Legal
How we handle your data — GDPR/DSGVO compliant
David Sanker
Cologne, Germany
Email: [email protected]
Contact form submissions:
When you use our contact form, we collect your name, email address, selected service interest, and message. This data is used solely to respond to your inquiry and is retained for a maximum of 30 days after the conversation concludes. The legal basis is Art. 6(1)(b) GDPR (pre-contractual measures).
Website analytics:
We measure the use of this site with Plausible Analytics, which we host ourselves on our own server in Frankfurt am Main, Germany. Plausible sets no cookies and assigns no persistent identifier; your IP address is not stored, but combined with a daily-changing random value into a hash that cannot be reversed and becomes meaningless after 24 hours. The data never leaves our server. The legal basis is Art. 6(1)(f) GDPR (legitimate interest in understanding website usage); consent under § 25 TDDDG is not required because nothing is stored on or read from your device.
Appointment booking:
The “Book” links on this site lead to
book.lawkraft.com, our own scheduling application. It is
operated by us on our own server — not by an external booking
provider.
If you book an appointment there, we store the data you enter for that booking: your email address, your name where you provide it, and the appointment slot you choose. To show you which slots are free, the application queries the free/busy status of our own calendar via the Google Calendar API; that query transmits no data about you.
Only the free introductory conversation can be booked. No payment provider is involved in that booking and none is loaded on the booking page.
Web fonts:
This site loads its typefaces from Google Fonts
(fonts.googleapis.com, fonts.gstatic.com).
When a page loads, your browser contacts those servers directly, which
transmits your IP address to Google. The fonts are not currently
self-hosted.
Advertising measurement — only with your consent:
Nothing of this kind loads unless you accept it. If you do, this site additionally loads the Google Ads conversion tag (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland) and the LinkedIn Insight Tag (LinkedIn Ireland Unlimited Company, Wilton Plaza, Wilton Place, Dublin 2, Ireland). Both set cookies and recognise whether a click on one of our ads led to a visit here. Both providers build a profile of your behaviour and link it to data they already hold; if you are signed in with them, this visit can be attributed to your account. We have no influence over how far that linking goes.
Legal basis: § 25 (1) TDDDG and Art. 6 (1) (a) GDPR — your consent, and nothing else. Third-country transfers: both providers also process data in the United States, on the basis of the European Commission's adequacy decision on the EU-U.S. Data Privacy Framework. Retention: cookie lifetimes are set by Google and LinkedIn, not by us; according to their own information they range from a few days to 24 months depending on the cookie.
Without your consent none of this loads. The scripts are
present in the page source but disabled (type="text/plain")
and only run once you accept. A tracking pixel that cannot be switched
off is deliberately not included. There are no social-media plugins.
Content delivery (Cloudflare):
This site is delivered through the network of Cloudflare, Inc. (101 Townsend Street, San Francisco, CA 94107, USA), which caches it and protects it against attacks. In doing so Cloudflare processes your IP address and the technical data of each request. Legal basis: Art. 6 (1) (f) GDPR (legitimate interest in fast and secure delivery). Cloudflare is certified under the EU-U.S. Data Privacy Framework (participant list of the U.S. Department of Commerce, checked 2026-09-10); the transfer to the United States rests on the European Commission's adequacy decision for that framework.
We do not sell or trade your personal data. Your contact form data is processed only by David Sanker for the purpose of responding to your inquiry, and is passed to no one. There is one exception, and only one: if you have consented to advertising measurement (section 2), data is transmitted to Google and LinkedIn as described there. Without your consent this does not happen.
Contact form data: deleted within 30 days after the
conversation concludes.
Audience measurement (Plausible): aggregated and not
personal; no identifier is stored.
Server logs: see section on server log files.
Advertising measurement (only with consent): cookie
lifetimes and retention are determined by Google and LinkedIn, not by
us; according to their own information they range from a few days to
24 months depending on the cookie. Their notices govern:
Google and
LinkedIn. You can withdraw your consent at any time
(section 6); no new data is collected afterwards.
Under the GDPR, you have the right to:
To exercise these rights, contact us at [email protected].
Without your consent, this website sets no cookies at all — not even a technically necessary one. Plausible Analytics is cookie-free and always on. Cookies are set only if you accept in the consent dialog, and then only by the two advertising services named in section 2.
Your consent decision is stored in your browser's localStorage under the
key consent_v2. It remains on your device and is not
transmitted to our servers. This is not a cookie. Storing it is nonetheless an access to your device within the meaning of § 25 TDDDG; it needs no consent of its own because it is strictly necessary to provide a service you expressly requested — remembering your choice so we can honour it (§ 25(2) no. 2 TDDDG). It is kept for six months, after which you are asked again, and the button below deletes it at any time.
The button deletes your stored decision and reloads the page. You will then be asked again, and no advertising service loads until you make a new choice. Withdrawal takes effect for the future; the lawfulness of processing carried out beforehand is unaffected. Cookies already set by Google and LinkedIn can additionally be removed in your browser settings.
This site uses SSL/TLS encryption (HTTPS) for security. Data transmitted between your browser and our server is encrypted.
We may update this privacy policy from time to time. The current version is always available at this URL.
You have the right to lodge a complaint with the competent data protection supervisory authority. The competent authority is the Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen.
Last updated: 8 September 2026