Privacy policy

1. Controller and scope

The controller responsible for this website and initial consultations requested from us is Elias Schultze, es.design, Hölderlinstraße 4, 69429 Waldbrunn, Germany. Telephone: +49 159 02025178, email: info@eliasschultze.de.

This policy describes the processing of personal data on our website, including the embedded booking of an initial consultation. When using the es.booking platform independently, the privacy information provided there also applies.

2. Website access and server logs

When you access the website, the server processes technical connection data: IP address, date and time, requested address, response status, volume of data transferred, browser and operating system information and, where your browser provides it, the previously visited page. This serves to deliver the website, analyse errors and prevent misuse. The legal basis is Article 6(1)(f) GDPR; our legitimate interest is secure and reliable operation.

Data on the publicly available website is transmitted using HTTPS encryption.

3. Hosting and email infrastructure

The website and our email mailboxes are hosted by IONOS SE, Elgendorfer Straße 57, 56410 Montabaur, Germany. IONOS processes the data necessary to deliver and operate the website and to send, receive and store emails. For emails, this includes sender and recipient addresses, message contents, attachments and technical transmission data. The legal basis is Article 6(1)(f) GDPR, in particular our interest in reliable technical infrastructure.

4. Cookies and similar technologies

Information is stored on or accessed from your device where this is strictly necessary for a service you expressly request (Section 25(2), point 2 TDDDG) or where you have given prior consent (Section 25(1) TDDDG). These conditions also apply to similar technologies that do not use cookies. Any subsequent processing of personal data is additionally governed by the relevant GDPR legal basis specified in this policy.

Optional services may only be activated after you give consent. You can change or withdraw your consent at any time, with effect for the future, through the cookie settings. This does not affect the lawfulness of processing carried out beforehand.

When you select light or dark mode, this preference is stored locally in your browser under “es-theme”. It provides the display mode you requested (Section 25(2), point 2 TDDDG) and remains until you clear the website data in your browser.

5. Contacting us

If you contact us by form, email or telephone, we process your contact details, the contents of your enquiry and any documents you provide to handle your request. For steps prior to entering into a contract or for performing a contract, the legal basis is Article 6(1)(b) GDPR. We handle other enquiries on the basis of Article 6(1)(f) GDPR; our legitimate interest is responding to your message.

Providing this information is voluntary. Without contact details or the information needed to handle your request, we may be unable to respond. Once the matter is resolved, data is deleted when it is no longer needed for handling the request, statutory retention or the establishment or defence of specific legal claims.

6. Audience measurement with Matomo

We use Matomo as a WordPress plugin on our hosting infrastructure. The analysis helps us understand how our website is used and improve its content and technical features. The theme disables Matomo cookies. Depending on the tracking configuration, data processed includes pages visited, referrers, timestamps, device and browser information and information derived from the IP address.

Matomo is activated only after you consent to the “Analytics · Matomo” category. The legal basis is Article 6(1)(a) GDPR and, where information is stored on or accessed from your device, Section 25(1) TDDDG. You can change or withdraw consent at any time using “Cookie settings” in the footer. Withdrawal stops further measurement and does not affect the lawfulness of processing before withdrawal. Consent for embedded appointment booking is managed separately.

7. Contact via WhatsApp

The WhatsApp link lets you open WhatsApp and contact us there. The provider for users in the European Economic Area is WhatsApp Ireland Limited. When you open WhatsApp, the provider processes technical usage data; when you contact us, we process your WhatsApp contact details and messages to handle your enquiry. Article 6(1)(b) GDPR applies to contract-related enquiries; Article 6(1)(f) GDPR applies to other enquiries, with the legitimate interest of responding to them. You can alternatively contact us by email or telephone.

WhatsApp also processes data under its own privacy policy: WhatsApp privacy policy.

8. Other website features

8.1 Consent management with CookieYes

We use CookieYes, provided by CookieYes Limited, 3 Warren Yard, Warren Park, Wolverton Mill, Milton Keynes, MK12 5NW, United Kingdom, to manage your choices regarding optional services. A script from cdn-cookieyes.com is loaded for this purpose. This transmits technical connection data to the service providing it. Your choice is stored in the “cookieyes-consent” cookie for up to 365 days so that it can be respected on later visits. You can delete this cookie through your browser at any time. The “Appointment booking” and “Analytics · Matomo” categories can be accepted or rejected independently. Consent status, timestamps and technical evidence data may be processed for documentation.

