Privacy policy es.design

1) Introduction and contact details of the controller

1.1

We are pleased that you are visiting our website and thank you for your interest. Below we inform you about how we handle your personal data when you use our website. Personal data means any data with which you can be personally identified.

1.2

The controller for data processing on this website within the meaning of the GDPR is Elias Schultze, Hölderlinstraße 4, 69429 Waldbrunn, Germany, Tel.: +49 159 02025178, E-Mail: info@eliasschultze.de. The controller of personal data is the natural or legal person who, alone or jointly with others, decides on the purposes and means of processing personal data.

2) Data collection when visiting our website

2.1

If you use this website for information only, i.e. if you do not register or otherwise send us information, we only collect the data that your browser transmits to the server (so-called server log files). When you access our website we collect the following data that is technically required to display the site:

• Our visited website
• Date and time at the time of access
• Amount of data sent in bytes
• Source/reference from which you reached the page
• Used Browser
• Used operating system
• Used IP address (if applicable: in anonymized form)

Processing is based on Art. 6 (1) (f) GDPR on the basis of our legitimate interest in improving the stability and functionality of our website. Data is not passed on or used in any other way. We reserve the right to subsequently check the server log files if there are specific indications of unlawful use.

2.2

For security reasons and to protect the transmission of personal data and other confidential content (e.g. orders or enquiries to the controller), this website uses SSL or TLS encryption. You can recognise an encrypted connection by the string “https://” and the padlock icon in your browser bar.

3) Hosting & Content-Delivery-Network

IONOS

We use a content delivery network from the following provider: 1&1 IONOS Internet SE, Elgendorfer Str. 57, 56410 Montabaur, Germany

This service allows us to deliver large media files such as graphics, page content or scripts more quickly via a network of regionally distributed servers. Processing is based on our legitimate interest in improving the stability and functionality of our website according to Art. 6 (1) (f) GDPR.

We have concluded an order processing contract with the provider, which ensures the protection of the data of our website visitors and prohibits unauthorized disclosure to third parties.

4) Cookies

Um den Besuch unserer Website attraktiv zu gestalten und die Nutzung bestimmter Funktionen zu ermöglichen, verwenden wir Cookies, also kleine Textdateien, die auf Ihrem Endgerät abgelegt werden. Teilweise werden diese Cookies nach Schließen des Browsers automatisch wieder gelöscht (sog. „Session-Cookies“), teilweise verbleiben diese Cookies länger auf Ihrem Endgerät und ermöglichen das Speichern von Seiteneinstellungen (sog. „persistente Cookies“). Im letzteren Fall können Sie die Storage period der Übersicht zu den Cookie-Einstellungen Ihres Webbrowsers entnehmen.

If individual cookies we use also process personal data, processing is based on Art. 6 (1) (b) GDPR to perform a contract, Art. 6 (1) (a) GDPR in the case of consent, or Art. 6 (1) (f) GDPR to protect our legitimate interests in the best possible functionality of the website and a user-friendly visit.

You can set your browser so that you are informed about the setting of cookies and can decide individually whether to accept them, or exclude cookies in certain cases or in general.

Please note that if you do not accept cookies, the functionality of our website may be limited.

5) Getting in contact

When you contact us (e.g. via contact form or email), personal data is collected. Which data is collected via a contact form is shown in the respective form. This data is stored and used solely to answer your request and for the associated technical administration.

The legal basis for processing this data is our legitimate interest in answering your request according to Art. 6 (1) (f) GDPR. If your contact aims at concluding a contract, Art. 6 (1) (b) GDPR is an additional legal basis. Your data is deleted after your request has been fully processed, unless statutory retention obligations apply.

6) Web analysis services

6.1 Matomo (selbst gehostet)

Diese Website nutzt Matomo, eine Open-Source-Software zur statistischen Auswertung von Besucherzugriffen. Matomo wird als WordPress-Plugin auf unserem eigenen Webserver (Hosting bei IONOS SE, siehe Abschnitt 3) betrieben. Die Auswertungen verbleiben damit in unserem Verantwortungsbereich; eine Übermittlung an Google oder andere Analyseanbieter findet nicht statt.

Mit Matomo erfassen wir insbesondere aufgerufene Seiten und Dateien, ungefähre Herkunft (Referrer), verwendetes Gerät/Browser, ungefähren Standort auf Basis der IP-Adresse sowie technische Metadaten zum Seitenaufruf. Die IP-Adresse wird von Matomo gekürzt bzw. nicht in vollständiger Form zur Profilerstellung genutzt. Das Tracking erfolgt ohne Matomo-Cookies (disableCookies); es werden keine dauerhaften Wiedererkennungscookies gesetzt.

