Privacy Policy

Last updated: October 2026

1. Controller

The controller responsible for data processing on this website is:

David Nawee
Nawee
Weicheselstraße 1
30519 Hannover, Germany

E-Mail: david@nawee.net

2. Hosting and Server Log Files

This website is hosted via GitHub Pages. The provider is GitHub, Inc., 88 Colin P. Kelly Jr. Street, San Francisco, CA 94107, USA. When you access the website, the hosting provider automatically processes information transmitted by your browser (so-called server log files), including your IP address, date and time of access, the page accessed, browser type, and operating system.

Processing is based on Art. 6(1)(f) GDPR. Our legitimate interest is the secure and reliable provision of the website without operating our own server. The server is located in the United States. The transfer of your data there is based on the European Commission’s Standard Contractual Clauses (Art. 46(2) GDPR). We do not have access to these log files ourselves. Further information can be found in GitHub’s privacy statement.

3. Domain, DNS (Squarespace) and Visitor Statistics

Our domain davidnawee.com is registered with Squarespace, Inc., 225 Varick Street, New York, NY 10014, USA, which also resolves the domain name (DNS), i.e. answers the request for which server address davidnawee.com belongs to. Your actual visit to the website is not routed through Squarespace. The legal basis is Art. 6(1)(f) GDPR; our legitimate interest is the reliable availability of our website.

Cloudflare Web Analytics

We use Cloudflare Web Analytics (Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107, USA) to understand how our website is used (e.g. which pages are visited, from which websites visitors arrive, and how fast the pages load). For this, a script from Cloudflare is loaded when you open a page. It transmits the page address, the referring website, information about your browser, operating system and device, page load times and your IP address, from which an approximate country is derived. Cloudflare Web Analytics does not use cookies, does not store anything on your device and does not create user profiles or track you across websites; we only see aggregated statistics.

The legal basis is Art. 6(1)(f) GDPR. Our legitimate interests are improving our content and offers based on anonymous usage statistics. Cloudflare is certified under the EU-U.S. Data Privacy Framework. Further information is available in Cloudflare’s privacy policy at cloudflare.com/privacypolicy.

4. Contact by Email or Telephone

If you contact us by email or telephone, we store and process your information solely for the purpose of handling your inquiry. The legal basis is Art. 6(1) (b) or (f) GDPR. The data is deleted as soon as it is no longer required for this purpose.

Emails to us are received, stored and sent via the email service Zoho Mail provided by Zoho Corporation B.V. (Netherlands). In particular, your name, email address, the content of your message and technical email data are processed. The data is processed in a Zoho data center in the EU. The legal basis is Art. 6(1)(b) GDPR where your message relates to a contract or pre-contractual measures, and otherwise Art. 6(1)(f) GDPR (legitimate interest in reliable email communication).

Job Applications

If you apply to us by email, we process your details and documents (e.g. name, contact details, CV, certificates) only to review your application and to get in touch with you. The legal basis is Art. 6(1)(b) GDPR (steps taken at your request before entering into a contract). We receive these emails via Zoho Mail (see above). If no collaboration results, we delete your documents no later than six months after the application process has ended, unless you have agreed to a longer retention period.

Ordering Packages via Zoho Forms

We also use Zoho Forms for ordering packages. Zoho processes your name, email address, the chosen package, your confirmations (booking terms, withdrawal information, start of the service before the withdrawal period expires) with their time, and technical data such as your IP address. Payment is processed within the form via Stripe (see section 5). After payment, you receive a confirmation email from Zoho with your personal booking link. The data is processed in a Zoho data center in the EU. The legal basis is Art. 6(1)(b) GDPR (conclusion and performance of the contract) and Art. 6(1)(c) GDPR (documentation and retention obligations).

Online Withdrawal via Zoho Forms

For the electronic withdrawal from contracts (“Withdraw from contract”), we use a form provided by the service Zoho Forms of Zoho Corporation B.V. (Netherlands). The form is loaded on the “Withdraw from contract” and withdrawal information pages. Zoho processes your name, email address, the details of the contract withdrawn from, your withdrawal statement, the time of receipt and technical data such as your IP address. The data is processed in a Zoho data center in the EU.

