retention processes.

10. Your rights

Subject to legal conditions, you have rights of access (Article 15 GDPR), rectification (Article 16), erasure (Article 17), restriction (Article 18) and portability (Article 20). You may withdraw consent at any time for the future (Article 7(3)).

Objection: where processing relies on Article 6(1)(f), you may object on grounds relating to your particular situation (Article 21(1)). Processing then stops unless overriding compelling legitimate grounds or legal claims justify continuing it. You may object to direct marketing at any time without giving reasons.

You may complain to a data protection authority, particularly in the place of your habitual residence, work or the suspected infringement (Article 77). For our Dresden location, the authority is the Saxon Data Protection and Transparency Commissioner, Postfach 11 01 32, 01330 Dresden, Germany; email post@sdtb.sachsen.de.

11. Providing data and automated decisions

You do not have to contact us or activate external services. A page cannot be served without technically necessary connection data, and the selected enquiry cannot be handled without the required contact or booking details. There is no automated decision producing legal or similarly significant effects under Article 22 GDPR. Technical spam prevention only protects access to the form.