Skip to content

Privacy Policy

1. Responsible party

Paul Finn Koch
Munich, Germany
Email: kontakt@paulfinnkoch.com

2. Hosting

This website is hosted by Netlify, Inc., 2325 3rd Street, Suite 296, San Francisco, CA 94107, USA. Netlify provides content delivery infrastructure where personal data such as IP addresses may be processed for secure, efficient website operation. Data processing occurs partly in the USA, with Standard Contractual Clauses (SCC) per Art. 46 GDPR established.

Details: https://www.netlify.com/privacy/

3. Collection and processing of personal data

When visiting this website, the following data is automatically collected in the hosting provider's log files:

Legal basis: Art. 6(1)(f) GDPR (legitimate interest in technical functionality, stability, security, and optimization of the website).

This website sets no cookies without your consent and loads no third-party services without consent. To measure the reach of our advertising we use the Meta pixel described under section 5, and only after your explicit consent.

4. Contact form

When you send an enquiry through the contact form, I process the details you provide: name, email address, optionally your company, as well as the topic, budget range, and your message. The website check additionally collects your phone number, your selected goal and whether you already have a website. Depending on your choice, we collect either your website address or a short description of your business and offering for an initial consultation. The enquiry type is saved to identify the requested service. I use your phone number and email address to arrange the requested check personally. If present in the link you opened, the campaign parameters utm_source, utm_medium, utm_campaign, and utm_content are also stored with your enquiry to identify its source.

Purpose: solely to handle and respond to your enquiry and to explore possible cooperation.

Legal basis: Art. 6(1)(b) GDPR (pre-contractual measures) and Art. 6(1)(a) GDPR (your consent, which you may withdraw at any time with effect for the future).

Processing: Submission runs through Netlify Forms, a service of Netlify, Inc. The form data is stored there and forwarded to me by email. The same information on third-country transfers and standard contractual clauses applies as under section 2.

Retention: Your enquiry is deleted once it has been conclusively handled, provided no statutory retention obligations apply. Where cooperation follows, commercial and tax retention periods apply.

To protect against automated submissions, the form contains a field that is invisible to you (honeypot). Your details are not shared for advertising purposes.

4a. Enquiries through Meta instant forms

Our Facebook and Instagram ads let you request a free website check or initial consultation directly through an instant form. The platform provider is Meta Platforms Ireland Limited. We receive your name, email address, phone number and whether you already have a website. Depending on your answer, we also receive your website address or a short description of your business and offering. Meta may prefill contact fields from your profile; please check them before submitting.

We use these details solely to handle the requested consultation and arrange an appointment personally by phone or email. The enquiry does not oblige you to commission work or subscribe you to a newsletter. The legal basis is Art. 6(1)(b) GDPR where necessary for the pre-contractual steps you requested, or Art. 6(1)(f) GDPR for enquiries from company representatives (legitimate interest in handling business enquiries).

Meta transmits the details and makes them available to us in its business tools. Attribution to the ad helps us assess which ads generate enquiries. We delete the enquiries we hold once they have been conclusively handled, unless statutory retention obligations apply. Our contact address and your rights are described in sections 1 and 7. Meta's own processing, including possible international transfers, is additionally described in Meta's privacy policy.

5. Meta pixel (Facebook and Instagram)

We run ads on Facebook and Instagram. To measure which ads lead to an enquiry, we use the visitor action pixel of Meta Platforms Ireland Limited, 4 Grand Canal Square, Dublin 2, Ireland.

The pixel is only loaded after you have agreed in the consent banner. If you decline or make no choice, it is not loaded, no cookies are set, and no data is sent to Meta. The website works in full without consent.

Once you consent, the following data in particular is processed: your IP address, information about your browser and device, the pages you visit, and whether you submitted the contact form. Meta may link this data to your user account if you are logged in to Facebook or Instagram, and use it for its own purposes. We have no influence over Meta's further processing.

Legal basis: your consent under Art. 6(1)(a) GDPR and § 25(1) TTDSG. You can withdraw your consent at any time with effect for the future, at no disadvantage to you: change consent.

Transfers to third countries: a transfer to the USA cannot be ruled out. Meta relies on the EU-US Data Privacy Framework and on standard contractual clauses. Despite these safeguards, access by US authorities cannot be fully excluded.

Joint controllership: we are jointly responsible with Meta for the collection and transmission of this data (Art. 26 GDPR). Further information is available in Meta's privacy policy.

6. Data sharing

Personal data is not shared with third parties unless required for contractual fulfillment, legally mandated, or there is a legitimate interest without overriding protections of the data subject. Third-country transfers (USA) are based on Standard Contractual Clauses.

7. Rights of data subjects

Under the GDPR, you have the following rights:

You also have the right to lodge a complaint with a data protection supervisory authority regarding the processing of your personal data.

8. Security

Technical and organizational security measures are in place to protect your data against loss, destruction, manipulation, and unauthorized access. These measures are continuously updated.