Privacy policy Last updated: October 2026

Controller

Nils Enders-Brenner
Luswiese 6, 82327 Tutzing, Germany
Email: business@designernils.com

The basic principle

You can use this website fully without agreeing to any processing for analytics. Without your consent, only the technical access data that comes with every website visit is processed (see “Hosting and access data”). Google Analytics 4 is blocked until you agree: no cookies are set and no analytics data is evaluated. I do not use advertising networks or social media plugins.

You can change or withdraw your decision at any time by choosing “Cookie settings” at the bottom of the page.

Hosting and access data

This website runs on a web server. When you visit it, the server automatically logs technical access data (server log files), in particular: the IP address of your device, the date and time of access, the URL you visited, the amount of data transferred, and your browser type and operating system.

This data is technically necessary to run the website (Art. 6 (1) (f) GDPR – legitimate interest in providing the website securely and without errors). It is not combined with other data sources and is deleted after 30 days at the latest.

Contact by email

If you email me, I process your email address and the content of your message only to deal with your enquiry (Art. 6 (1) (b) GDPR). The data is not passed on to third parties and is deleted once our communication has ended, unless there is a legal obligation to keep it.

Contact form

This website has a contact form on the German and the English start page. The required fields are your name, your email address and your message; without an address I cannot reply to you.

Your details are processed only to answer your enquiry. The legal basis is Art. 6 (1) (b) GDPR where the enquiry is about entering into a contract, otherwise Art. 6 (1) (f) GDPR (legitimate interest in answering enquiries). When you send the form, the server emails your details to my inbox and also writes them to a file on this website’s server, so that no message is lost if sending the email fails.

To protect against automated requests, the form checks an extra field that people cannot see, plus a timestamp and a check token that your browser fetches from this website’s server the first time you click into the form. These are technical values that say nothing about you; no cookie is set. Rejected attempts are noted in the same file on the server with name and email address, but without the message.

Your details are not passed on to third parties, and there is no newsletter. They are deleted once our communication has ended, unless there is a legal obligation to keep them.

Cookies

Without your consent, this website does not set any cookies for analytics or advertising. The only thing stored is your choice from the consent banner, so you are not asked again on every visit. This storage is strictly necessary for the service you asked for and therefore does not need consent (§ 25 (2) no. 2 TDDDG, the German Telecommunications Digital Services Data Protection Act).

If you agree to analytics, Google Analytics 4 also sets the cookies _ga and _ga_M8G7QV36DW, each for up to two years. If you withdraw your consent, these cookies are no longer set.

Consent management

The consent banner is part of this website and is served from my own server. No external provider is used for it, and no data is sent to third parties when the banner is shown. Your choice is stored only in your browser.

You can change or withdraw your consent at any time with effect for the future by choosing “Cookie settings” at the bottom of the page. This does not affect the lawfulness of processing before you withdrew consent. When you withdraw consent, analytics cookies that have already been set are deleted.

Analytics with Google Analytics 4

With your consent, I use Google Analytics 4, a service of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. It helps me understand how this website is found and used, so I can improve it.

The service is only loaded after you have agreed. Before that, your browser does not connect to Google, no cookies are set and nothing is evaluated.

The data processed includes in particular: a shortened IP address, the pages you visit and how long you stay, where you came from (for example a search engine or a link on another website), your approximate location at city level, and your browser, operating system and device type. Google Analytics 4 shortens IP addresses by default before any further processing, so I cannot identify you as a person.

The legal basis is your consent under Art. 6 (1) (a) GDPR and § 25 (1) TDDDG. There is a data processing agreement with Google Ireland Limited under Art. 28 GDPR. User-level data is deleted after 14 months at the latest.

Transfers to the USA

When Google Analytics 4 is used, data may be transferred to Google LLC in the USA. On 10 July 2023, the European Commission decided that companies certified under the EU-US Data Privacy Framework offer an adequate level of data protection. Google LLC is certified under this framework.

Even so, it cannot be ruled out completely that US authorities access transferred data. If you want to avoid this, do not agree to analytics in the consent banner. The website still works fully.

Your rights

You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and to object (Art. 21). Please send requests to business@designernils.com.

You also have the right to complain to a data protection supervisory authority. My supervisory authority is the Bavarian State Office for Data Protection Supervision (BayLDA), Promenade 18, 91522 Ansbach, Germany. If you live in the United Kingdom, you can also complain to the Information Commissioner’s Office (ICO), ico.org.uk.

Direct contact by email (business contacts)

I sometimes write to consulting, search and investment firms by email to offer my services. If you received such an email, this section explains where I got your details and what I do with them.

• What data: your name, your business email address, the name of your firm, your role, and what your firm’s website says publicly about its services.
• Where it comes from: your firm’s own website and, for UK companies, the public register at Companies House. I do not buy address lists.
• Why: to contact you once about a new website for your firm, and to send up to three follow-ups if I have not heard back.
• Legal basis: my legitimate interest in offering my services to businesses (Art. 6 (1) (f) UK GDPR and GDPR). Under the UK Privacy and Electronic Communications Regulations, emails to corporate addresses are allowed as long as you can opt out.
• How long: 12 months after our last contact, then I delete it. If you ask me not to contact you again, I keep only your email address on a do-not-contact list, so that it does not happen again.
• Your right to object: you can object to this at any time, free of charge and without giving a reason (Art. 21 (2) and (3) GDPR). A short reply to my email is enough, and I will not contact you again.
• No sharing: I do not pass your details on to anyone.

Changes to this policy

This privacy policy may be updated when the website or the law changes. The current version is always on this page.