We use this data to process your withdrawal and to confirm its receipt. The legal basis is Art. 6(1)(c) GDPR in conjunction with § 356a of the German Civil Code (BGB) (statutory obligation to provide an electronic withdrawal function) and Art. 6(1)(b) GDPR. Further information can be found in Zoho’s privacy policy.

We have a data processing agreement with Zoho Corporation B.V. in accordance with Art. 28 GDPR. It covers all Zoho services mentioned in this section (Zoho Mail and Zoho Forms).

5. Appointment Booking (Cal.com) and Payment (Stripe)

To book appointments (e.g. the free initial consultation), we use the service Cal.com provided by Cal.com, Inc. When you click a booking link, you are redirected to Cal.com's booking page. No Cal.com content is loaded on our website itself.

When you make a booking, Cal.com processes the data you enter, in particular your name, email address, phone number and message where provided, and the appointment you choose. We use this data to hold the appointment and to contact you. The legal basis is Art. 6(1)(b) GDPR (pre-contractual measures or performance of a contract).

Booked appointments are automatically transferred to our Google Calendar so that we can manage availability and avoid double bookings. The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Your name, email address and appointment details are transmitted to Google. A transfer to the USA is possible; Google is certified under the EU-US Data Privacy Framework. The legal basis is Art. 6(1)(b) GDPR.

Where data is transferred to the USA, this takes place on the basis of appropriate safeguards in accordance with Art. 44 et seq. GDPR. Further information can be found in Cal.com's Privacy Policy .

Payment Processing via Stripe

Packages can be paid online. Payment takes place within the order form (Zoho Forms, see section 4) via the payment service provider Stripe; your payment details are transmitted directly to Stripe. For customers in the EU, the provider is Stripe Payments Europe, Ltd., 1 Grand Canal Street Lower, Grand Canal Dock, Dublin, D02 H210, Ireland.

Stripe processes in particular your name, email address, payment details (e.g. card details), the amount and technical data such as your IP address. We do not receive your full payment details; we only receive confirmation that the payment has been made. The legal basis is Art. 6(1)(b) GDPR (performance of a contract) and Art. 6(1)(c) GDPR (statutory retention obligations). For fraud prevention, Stripe also processes data on the basis of legitimate interests (Art. 6(1)(f) GDPR).

Stripe may also transfer data to Stripe, Inc. in the USA. This takes place on the basis of appropriate safeguards in accordance with Art. 44 et seq. GDPR. Further information can be found in Stripe's Privacy Policy .

6. Cookies

We do not use our own cookies on this website for analytics or advertising purposes. No third-party content that sets cookies is embedded on this website.

7. SSL/TLS Encryption

This website uses SSL/TLS encryption for security reasons. You can recognize an encrypted connection by “https://” in your browser’s address bar.

8. Storage Period

We only store personal data for as long as is necessary for the respective purpose:

Enquiries (email, phone): until your enquiry has been fully dealt with. If no contract is concluded, we delete the data no later than six months after the last contact.
Bookings and customer data: for the duration of our work together. Invoices and tax-relevant documents are then kept for as long as required by law (in particular under § 147 of the German Fiscal Code (AO), usually eight to ten years).
Server log files: deleted by the hosting provider according to its own retention periods; we do not have access to them.

9. Your Rights

You have the following rights with regard to your personal data:

Access (Art. 15 GDPR)
Rectification (Art. 16 GDPR)
Erasure (Art. 17 GDPR)
Restriction of processing (Art. 18 GDPR)
Data portability (Art. 20 GDPR)
Objection to processing (Art. 21 GDPR)
Withdrawal of consent (Art. 7(3) GDPR)

If you believe that the processing of your data violates data protection law, you may lodge a complaint with a supervisory authority. The supervisory authority responsible for us is the State Commissioner for Data Protection of Lower Saxony (Landesbeauftragte für den Datenschutz Niedersachsen), Prinzenstraße 5, 30159 Hannover, Germany.

If you have any questions about data protection, you can contact us at david@nawee.net.