Storing a choice necessary for consent management is based on Section 25(2), point 2 TDDDG. The necessary documentation of consent is based on Article 6(1)(c) in conjunction with Article 7(1) GDPR. Where technically necessary processing does not fall under this basis, it is based on Article 6(1)(f) GDPR and our interest in reliably managing your choices.

Further information: CookieYes privacy policy.

8.2 Blog newsletter

With your consent, we send you emails about new blog articles. We store your email address, subscription status, registration time, confirmation time, the time of the consent recorded in the form and the IP address recorded during registration. You first receive an email containing a confirmation link (double opt-in). Your address is added to the active mailing list only after confirmation.

The legal basis for sending the newsletter is Article 6(1)(a) GDPR. Necessary documentation of your consent is based on Article 6(1)(c) in conjunction with Article 7(1) GDPR. To limit misuse, the system also uses technical records derived from IP addresses and timestamps. This is based on Article 6(1)(f) GDPR, with the interest of preventing automated or repeated registrations.

The subscriber list is stored on our hosting infrastructure. Emails are sent through our email infrastructure; no separate newsletter delivery service is used. You may withdraw consent at any time using the unsubscribe link in each newsletter or by emailing us. This does not affect the lawfulness of emails sent previously.

When you unsubscribe, your address is excluded from further mailings and the stored IP address is removed from your subscriber record. Your email address, previous evidence timestamps and the unsubscribe time initially remain stored with the status “unsubscribed”. This does not constitute complete deletion of the record.

8.3 Locally hosted fonts

The Inter and Outfit fonts are served from our own web server. These font files do not require a connection to Google Fonts.

8.4 SEO check and report by email

When you request an SEO report, we process your email address, the website URL provided, the selected device view and any search terms you supply. The URL being checked is transmitted server-side to the Google PageSpeed Insights API to retrieve technical test results. The report is sent to your email address; we also receive an internal notification of the request. This does not subscribe you to the newsletter.

Processing to provide the requested report is based on Article 6(1)(b) GDPR. To prevent misuse, the system also processes IP addresses and email addresses to limit repeated requests. Article 6(1)(f) GDPR applies to this processing; our legitimate interest is protecting the service against automated overload and unwanted emails. A website URL is required for the check, and an email address is required to send the report.

Test results are cached and, under the current code, reused for up to 15 minutes. This reuse period is not a guaranteed deletion period.

8.5 Embedded appointment booking

After you allow “Appointment booking”, opening the booking window loads es.booking from app.eliasschultze.de. This request already transmits technical connection data, such as your IP address and browser information, to the booking platform's infrastructure. Booking details entered in the form are transmitted when you submit it to process your booking. The legal basis for arranging an appointment with us is Article 6(1)(b) GDPR. We are responsible for bookings of initial consultations with us. We process the contact details you enter, your requested appointment and any message to arrange and conduct the consultation. You can alternatively contact us by email or telephone.

Further information on independent use of the platform is available in the privacy policy at es.booking.

8.6 Security features

We use Wordfence by Defiant Inc., USA, to protect against attacks and unauthorised logins. Data processed for this purpose includes IP addresses, requested URLs, timestamps and security-related login and access data. The firewall and login protection are enabled. Security-related data may be transmitted to Defiant as part of the security services. The legal basis is Article 6(1)(f) GDPR; our legitimate interest is protecting the website and the data processed on it. Provider information on data processing and the standard contractual clauses it makes available: Wordfence and data protection.

9. Your rights

Subject to the applicable legal conditions, you have the right of access (Article 15 GDPR), rectification (Article 16), erasure (Article 17), restriction of processing (Article 18) and data portability (Article 20). You may withdraw consent at any time with effect for the future (Article 7(3)). Please use the contact details above.

Right to object: Where processing is based on Article 6(1)(e) or (f) GDPR, you may object on grounds relating to your particular situation (Article 21(1)). We will stop processing unless we demonstrate compelling legitimate grounds which override your interests, rights and freedoms, or the processing serves the establishment, exercise or defence of legal claims. You may object to processing for direct marketing at any time without giving particular grounds; that processing will then stop.

You may also lodge a complaint with a data protection supervisory authority, particularly in the Member State of your habitual residence, place of work or the alleged infringement (Article 77 GDPR).

10. Retention and deletion

We retain personal data only for as long as necessary for its respective purpose or as required by statutory retention obligations. Consent or legitimate interests do not justify unlimited retention. Once the purpose no longer applies, data is deleted or, where a retention obligation or a specific evidentiary purpose continues to apply, restricted from other uses and subsequently deleted.

Last updated: 7 October 2026.