Privacy Policy

for the website https://stefan-thormann.com — Effective: June 2026

1. Data Controller within the meaning of Data Protection Law

The controller responsible for processing personal data on this website within the meaning of Art. 4 (7) of the General Data Protection Regulation (GDPR) is:

2. EU Representative pursuant to Art. 27 GDPR

The controller is established and resident outside the European Economic Area (EEA). To the extent that personal data of data subjects located in the Union are processed and such processing is not merely occasional in nature, an EU representative is designated pursuant to Art. 27 GDPR.

The details of the designated EU representative will be published here as soon as the designation has been completed.

3. General Information on Data Processing

3.1 Scope of Processing of Personal Data

We process personal data of our users only insofar as this is necessary to provide a functional website as well as our content and services. The processing of our users' personal data is generally carried out only with the user's consent. An exception applies in cases where prior consent cannot be obtained for factual reasons and the processing of the data is permitted by statutory provisions.

3.2 Legal Basis for Processing

Where we obtain consent of the data subject for processing operations, Art. 6 (1) lit. a GDPR serves as the legal basis. For the processing of personal data necessary for the performance of a contract to which the data subject is party, Art. 6 (1) lit. b GDPR serves as the legal basis. This also applies to processing operations necessary to carry out pre-contractual measures.

Where processing of personal data is necessary for compliance with a legal obligation to which our enterprise is subject, Art. 6 (1) lit. c GDPR serves as the legal basis. If the processing is necessary for the purposes of the legitimate interests pursued by our enterprise or by a third party, and such interests are not overridden by the interests, fundamental rights and freedoms of the data subject, Art. 6 (1) lit. f GDPR serves as the legal basis for the processing.

3.3 Data Erasure and Storage Period

The data subject's personal data will be erased or blocked as soon as the purpose for which they are stored ceases to apply. Storage beyond this may take place if it has been provided for by European or national legislators in Union regulations, laws or other provisions to which the controller is subject. The data will also be blocked or erased when a storage period prescribed by the aforementioned standards expires, unless there is a need for further storage of the data for the conclusion or fulfilment of a contract.

4. Provision of the Website and Creation of Log Files

4.1 Description and Scope of Data Processing

Each time our website is accessed, our system automatically collects data and information from the computer system of the calling computer. The following data is collected:

• IP address of the user (generally anonymised)
• Date and time of access
• Internet service provider of the user
• Browser and operating system used
• Access method/function (e.g. GET, POST)
• Volume of data transferred
• Source from which the access was made (referrer)

The data is also stored in the log files of our system. Storage of this data together with other personal data of the user does not take place.

4.2 Legal Basis for Data Processing

The legal basis for the temporary storage of the data and log files is Art. 6 (1) lit. f GDPR. Our legitimate interest lies in ensuring the functionality, stability and security of the website.

4.3 Duration of Storage

The data is erased as soon as it is no longer required to achieve the purpose of its collection. In the case of data collection for the provision of the website, this is the case when the respective session has ended. Log files are stored for a maximum of seven (7) days. Storage beyond this period is possible if the IP addresses of the users are anonymised or deleted so that an assignment of the calling client is no longer possible.

5. Hosting and Content Delivery Network by Cloudflare

This website is provided via Cloudflare Pages, a service of Cloudflare, Inc., 101 Townsend Street, San Francisco, CA 94107, USA (hereinafter "Cloudflare"). EU establishment: Cloudflare Germany GmbH, Rosental 7, c/o Mindspace, 80331 Munich, Germany. Each time the website is visited, technical connection data (see Sec. 4) is processed by Cloudflare in order to deliver the website via a globally distributed content delivery network (CDN) as well as to provide security and protection functions (e.g. attack mitigation, DDoS protection). The legal basis is Art. 6 (1) lit. f GDPR; our legitimate interest lies in the secure, stable and performant provision of the website.

Processing is carried out on behalf of the controller on the basis of an order processing agreement in accordance with Art. 28 GDPR. Cloudflare operates a worldwide server network; this may involve the transfer of personal data to third countries, in particular the USA. Cloudflare, Inc. is certified under the EU-US Data Privacy Framework. In addition, the transfer is based on the Standard Contractual Clauses of the European Commission pursuant to Art. 46 (2) lit. c GDPR.

Further information on data protection at Cloudflare: https://www.cloudflare.com/privacypolicy/

6. Contact by Email

6.1 Description and Scope of Data Processing

Direct contact by email to [email protected] is possible on the website. In this case, the user's personal data transmitted with the email is stored (name, email address, content of the enquiry, where applicable telephone number and other voluntarily provided data).

6.2 Legal Basis for Data Processing

The legal basis for the processing of the data is Art. 6 (1) lit. a GDPR if the user has given consent. The legal basis for the processing of data transmitted in the course of sending an email is Art. 6 (1) lit. f GDPR. If the email contact is aimed at the conclusion of a contract, the additional legal basis for the processing is Art. 6 (1) lit. b GDPR.

