Skip to content

Privacy Policy

As of: October 2026

Read in German

Controller

The controller responsible for processing personal data on this website is:

Christian Lempa, trading as CL Creative
c/o Block Services
Stuttgarter Str. 106
70736 Fellbach
Germany
Email: info@clcreative.de

Contact form: christianlempa.de/contact

Hosting, security, and server log files

This website and its database and email services are operated at netcup GmbH, Emmy-Noether-Straße 10, 76131 Karlsruhe, Germany. Contact enquiries and administratively managed website content are stored in this hosting environment. Emails to and from info@clcreative.de are also transmitted and stored via netcup. netcup is used on the basis of a data processing agreement pursuant to Art. 28 GDPR.

When the website is accessed, the IP address, date and time, requested URL or file, referrer URL, browser and operating-system information, status code, and amount of data transferred may be processed. Provider-side web-access and error logs are rotated daily. For each log, up to 14 rotated files are retained in addition to the current file; older rotated files are removed when that limit is reached. Security-related application logs are retained for no more than 14 days; message contents and credentials are not intended to be logged.

To protect login, the contact form, and interfaces, the application derives a non-reversible check value from the IP address using a secret key. The raw IP address is not stored in the database tables used for this purpose. Contact-form rate-limit records generally exist for up to one hour; aggregate records of rejected requests are deleted after seven days.

The legal basis is Art. 6(1)(f) GDPR. Our legitimate interest is the secure, stable, and error-free provision of the website and email communication and the prevention of spam and abuse.

YouTube embeds

This website embeds videos from YouTube. The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. YouTube videos are loaded only after you have given express consent. In particular, IP address, browser information, and usage data may be processed, and cookies or similar technologies may be used. If you are signed in to your YouTube or Google account, Google may associate the visit with your account.

Google may also process data outside the European Economic Area. Information about recipients and the safeguards used by Google is available in the Google Privacy Policy (opens in a new tab). The legal basis for loading the video is your consent pursuant to Art. 6(1)(a) GDPR and § 25(1) TDDDG.

Externally hosted hardware photographs

With your external-media consent, hardware pages load product photographs directly from Amazon's m.media-amazon.com. Without consent, these images are not requested. Ordinary product links do not load images automatically.

Amazon can receive your IP address, image URL, browser and device information, and request time. Image requests use a no-referrer policy and do not send this site's page URL. Amazon group companies may retain request logs and process data outside the EEA. The Amazon.com Privacy Notice (opens in a new tab) identifies Amazon's processing and privacy contacts but does not specify a fixed image-request-log retention period. Transfer information is provided below.

The legal basis for loading these images is your consent under Art. 6(1)(a) GDPR. You can withdraw it via “Cookie Settings” in the footer.

Amazon affiliate links

Hardware cards may contain Amazon affiliate links, identified as advertising beside the link. As an Amazon Associate I earn from qualifying purchases. The link contains a partner identifier so that Amazon can attribute qualifying purchases and calculate a commission. Links are created with Amazon SiteStripe and may lead to Amazon.com or, through Amazon's OneLink localization, a regional Amazon store. The US affiliate-program entity is Amazon.com Services LLC (United States). For Amazon.de, the program provider is Amazon Europe Core S.à r.l., 38 avenue John F. Kennedy, L-1855 Luxembourg. The destination depends on Amazon's localization settings and product matching; a local redirect is not guaranteed.

These are ordinary outbound links, not embedded Amazon advertisements. The affiliate links themselves do not load Amazon scripts, pixels, widgets or images, or set Amazon cookies on this website. Separately, Amazon-hosted product photographs may load only with your external-media consent, as described above. Following a link opens Amazon, sometimes via Amazon's short-link service amzn.to. For Amazon shop links, the browser may send only this site's origin (scheme and hostname, and port if present) in the Referer header, not the page path, query parameters or fragment. The partner identifier remains in the destination link; it is not a personal visitor identifier generated by this website. Optional website Analytics is described separately below.

When you follow a link, Amazon receives the link identifier and technical request data, such as your IP address and browser information. Amazon may use cookies or similar technologies to attribute purchases and may associate activity with your Amazon account if you are signed in. Amazon is responsible for its processing on its services, including its consent choices. Data may be processed outside the European Economic Area. Details on Amazon's controllers, purposes, legal bases, retention, transfers and privacy choices are available in the Amazon.com Privacy Notice (opens in a new tab) and, for Amazon.de, the Amazon.de Privacy Notice (opens in a new tab). Other localized stores provide their applicable notices on the destination site. Our website's cookie settings do not control cookies on Amazon.

Google Analytics

Where Google Analytics is enabled on this website and you have given consent, we use Google Analytics 4 from Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, to measure website use. In particular, IP address, device and browser information, pages viewed, times of use, and interactions with links or buttons may be processed, and cookies such as _ga and _ga_* may be set. The application transmits page paths but does not add query parameters, URL fragments, search terms, or other user input.

