Privacy Policy

1. Data Controller

The data controller responsible for your personal data is:

N&K Webdesign
Munich, Bavaria, Germany
Email: main@nkwebdesign.de
Website: https://nkwebdesign.de

This privacy policy is provided in accordance with the EU General Data Protection Regulation (GDPR, Regulation EU 2016/679) and the German Federal Data Protection Act (Bundesdatenschutzgesetz, BDSG).

2. What Data We Collect

2.1 Contact Form

When you submit our contact form, we collect:

• Full name
• Email address
• Company name (optional)
• Service of interest (optional)
• Message content
• Date and time of submission

2.2 Analytics (with consent only)

If you consent to analytics cookies, Google Analytics 4 collects:

• Pages visited and time spent
• Browser type and operating system (aggregated)
• Referring website
• Country and city (approximate, via IP — IP address is anonymised)
• Device type (desktop / mobile / tablet)

This data is collected in aggregate and cannot be used to identify you personally. IP anonymisation is enabled.

2.3 Technical Data (server logs)

Our hosting provider may collect standard server log data including IP addresses, access timestamps, and requested URLs for security and diagnostic purposes. This data is not used for marketing and is deleted after 7 days.

3. Legal Basis for Processing

Processing Activity	Legal Basis (GDPR Art. 6)
Contact form submission and responding to enquiries	Art. 6(1)(b) — Performance of a contract / pre-contractual steps
Analytics cookies (Google Analytics 4)	Art. 6(1)(a) — Consent
Essential cookies (cookie preferences, theme)	Art. 6(1)(f) — Legitimate interests (website functionality)
Server access logs	Art. 6(1)(f) — Legitimate interests (security)
Sending project quotes and proposals	Art. 6(1)(b) — Pre-contractual relationship

4. Data Retention Periods

Data Type	Retention Period	Reason
Contact form enquiries (no contract)	12 months	Follow-up enquiries; deleted after no response
Client project data and correspondence	10 years	German commercial law (§ 257 HGB)
Invoice and payment data	10 years	German tax law (§ 147 AO)
Analytics data (Google Analytics)	14 months (GA4 default)	Trend analysis
Cookie consent records	1 year	Compliance documentation
Server access logs	7 days	Security monitoring

5. Third-Party Processors

5.1 Web3Forms

Our contact form uses Web3Forms to forward form submissions to our email address. Web3Forms processes your contact form data to deliver the submission. Data is not stored longer than required for delivery. See their privacy policy.

5.2 Google Analytics 4 (consent-dependent)

We use Google Analytics 4, provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Analytics is only loaded after you grant consent via our cookie banner. IP anonymisation is activated. Google may transfer data to the USA under Standard Contractual Clauses. See Google's privacy policy.

5.3 Google Fonts

This website loads fonts from Google Fonts (Google Ireland Limited). When your browser requests a font file, your IP address is transmitted to Google's servers. We use these fonts solely for visual presentation. See Google Fonts privacy FAQ. Note: To eliminate this transfer, fonts can be self-hosted. Contact us if you prefer this for a project.

5.4 Hosting

This website is hosted via a third-party hosting provider. The provider acts as a data processor under a data processing agreement (DPA) and may process access log data as described in Section 2.3.

6. International Data Transfers

Some of our third-party providers (Google) may transfer your data outside the European Economic Area (EEA). These transfers are covered by Standard Contractual Clauses (SCCs) approved by the European Commission pursuant to Art. 46 GDPR, or by an adequacy decision.

7. Your Rights Under GDPR

You have the following rights under GDPR:

• Right of access (Art. 15): Request a copy of the personal data we hold about you.
• Right to rectification (Art. 16): Request correction of inaccurate data.
• Right to erasure (Art. 17): Request deletion of your data ("right to be forgotten"), subject to legal retention obligations.
• Right to restriction (Art. 18): Request that we restrict processing of your data.
• Right to data portability (Art. 20): Receive your data in a structured, machine-readable format.
• Right to object (Art. 21): Object to processing based on legitimate interests.
• Right to withdraw consent (Art. 7(3)): Withdraw analytics consent at any time via our Cookie Settings link. Withdrawal does not affect prior processing.

To exercise any of these rights, email us at main@nkwebdesign.de. We will respond within 30 days. We may need to verify your identity before acting on a request.

8. Right to Lodge a Complaint

If you believe we are processing your data in violation of GDPR, you have the right to lodge a complaint with the supervisory authority. The competent authority for Bavaria, Germany is:

Bayerisches Landesamt für Datenschutzaufsicht (BayLDA)
Promenade 27, 91522 Ansbach, Germany
Tel: +49 (0) 981 180093-0
Website: www.lda.bayern.de

9. Cookies

We use cookies as described in our Cookie Policy. You can manage your preferences via the cookie banner or the Cookie Settings link in our footer.

10. Children's Privacy

Our services are not directed at individuals under the age of 16. We do not knowingly collect personal data from minors. If you believe a minor has submitted data through our site, contact us at main@nkwebdesign.de and we will delete it promptly.

11. Changes to This Policy

We may update this privacy policy from time to time. Material changes will be indicated by a new "Last updated" date at the top of this page. Continued use of our website after changes constitutes acceptance of the revised policy.

12. Contact

For any privacy-related questions, requests, or complaints, contact us at:

N&K Webdesign
Munich, Bavaria, Germany
main@nkwebdesign.de