1. Controller
The controller within the meaning of the General Data Protection Regulation (GDPR) is:
Hrvoje Bolf UG (haftungsbeschränkt)
Brendstraße 22
75179 Pforzheim
Germany
Managing Director: Hrvoje Bolf
Phone: +49 1520 8685784
Email: hrvoje1bolf@gmail.com
2. General information
We take the protection of your personal data seriously. Personal data is any information relating to an identified or identifiable natural person.
We process personal data only where this is necessary to provide this website, to handle enquiries, to carry out pre-contractual measures, to perform contracts, to comply with legal obligations, or on the basis of valid consent.
3. Provision of the website and server log files
When you access this website, the web server processes technically necessary information. This may include in particular:
- IP address
- date and time of access
- page or file requested
- referrer URL
- browser type and version
- operating system
- HTTP status code
- volume of data transferred
This processing serves to provide the website securely and reliably, to analyse errors, and to defend against abusive or unlawful access.
The legal basis is Art. 6(1)(f) GDPR. Our legitimate interest lies in the secure, stable and functional provision of our website.
The data is stored only for as long as is necessary for these purposes, unless longer retention is required because of a security incident or a legal obligation.
Hosting
This website is hosted by the following provider:
Namecheap, Inc.
4600 East Washington Street, Suite 305, Phoenix, AZ 85034, USA
The provider processes the connection and log data described above, as well as the emails sent through this website, on our behalf and only as far as is necessary to operate and secure the website. This is governed by a data processing agreement pursuant to Art. 28 GDPR. Information on transfers to third countries can be found in section 10.
4. Contacting us by email or telephone
If you contact us by email or telephone, we process the data you provide – in particular your contact details and the content of your enquiry – in order to handle your enquiry and communicate with you.
Where your enquiry serves to initiate or perform a contract, processing is based on Art. 6(1)(b) GDPR. In other cases, processing is based on Art. 6(1)(f) GDPR. Our legitimate interest lies in dealing appropriately with business enquiries.
The data is deleted as soon as it is no longer required to handle the enquiry and no statutory retention obligations or other legal grounds require further storage.
5. Contact and quotation form
If you send a contact or quotation request through our website, we process the data you enter into the form in order to handle your enquiry, contact you and, where relevant, prepare a quotation.
The following data is processed:
- name
- telephone number, where provided
- email address
- requested service
- project description
- any other details you choose to include in the project description, such as location, measurements or preferred timing
Mandatory fields are marked as such. The legal basis is Art. 6(1)(b) GDPR where processing is carried out to take pre-contractual steps at your request. For other enquiries, processing is based on Art. 6(1)(f) GDPR.
Form data is stored only for as long as is necessary to handle your enquiry, prepare a quotation, carry out a project, and comply with statutory retention obligations.
6. Contact via WhatsApp
In the contact form you may voluntarily provide a WhatsApp number. If you do, we can reply to your enquiry via WhatsApp at your request. This website embeds neither a WhatsApp widget nor any WhatsApp script; simply visiting this website transfers no data to WhatsApp.
Once communication takes place via WhatsApp, the provider of that service processes personal data on its own responsibility and under its own privacy terms. Processing outside the European Economic Area cannot be ruled out in that case.
Using WhatsApp is voluntary. You can always reach us instead by email, telephone or through the contact form. Please do not send sensitive information via WhatsApp that is not needed to handle your enquiry.
The legal basis is Art. 6(1)(b) GDPR where your message is directed at initiating or performing a contract. In other cases, Art. 6(1)(f) GDPR applies.
7. Cookies and similar technologies
This website sets no cookies when you simply visit it, and uses no comparable storage technologies on your device. In particular, no analytics, statistics, marketing or tracking technologies are used.
Cookies are set only for users logged in to the content management system, for example to maintain the login session. Such cookies are strictly necessary; the basis is Section 25(2) TDDDG.
Because no technologies requiring consent are in use, we deliberately do not display a consent banner. Should non-essential technologies be added in future, they will be activated only after your consent pursuant to Section 25(1) TDDDG and Art. 6(1)(a) GDPR, and this privacy policy will be updated accordingly.
8. External content and third-party providers
This website loads no third-party content. In particular, the following are not used:
- Google Fonts or other external font providers – all typefaces are loaded locally from our own server
- content delivery networks for CSS, JavaScript or font files
- external image services or images hotlinked from other servers
- web analytics or statistics services
- marketing, remarketing or social media pixels
- Google Maps or other mapping services
- YouTube, Vimeo or other video services
- reCAPTCHA or other external CAPTCHA services
Accessing this website therefore establishes no connection to third-party servers. Should this change, we will extend this privacy policy with a dedicated section for each provider actually used.
9. Recipients and processors
Personal data is disclosed only where this is necessary to fulfil the purposes described above, where a legal obligation exists, or where another legal basis applies.
Recipients may in particular be:
- our hosting and email provider Namecheap, Inc. (processing under Art. 28 GDPR)
- tax advisors and accountants
- banks and payment service providers in the course of invoicing
- insurers, where a claim requires it
- suppliers and subcontractors, where necessary to carry out the work
- authorities and public bodies where legally required
Service providers that process personal data on our behalf are engaged – where legally required – on the basis of a data processing agreement pursuant to Art. 28 GDPR.
10. Transfers to third countries
Our hosting and email provider Namecheap, Inc. is a company based in the United States of America. Processing of personal data outside the European Economic Area can therefore not be ruled out.
Where personal data is transferred to recipients outside the European Economic Area, this takes place only in compliance with Art. 44 et seq. GDPR, in particular on the basis of the European Commission’s standard contractual clauses agreed with the provider pursuant to Art. 46(2)(c) GDPR.
Processing outside the European Economic Area may also occur if you contact us via WhatsApp (see section 6).
11. Retention periods
We store personal data only for as long as is necessary for the respective processing purpose.
Beyond that, data may be stored where statutory retention obligations exist or where storage is necessary to establish, exercise or defend legal claims.
Once the processing purpose no longer applies and the relevant retention periods have expired, the data is deleted or anonymised.
12. Your rights
Within the statutory requirements, you have in particular the right to:
- access under Art. 15 GDPR
- rectification under Art. 16 GDPR
- erasure under Art. 17 GDPR
- restriction of processing under Art. 18 GDPR
- data portability under Art. 20 GDPR
- object under Art. 21 GDPR
- withdraw consent under Art. 7(3) GDPR
Withdrawing consent does not affect the lawfulness of processing carried out on the basis of that consent before its withdrawal.
To exercise your rights, please contact us using the contact details given above.
13. Right to lodge a complaint
Under Art. 77 GDPR you have the right to lodge a complaint with a data protection supervisory authority if you consider that the processing of your personal data infringes the GDPR.
The authority responsible for our registered office is:
Der Landesbeauftragte für den Datenschutz und die Informationsfreiheit Baden-Württemberg
Lautenschlagerstraße 20
70173 Stuttgart
Germany
14. Data security
We take appropriate technical and organisational measures to protect personal data against loss, unauthorised access, alteration or unauthorised disclosure.
15. Updates to this privacy policy
We update this privacy policy whenever the services we use, our data processing or the legal requirements change.
Last updated: September 2026