Privacy Policy

This is a translation. The German version is binding.

1. Controller

Eric Lubczynski, Bexbacher Str. 112, 28309 Bremen, Germany, email eric@ericlub.de. I am a sole trader without employees; I am not required to appoint a data protection officer. Privacy questions come straight to me.

2. At a glance

What	Why	How long
Access logs with shortened IP address	running and securing the website	14 days
Contact form and project enquiry, including images	answering you, writing an offer	6 months after our last contact if no order follows
Offer that is not accepted	the offer	6 months after refusal or expiry
Details entered on the offer page before payment	the handover after ordering	2 days if no payment arrives
Contract, handover details	performing the contract	term plus 30 days
Invoices and payment records	statutory retention	10 years
Accepted offer, confirmations, contract correspondence	statutory retention	6 years
Withdrawal and cancellation	proof that I received and handled them	3 years
Research notes from looking for clients	making your business one offer	without a letter 30 days after the research, after the letter 180 days, preview 8 weeks
Block note after an objection	not writing to you again	as long as I write to businesses

No cookies, no analytics, no advertising. Fonts, scripts and images are served from this server, not from Google or anyone else.

3. Visiting the website

The website is hosted by Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany, in a German data centre, with a data processing agreement in place.

For every request the web server writes a log entry: shortened IP address (IPv4 to 16 bits, IPv6 to 24 bits), time, page requested, browser identification and referring page. I need it to spot faults and attacks. The log is overwritten after 14 days. Legal basis: my legitimate interest in secure operation (Art. 6(1)(f) GDPR).

4. Writing to me

Contact form and project enquiry. I process what you enter: name, email address, your message and, if given, phone number and role; for the project enquiry also the chosen building blocks, page count, payment mode and your preferred domain name. Legal basis: steps prior to a contract (Art. 6(1)(b) GDPR).

Images. Photos or a logo you attach stay with your enquiry. An image that is uploaded but never sent with an enquiry is deleted by the server after two hours.

Domain check. When you check whether an address is free, my server asks the registry: DENIC eG in Frankfurt for .de, Verisign in the USA for .com and .net. Only the domain name leaves the server, not your name or IP address. The result is kept in memory for ten minutes and then discarded.

How your enquiry reaches me. It is sent to me by email through Brevo (Sendinblue GmbH, Berlin; data processing agreement in place). The confirmation to you is sent from my own mailbox at Migadu (Migadu-Mail GmbH, Switzerland, covered by an EU adequacy decision). The enquiry itself stays on my server until my workstation in Germany collects it, usually within minutes; after that it is deleted from the server.

Retention. If no order follows, I delete your enquiry and images at the latest six months after our last contact.

5. Receiving an offer

I send the offer as a PDF by email and as a page under ericlub.de/angebot/…. The address contains a random key; without it the page cannot be found, and search engines do not see it. If the offer is not accepted, I close the page and delete the offer after six months.

Help with writing. I draft offers with the help of a language model by Anthropic (Anthropic PBC, San Francisco, USA). Your name, the subject and text of your enquiry and your chosen building blocks go to Anthropic, not your email address or phone number. I read the text before it goes to you. Legal basis: my legitimate interest in writing you a personal offer quickly (Art. 6(1)(f) GDPR). If you do not want this, say so in your enquiry and I will write the offer without it.

6. Ordering and paying

Details before payment. What you enter on the offer page before ordering stays locked on my server until payment is confirmed. If no payment arrives, I delete it after two days. The domain transfer code (auth code) is only asked for after payment.

Payment. Payments are handled by Stripe (Stripe Payments Europe Ltd., Dublin, Ireland). You enter your payment details directly with Stripe; I do not see them. Stripe’s own privacy policy applies there (stripe.com/privacy), including cookies on the checkout page. Stripe tells me the amount, time, your email address and the identifiers of the payment and subscriptions.

After ordering. Confirmation, terms and the data processing agreement are sent through Migadu. I write invoices myself and send them as PDF. Legal basis: the contract (Art. 6(1)(b) GDPR); for invoices and records the statutory retention duty (Art. 6(1)(c) GDPR).

Withdrawal and cancellation. The forms at /widerruf and /kuendigen send me your statement and you a confirmation with date and time. I keep the statement for three years as proof of receipt.

7. If you are a client

For your website, contact form and mailbox I process data of your visitors and contacts on your behalf, under the data processing agreement at /avv. When the contract ends, I delete website, mailbox and related data 30 days later and confirm this on request.

8. If I write to your business

I look for businesses whose website is missing or dated and offer them a new one by letter. For this I read what is publicly available about your business: the website and its imprint, business directories and map services. I note the business name and address, the name of the contact person, business phone number and email address, links to public profiles of the business (such as Instagram or LinkedIn), what I notice about the website, a screenshot of the existing website and where each detail comes from. Sometimes I also build a preview of what a new website could look like.

Why. I want to make your business one offer by letter. Legal basis: my legitimate interest in offering my work to businesses (Art. 6(1)(f) GDPR). I write only by post or hand the letter over in person, never by email, through social networks or through your contact form.

Who receives the details. A language model by Anthropic (Anthropic PBC, San Francisco, USA) helps me with the research and the letter; the details about your business go to Anthropic in the process. The preview is kept on my server at Hetzner in Germany (section 3).

Retention. If I write to you, I do so within 30 days of the research. If I do not write to you, I delete everything within 30 days of the research. If my letter gets no answer, I delete everything 180 days after the letter and the preview after eight weeks. If you answer, section 4 applies from then on.

Objection. You may object at any time, without giving reasons, by writing to the address above (Art. 21(2) GDPR). I will then not write to you again and delete your details. Only your business name and the date of the objection remain as a block note, so that a later search does not lead me to write to you again. I keep that note as long as I write to businesses.

9. Your rights

You may ask at any time what I store about you and request rectification, erasure, restriction or a copy of your data (Art. 15 to 20 GDPR). You may object to processing based on legitimate interest (Art. 21 GDPR). Just write to the address above; you will get an answer within one month. Anything I must keep by law, such as invoices, I delete once the retention period ends, and I will tell you so.

You also have the right to complain to a supervisory authority. Mine is the Landesbeauftragte für Datenschutz und Informationsfreiheit der Freien Hansestadt Bremen.