Privacy policy
Last updated: 25 September 2026
This is a courtesy translation. Only the German version is legally binding. → /datenschutz/
Here you can find out what data I process when you visit this website or contact me, and what rights you have. In short: this website does not use cookies for advertising or analytics purposes and does not embed content from third-party providers such as Google Fonts, YouTube or social media plugins.
1. Controller
Marvin Pirner – IV Digital, Törlenstraße 67, 82467 Garmisch-Partenkirchen, Germany · Phone +49 151 20260201 · Email letters@marvinpirner.com
No data protection officer has been appointed, as there is no statutory obligation to do so.
2. Hosting and provision of the website (Cloudflare)
This website is provided via Cloudflare (Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107, USA). When you access the site, Cloudflare processes technically necessary data: IP address, date and time, page accessed, browser and device information, referrer. This serves to deliver the page, ensure security (e.g. defence against attacks) and ensure stability.
Legal basis: Art. 6(1)(f) GDPR (legitimate interest in a secure, fast website). A data processing agreement is in place with Cloudflare. For any transfer to the USA, the processing relies on the European Commission's adequacy decision for the EU-US Data Privacy Framework (Art. 45 GDPR), under which Cloudflare is certified, supplemented by the European Commission's Standard Contractual Clauses (Art. 46 GDPR).
Retention period: log data is stored by Cloudflare only for a short time and then deleted or anonymised.
3. Cookie-free analytics (Cloudflare Web Analytics)
To understand which pages are read, I use Cloudflare Web Analytics. The service does not set cookies, does not use local storage and does not create profiles of individual visitors. Aggregated information such as page views, referring page, country, and browser and device type is collected. According to Cloudflare, IP addresses are not stored for identification purposes.
Legal basis: Art. 6(1)(f) GDPR (legitimate interest in a needs-based website). Because neither cookies nor storage on your device are used, no consent under Section 25 of the German Telecommunications Digital Services Data Protection Act (TDDDG, "Telekommunikation-Digitale-Dienste-Datenschutz-Gesetz") is required.
Provider and third-country transfer as under item 2.
4. Contact form and initial-consultation request
If you use the form, I process the information you provide: name, email address, and optionally company, industry, phone number, desired type of consultation, desired package, message, and – if you arrive via a link such as the flyer QR code – the source information (e.g. "flyer"). This information is
- stored in a database at Cloudflare (Cloudflare D1; the storage region is set to Europe) so that no request is lost, and
- sent by email via the delivery service Resend (Resend, Inc., 2261 Market Street #5039, San Francisco, CA 94114, USA; sent via servers in the EU, Ireland region) to my mailbox.
Purpose: processing your request and arranging an appointment. Legal basis: Art. 6(1)(b) GDPR (pre-contractual measures taken at your request) and Art. 6(1)(f) GDPR (legitimate interest in responding to enquiries).
Data processing agreements are in place with Resend and Cloudflare. Both providers are certified under the EU-US Data Privacy Framework; any transfer to the USA relies on this adequacy decision (Art. 45 GDPR), supplemented by Standard Contractual Clauses (Art. 46 GDPR).
Providing your name and email address is required so that I can reply to you; all other information is voluntary. Without this information I cannot process your enquiry via the form – but you can always call me instead.
Retention period: requests in the database are automatically deleted after 12 months. If an engagement results, I retain the data necessary for its handling in accordance with statutory retention obligations (generally 6 or 8 years for business correspondence and accounting records).
Abuse protection: the form contains a hidden field against automated entries and briefly limits the number of requests per IP address; for this purpose, the IP address is stored only in working memory and not permanently.
5. Contact by email and phone
If you send me an email or call me, I process your information to handle your enquiry (Art. 6(1)(b) or (f) GDPR). My email mailbox is operated by STRATO GmbH, Otto-Ostrowski-Straße 7, 10249 Berlin, in Germany; a data processing agreement is in place with STRATO. I delete emails as soon as they are no longer needed for processing and no retention obligations apply.
6. Online appointments with Google Meet
For online appointments I use Google Meet (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland). The data processed is that necessary to conduct the appointment: name or display name, email address where applicable, video and audio data during the appointment, and technical connection data. Appointments are not recorded. Legal basis: Art. 6(1)(b) GDPR. A transfer to Google LLC in the USA is possible; Google is certified under the EU-US Data Privacy Framework. If you do not wish to use Google Meet, we can talk by phone or in person.
7. Engagements and invoices
When we work together, I process the data necessary for the contract (name, address, contact details, appointments, services, invoicing and payment data). Legal basis: Art. 6(1)(b) GDPR (performance of a contract) and Art. 6(1)(c) GDPR (statutory retention obligations under Section 147 of the German Fiscal Code (AO, "Abgabenordnung") and Section 257 of the German Commercial Code (HGB, "Handelsgesetzbuch"), generally 6 or 8 years). Payments by bank transfer are processed by your bank and mine on their own responsibility. For bookkeeping I may engage a tax advisor who is professionally bound to confidentiality.
7a. Fonts
The fonts used on this website are served from my own server. There is no connection to Google Fonts or other font providers.
8. No disclosure, no advertising
I do not disclose your data to third parties, except to the service providers named above, who process it only on my behalf, or where I am legally obliged to do so. There is no automated decision-making and no profiling.
9. Your rights
You have the right to access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20), and to withdraw any consent given with effect for the future (Art. 7(3)).
Right to object (Art. 21 GDPR): where I process data on the basis of a legitimate interest (Art. 6(1)(f)), you may object at any time for reasons arising from your particular situation.
An informal message to letters@marvinpirner.com is sufficient.
Right to lodge a complaint: you may lodge a complaint with a data protection supervisory authority, for example the Bavarian Data Protection Authority (BayLDA, "Bayerisches Landesamt für Datenschutzaufsicht"), Promenade 18, 91522 Ansbach.
10. Security
The connection to this website is encrypted using TLS (indicated by "https").
11. Changes
I will adapt this privacy policy if the website or the legal situation changes. The version published here at any given time applies.