The website limits Analytics cookies to two months from the first visit without extending their lifetime on later visits. Browser-side restrictions may shorten the actual lifetime. Advertising storage, personalized advertising, and Google Signals are disabled by the website configuration. Google may also process data outside the European Economic Area. Cookie lifetime is distinct from user/event-data retention. The Analytics property retains user and event data for two months, without resetting the retention period on new user activity. Most aggregated standard reports are not affected by these retention settings.

You may withdraw your consent at any time with effect for the future via “Cookie Settings” in the footer. Further information is available in the Google Privacy Policy (opens in a new tab). The legal basis is your consent pursuant to Art. 6(1)(a) GDPR and § 25(1) TDDDG.

Contact form, email, and Google reCAPTCHA

If you contact us through the contact form, we process your name, email address, optional subject, and message content to review and respond to your enquiry. Name, email address, and message are required; without them the form cannot be submitted. The message is stored in our database and is accessible only to authorized administrators. Contact-form messages are generally retained for 180 days and then deleted during the next successful maintenance run. They are deleted earlier when no longer needed.

If you contact info@clcreative.de, we process the transmitted sender and recipient data, timestamps, subject, message content, and technical email metadata. Emails are deleted when they are no longer required for handling the enquiry or for statutory evidence or retention obligations.

After deletion from the live database, contact enquiries may remain in access-restricted backup copies until they are replaced by later backups. After a restoration, approved erasures must be applied again.

Where Google reCAPTCHA v3 is configured, it is loaded only after your separate consent when you submit the form. The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. reCAPTCHA may process the IP address, browser and device information, interaction data, and cookies or similar technologies to produce an automated assessment of the likelihood of abuse. If the assessment falls below the configured threshold, the message is not accepted or stored as a contact enquiry. You can contact us by email instead.

Google may also process data outside the European Economic Area. Further information is available in the Google Privacy Policy (opens in a new tab) and the Google Terms of Service (opens in a new tab). The legal basis for reCAPTCHA is your consent pursuant to Art. 6(1)(a) GDPR and § 25(1) TDDDG. The server-side check does not additionally transmit your IP address to Google.

The legal basis for handling your enquiry is Art. 6(1)(b) GDPR where it concerns a contract or pre-contractual measures, and otherwise Art. 6(1)(f) GDPR for handling and documenting the communication.

Cookies, local storage, and consent

Public visitors do not need a website account. Technically necessary cookies are used only for protected internal functions and their security. Non-essential services, in particular YouTube embeds, externally hosted hardware photographs and, where enabled, Google Analytics, are loaded only after your express consent. The consents for external media and Analytics are separate and disabled by default. reCAPTCHA receives separate consent in the contact form.

Your consent preferences and light/dark theme setting are stored in your browser's localStorage and are not sent to the server. They remain until you change them or delete your browser data. A new consent version or invalid data resets optional services to disabled. You can change your settings at any time through “Cookie Settings” in the footer. Withdrawing external-media consent removes embedded players and remote images. If the document has loaded the YouTube player API, it reloads to unload that code; this also applies to withdrawal in another open tab and restoration of a cached document. Withdrawal does not erase data already received by a provider.

Technically necessary storage and access take place pursuant to § 25(2) no. 2 TDDDG. The associated processing of personal data is based on Art. 6(1)(b) or (f) GDPR. The legal basis for non-essential storage, access, and external content is your consent pursuant to Art. 6(1)(a) GDPR and § 25(1) TDDDG.

International transfers

The services above may process data in the United States and other countries outside the EEA. Consent to loading a service is not itself a transfer safeguard under GDPR Chapter V.

For Google services, Google reports EU–US Data Privacy Framework certification for Google LLC and covered US subsidiaries (Art. 45 GDPR), and use of standard contractual clauses where an adequacy decision does not cover the transfer (Art. 46 GDPR). Details and how to request copies of those clauses: Google's data transfer frameworks (opens in a new tab).

Amazon.com's notice describes Amazon.com, Inc.'s EU–US Data Privacy Framework participation. Framework adequacy applies only to covered transfers to certified recipients, not automatically to every company or destination. Amazon's notices linked above contain transfer details and privacy contacts.

Your rights

Subject to the applicable statutory requirements, you have in particular these rights:

  • Access to your stored data (Art. 15 GDPR),
  • Rectification of inaccurate data (Art. 16 GDPR),
  • Erasure of your data (Art. 17 GDPR),
  • Restriction of processing (Art. 18 GDPR),
  • Data portability (Art. 20 GDPR),
  • Objection to processing based on legitimate interests (Art. 21 GDPR),
  • Withdrawal of consent with effect for the future (Art. 7(3) GDPR).

The lawfulness of processing before withdrawal remains unaffected. To exercise your rights, please contact info@clcreative.de.

Right to lodge a complaint

You have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR). The competent supervisory authority is:

The State Commissioner for Data Protection and Freedom of Information of Baden-Württemberg
Heilbronner Straße 35
70191 Stuttgart
www.baden-wuerttemberg.datenschutz.de (opens in a new tab)