Privacy

This site sets no cookies, loads nothing from third-party servers and does not track visitor behaviour. That is why there is no consent banner. It is not an omission but a consequence of how the site is built: what isn't loaded doesn't need permission.

This is a translation of the German Datenschutzerklärung.

1. Controller

No data protection officer has been appointed; the legal requirements for one are not met.

2. Visiting the site

When you visit the site, your browser transmits technically necessary data to the server: IP address, time, requested address, amount of data transferred, browser identifier and the page you came from. A page cannot be delivered without this information.

The legal basis is Art. 6(1)(f) GDPR. The legitimate interest lies in running the site without errors and fending off attacks. This data is not combined with other sources and not analysed to recognise you.

3. Hosting

The site is hosted by Cloudflare. The contracting party for customers in the European Economic Area is Cloudflare Germany GmbH, Rosental 7, 80331 Munich, Germany. Cloudflare processes the data listed in section 2 on my behalf; a data processing agreement under Art. 28 GDPR is in place.

A transfer to the United States cannot be ruled out. Cloudflare bases such transfers on the European Commission's Standard Contractual Clauses and is certified under the EU-US Data Privacy Framework.

4. Contact form

When you submit the form, the following is transmitted: your name, the way back you provide (email address or phone number), your message and, if you used the price calculator, your selection. I receive this by email.

The request is also stored with the host so that it isn't lost if sending the email fails. This copy is deleted automatically after 90 days.

The legal basis is Art. 6(1)(b) GDPR where your request aims at a contract, otherwise Art. 6(1)(f) GDPR because of the legitimate interest in answering requests. Consent is not required. Providing the data is voluntary, but without it I cannot reply.

I keep your request and my reply until their purpose no longer applies. Statutory retention periods remain unaffected.

Protection against automated submissions

The form works without a captcha and without any third-party service. Instead, it checks whether an invisible field was filled in and how much time passed between loading and submitting. The number of submissions per sender is also limited. For this, your IP address is not stored, only a check value derived from it that cannot be reversed and expires by itself after one hour.

5. WhatsApp

The site contains a link to WhatsApp. It is an ordinary link, not an embedded window or a WhatsApp script. As long as you don't click it, nothing is sent to WhatsApp.

If you click it, WhatsApp opens, and from that moment the terms of WhatsApp Ireland Limited apply. In particular, your phone number and your message are then transmitted. I have no influence on this processing. If you don't want that, please use the form or send an email.

6. Business outreach by email

I email small businesses in the United States to ask whether they would like a new website. I do not email businesses in the European Union or in Canada.

What data: your business name, the business email address and website you published yourself, your city and state, the name of your contact person if it appears on your website, and the emails we exchanged.

Where it comes from: your own business website. I may have found your business there first through a public state register (for example a business or tax register), a chamber of commerce directory, a city's published list of building permits, BuildZoom or OpenStreetMap.

Why, and on what legal basis: to offer you my web design services. The legal basis is Art. 6(1)(f) GDPR; my legitimate interest is direct marketing for my services. I send at most three emails, with no tracking pixels and no tracked links.

Recipients: Google Cloud EMEA Limited (Ireland), which hosts my mailbox in Google Workspace; Notion Labs, Inc. (USA), where I keep my notes; and Anthropic (USA), whose AI assistant Claude I use to research businesses and draft emails. Mail to hallo@cladostudio.com is forwarded by Cloudflare (see section 3).

Transfers to the United States: for Google on the basis of the EU-US Data Privacy Framework, with the European Commission's Standard Contractual Clauses as a fallback; for Notion on the basis of the Standard Contractual Clauses; Anthropic states that it relies on the Standard Contractual Clauses.

How long: if you don't reply or aren't interested, I delete your data 90 days after my last email. If you object, I keep only your email address, the date and the type of entry (objection, complaint or undeliverable) on a do-not-contact list, so that I never email you again.

Objection: you can object to this processing at any time (Art. 21 GDPR). Just reply "no" to any of my emails, or write to the address above.

7. Storage on your device

No cookies are set and no identifier is stored. Interactive examples on the site remember your clicks only in the memory of the open browser tab and forget them as soon as you close it. This data never leaves your device.

8. No analysis, no sharing

There is no audience measurement, no analytics, no error reporting service and no advertising network. No fonts, maps, videos or icons are loaded from third-party servers. Your data is not sold, not traded and not used for advertising.

There is no automated decision-making and no profiling under Art. 22 GDPR.

9. Encryption

The connection is encrypted with TLS throughout. You can tell by the lock symbol in the address bar.

10. Your rights

• Access to the data held about you (Art. 15 GDPR)
• Rectification of inaccurate data (Art. 16 GDPR)
• Erasure (Art. 17 GDPR)
• Restriction of processing (Art. 18 GDPR)
• Data portability (Art. 20 GDPR)
• Objection to processing based on a legitimate interest (Art. 21 GDPR)

An informal message to the address above is enough. You can also lodge a complaint with a data protection supervisory authority (Art. 77 GDPR). The authority responsible for me is the State Commissioner for Data Protection and Freedom of Information of Baden-Württemberg, Germany.

11. Changes

If the site or the law changes, this policy will be updated. The version available here always applies.

Last updated: 5 October 2026