6.3 Duration of Storage

The data is erased as soon as it is no longer required for achieving the purpose for which it was collected. This is the case when the respective conversation with the user has ended and the matter has been conclusively clarified. If commercial or tax-related retention obligations exist, deletion takes place after the relevant retention periods have expired.

7. Use of Cookies

The website uses cookies. Cookies are small text files that are stored in the internet browser or by the internet browser on the user's computer system. Cookies contain information that enables the user to be recognised when the website is accessed again.

7.1 Technically Necessary Cookies

We use cookies to make our website more user-friendly. Some elements of our website require the calling browser to be identifiable even after a page change. The legal basis is Art. 6 (1) lit. f GDPR.

7.2 Analytics and Marketing Cookies

Where analytics or marketing cookies are used, this is done exclusively on the basis of the user's express consent in accordance with Art. 6 (1) lit. a GDPR in conjunction with Section 25 (1) TDDDG (formerly TTDSG). Consent can be revoked at any time with effect for the future.

7.3 Management and Deletion of Cookies

You can prevent the installation of cookies by setting your browser software accordingly; however, we would like to point out that in this case you may not be able to use all functions of this website to their full extent. You can delete cookies already stored in your browser at any time.

8. Rights of the Data Subject

If your personal data is processed, you are a data subject within the meaning of the GDPR and you have the following rights vis-à-vis the controller:

8.1 Right of Access (Art. 15 GDPR)

You may request confirmation from the controller as to whether personal data concerning you is processed by us, as well as information about this data and the circumstances of its processing.

8.2 Right to Rectification (Art. 16 GDPR)

You have the right to rectification and/or completion vis-à-vis the controller if the personal data processed concerning you is inaccurate or incomplete. Rectification must be made without undue delay.

8.3 Right to Erasure (Art. 17 GDPR)

You may request from the controller that the personal data concerning you be erased without undue delay, provided that one of the reasons set out in Art. 17 (1) GDPR applies.

8.4 Right to Restriction of Processing (Art. 18 GDPR)

You may request the restriction of the processing of personal data concerning you under the conditions of Art. 18 GDPR.

8.5 Right to Data Portability (Art. 20 GDPR)

You have the right to receive personal data concerning you, which you have provided to the controller, in a structured, commonly used and machine-readable format.

8.6 Right to Object (Art. 21 GDPR)

You have the right to object, on grounds relating to your particular situation, at any time to the processing of personal data concerning you which is based on Art. 6 (1) lit. e or f GDPR.

8.7 Right to Withdraw Consent (Art. 7 (3) GDPR)

You have the right to withdraw your data protection consent at any time. The withdrawal of consent does not affect the lawfulness of the processing carried out on the basis of the consent up to the withdrawal.

8.8 Right to Lodge a Complaint with a Supervisory Authority (Art. 77 GDPR)

Without prejudice to any other administrative or judicial remedy, you have the right to lodge a complaint with a supervisory authority, in particular in the Member State of your habitual residence, place of work or place of the alleged infringement, if you consider that the processing of personal data relating to you infringes the GDPR.

As the controller does not maintain an establishment in Germany, the territorial competence of the supervisory authority is determined by the place of residence or work of the data subject or the place of the alleged infringement. An overview of the German data protection supervisory authorities is available at https://www.bfdi.bund.de.

9. Data Transfer to Third Countries

The controller itself is located in the Philippines. Personal data transmitted to us by data subjects located in the EU/EEA is processed in a third country (Philippines) within the meaning of Art. 44 et seq. GDPR. The Republic of the Philippines does not have an adequacy decision of the European Commission within the meaning of Art. 45 GDPR.

The transfer is based on appropriate safeguards within the meaning of Art. 46 GDPR, in particular (i) the express consent of the data subject after being informed of the risks associated with the transfer (Art. 49 (1) lit. a GDPR), (ii) necessity for the performance of a contract between the data subject and the controller (Art. 49 (1) lit. b GDPR), or (iii) necessity for important reasons of public interest (Art. 49 (1) lit. d GDPR).

The Philippines has the Data Privacy Act of 2012 (R.A. 10173) as its national data protection law. The supervisory authority is the National Privacy Commission (NPC), https://privacy.gov.ph.

10. SSL/TLS Encryption

This website uses SSL or TLS encryption for security reasons and to protect the transmission of confidential content. You can recognise an encrypted connection by the fact that the address line of the browser changes from "http://" to "https://" and by the lock symbol in your browser line.

11. Currency and Amendment of this Privacy Policy

This Privacy Policy is currently valid and has the status of June 2026. Due to the further development of our website and offers or due to amended statutory or regulatory requirements, it may be necessary to amend this Privacy Policy. The current Privacy Policy can be accessed and printed out by you at any time on the website at https://stefan-thormann.com/privacy.

12. Contact for Data Protection Questions

If you have any questions about the collection, processing or use of your personal data, about information, rectification, blocking or erasure of data, or about the revocation of consent given, please contact:

Email: [email protected]
Postal address: see Sec. 1.

This English version is a translation provided for convenience only. In case of discrepancies, the German version shall prevail.