Privacy

This English version is provided for convenience. Only the German version is legally binding.

This privacy policy explains which personal data we process when you visit this website, contact us, place an order and use the client area, for what purpose we do so, and what rights you have. Last updated: October 2026.

1. Controller

Phone: +49 1556 7753440
Email: hello@thaevenweb.com

2. Key points at a glance

• The pages of this website set no cookies and use no analytics or tracking tools. We only set technically necessary cookies when you place an order and in the client area.
• Fonts, images, videos and scripts are hosted on our own web server. No third-party content is loaded when you open a page.
• We only receive personal data if you contact us, order something or use the client area, and in the form of technically necessary server log files.
• Payments are processed by Stripe. You enter your card or account details directly with Stripe; we do not receive them.

3. Hosting and server log files

This website is run by an external hosting provider that processes data on our behalf (Art. 28 GDPR). Each time the site is accessed, the web server automatically stores information transmitted by your browser:

• IP address of the requesting device
• Date and time of access
• Page or file accessed and amount of data transferred
• Referrer URL (the previously visited page)
• Browser type and version, and operating system
• HTTP status code

This data is required to deliver the website and to ensure its security and stability, for example to detect and fend off attacks. The legal basis is Art. 6(1)(f) GDPR; our legitimate interest lies in the secure and error-free operation of the website. The log files are deleted as soon as they are no longer required for these purposes.

4. Contact form

If you write to us via the contact form, we process the data you enter: the selected topic, name, company, email address, phone number, your current website and your message. Required fields are marked; all other information is voluntary.

Your details are sent to us by email, also stored in our customer management system on our host's server and used solely to process your enquiry, for example for a first draft of your new website. The legal basis is Art. 6(1)(b) GDPR where your enquiry relates to a contract or a quote, and otherwise Art. 6(1)(f) GDPR (our legitimate interest in responding to enquiries).

To protect against misuse and automated spam, our server stores a non-reversible hash of your IP address for a maximum of one hour in order to limit the number of messages per sender (Art. 6(1)(f) GDPR). The IP address itself is not stored. In addition, while you fill in the form your browser solves a small computing task in the background that our server sets and checks. No cookies are set, no personal data is processed and no third-party services are involved.

We delete your enquiry once it has been fully dealt with, provided that no statutory retention obligations prevent this. If an enquiry does not lead to an order, we delete it after twelve months at the latest. Business letters and quotes are subject to retention periods of up to ten years under commercial and tax law.

5. Website check

With our free website check, you enter the address of a website. Our server sends this address to Google PageSpeed Insights (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland). Google loads the website and evaluates it. Our server does not pass your IP address or any other data about you to Google.

We store the result for no more than 30 minutes, so that checking the same address again does not query Google a second time. To prevent misuse, we count checks per hour using a daily changing hash of your IP address that cannot be reversed. The legal basis is Art. 6(1)(f) GDPR; our legitimate interest lies in offering the check free of charge and protecting it from misuse. If you then request a draft, section 4 applies; we send the result of the check along with your request.

6. Contact by email or phone

If you contact us by email or phone, we process your details (for example your name, contact details and the content of your enquiry) in order to deal with your request. The legal bases and storage period are the same as those set out in section 4.

7. Online ordering

If you order a website, we process the details from the order form: company, contact person, email address, phone number, address, VAT ID where applicable, website or preferred domain, your message and the selected package and model. We also store when you accepted the terms and conditions. The legal basis is Art. 6(1)(b) GDPR (contract and pre-contractual measures).

For payment, we redirect you to Stripe (Stripe Payments Europe, Ltd., 1 Grand Canal Street Lower, Grand Canal Dock, Dublin, D02 H210, Ireland). For this purpose, we transmit your company, email address, phone number and address as well as the order number and amount to Stripe. You enter your payment details (e.g. card or IBAN) directly with Stripe; we do not receive them. Stripe may also process data in the USA; the transfer is safeguarded by the EU-U.S. Data Privacy Framework or by standard contractual clauses. More information: stripe.com/de/privacy.

So that you can set your password straight after payment, we set a technically necessary cookie (“tw_order”, valid for 24 hours). The legal basis is § 25(2) no. 2 TDDDG (German Telecommunications and Digital Services Data Protection Act). We keep invoice and order data for up to ten years in accordance with commercial and tax law.

8. Client area

In the client area, we process your account data (email address, a password stored in encrypted form, company details), contract and invoice data, and everything you enter or upload there – for example your briefing, requests, files and approvals. The legal basis is Art. 6(1)(b) GDPR.

To log you in, we set a technically necessary session cookie (“tw_s”). It is deleted when you log out or close your browser, or after 30 days at the latest if you choose “Stay logged in”. The legal basis is § 25(2) no. 2 TDDDG. To protect against attacks on passwords, we count login attempts using a non-reversible hash of your IP address that changes daily (Art. 6(1)(f) GDPR).

We store your data for as long as you are a client. After that, we delete it unless statutory retention obligations apply. We send you emails relating to your account, for example about your order, replies to requests or invoices; you can switch off individual notifications in the client area.

9. Visitor counting for client websites

On the websites of our care clients, we operate our own cookie-free visitor counting on behalf of the respective client (Art. 28 GDPR). We record the page accessed, the referring website, the screen width and the browser type. To count each visitor only once per day, we create a hash from the IP address, browser and website that changes daily and is deleted after two days; we do not store the IP address itself. Only aggregated figures are stored. The respective operator of the client website is the controller. On the pages of thaevenweb.com itself, we count our own visits in the same way; the legal basis is our legitimate interest in data-minimising, cookie-free reach measurement (Art. 6(1)(f) GDPR).

10. Recipients

Your data is only received by the people who need it for the purposes stated. Technical service providers such as our hosting and email provider process data only on our behalf and in accordance with our instructions. Stripe processes some payment data under its own responsibility. Where a service provider processes data outside the EU or the EEA, this only takes place subject to the requirements of Art. 44 et seq. GDPR. Data is only passed on to other third parties if we are legally obliged to do so.

11. Encryption

This website uses TLS encryption. You can recognise an encrypted connection by “https://” in your browser’s address bar. This means that data you send via our forms or in the client area cannot be read by third parties.

12. Your rights

Within the scope of the statutory provisions, you have the following rights at any time:

• Access to the data we hold about you (Art. 15 GDPR)
• Rectification of inaccurate data (Art. 16 GDPR)
• Erasure (Art. 17 GDPR)
• Restriction of processing (Art. 18 GDPR)
• Data portability (Art. 20 GDPR)
• Withdrawal of any consent given, with effect for the future (Art. 7(3) GDPR)

Right to object: If we process your data on the basis of Art. 6(1)(f) GDPR, you may object to the processing at any time on grounds relating to your particular situation (Art. 21 GDPR).

To exercise your rights, an informal message to hello@thaevenweb.com is sufficient.

You also have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR), for example the Bavarian State Office for Data Protection Supervision (BayLDA), Promenade 18, 91522 Ansbach, www.lda.bayern.de.

13. No obligation to provide data, no automated decision-making

You are not obliged to provide us with personal data. However, without the information marked as required, we cannot process your enquiry. No automated decision-making, including profiling, takes place.

14. Changes

We update this privacy policy whenever the website or the legal requirements change. The version published here at the time applies.