Rechtsgrundlage ist Art. 6 Abs. 1 lit. f DSGVO (berechtigtes Interesse an der Reichweitenmessung, der Erkennung technischer Fehler und der Verbesserung unseres Angebots). Sie können der Verarbeitung widersprechen, indem Sie in Ihrem Browser Do-Not-Track aktivieren oder uns formlos per E-Mail an info@eliasschultze.de kontaktieren. Bereits erfasste Daten können wir auf Anfrage löschen.

Weitere Informationen zum Datenschutz bei Matomo finden Sie unter https://matomo.org/privacy-policy/.

7) WhatsApp

Auf dieser Website ist ein WhatsApp-Button (Plugin „Click to Chat for WhatsApp“, Holithemes) eingebunden. Erst wenn Sie den Button bewusst anklicken, wird WhatsApp (App oder WhatsApp Web) geöffnet. Dabei werden die von Ihnen verwendete Telefonnummer bzw. Ihr WhatsApp-Konto, der Zeitpunkt und der Inhalt Ihrer Nachricht an WhatsApp übermittelt.

Anbieter: WhatsApp Ireland Limited, 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Irland. Mutterunternehmen ist Meta Platforms, Inc., USA. Es kann zu einer Übermittlung in Drittländer (insbesondere USA) kommen. WhatsApp bzw. Meta stützen Übermittlungen u. a. auf den EU-US Data Privacy Framework und Standardvertragsklauseln.

Rechtsgrundlage ist Art. 6 Abs. 1 lit. a DSGVO, wenn Sie den Button freiwillig nutzen, bzw. Art. 6 Abs. 1 lit. b DSGVO, wenn die Nachricht der Anbahnung oder Durchführung eines Vertrags dient. Sie können uns stattdessen per E-Mail oder Telefon erreichen.

Datenschutzhinweise von WhatsApp: https://www.whatsapp.com/legal/privacy-policy-eea

8) Tools and miscellaneous

8.1 CookieYes (Cookie-Consent-Tool)

Diese Website nutzt das Einwilligungsmanagement von CookieYes (CookieYes Limited, 3 Warren Yard, Wolverton Mill, Milton Keynes, MK12 5NW, Vereinigtes Königreich; Plugin „CookieYes | GDPR Cookie Consent“). Beim Aufruf der Seite wird ein Banner angezeigt, über das Sie optionale Cookies und Dienste akzeptieren, ablehnen oder individuell einstellen können. Technisch notwendige Cookies – insbesondere das Cookie cookieyes-consent zur Speicherung Ihrer Auswahl – werden unabhängig davon gesetzt.

CookieYes kann zur Protokollierung der Einwilligung (Nachweispflicht nach DSGVO) Daten wie Zeitpunkt, Einwilligungsstatus und gekürzte technische Angaben einschließlich der IP-Adresse verarbeiten. Rechtsgrundlage ist Art. 6 Abs. 1 lit. c DSGVO (rechtliche Verpflichtung zum Nachweis von Einwilligungen) sowie Art. 6 Abs. 1 lit. f DSGVO (berechtigtes Interesse an einem funktionsfähigen, nachweisbaren Consent-Management). Where CookieYes receives data as a processor, a corresponding data processing agreement is in place.

Ihre Auswahl können Sie jederzeit über den Zustimmungs-Button bzw. den Link „Cookie-Einstellungen“ auf der Website ändern. Weitere Informationen: https://www.cookieyes.com/privacy-policy/

8.2 Newsletter

Wenn Sie unseren Blog-Newsletter abonnieren, verarbeiten wir Ihre E-Mail-Adresse, um Ihnen Hinweise auf neue Artikel zu senden. Die Anmeldung erfolgt im Double-Opt-in-Verfahren: Nach dem Eintrag erhalten Sie eine Bestätigungsmail mit Link; erst nach der Bestätigung wird die Adresse für den Versand genutzt. Die Abonnentenliste wird auf unserem eigenen Server gespeichert, nicht bei einem externen Newsletterdienst.

Rechtsgrundlage ist Art. 6 Abs. 1 lit. a DSGVO. Die Einwilligung können Sie jederzeit widerrufen, indem Sie den Abmeldelink in jeder Newsletter-Mail nutzen oder uns per E-Mail an info@eliasschultze.de schreiben. Nach der Abmeldung löschen wir die Adresse aus der Versandliste, soweit keine gesetzlichen Aufbewahrungspflichten entgegenstehen.

8.3 Lokale Schriften

Die auf dieser Website verwendeten Schriftarten (Inter und Outfit) werden lokal von unserem Server ausgeliefert. Es findet kein Abruf von Schrift-Dateien bei Google oder anderen Drittanbietern statt.

9) Rights of the data subject

9.1

Das geltende Datenschutzrecht gewährt Ihnen gegenüber dem Verantwortlichen hinsichtlich der Verarbeitung Ihrer personenbezogenen Daten die nachstehenden Data subject rights (Auskunfts- und Interventionsrechte), wobei für die jeweiligen Ausübungsvoraussetzungen auf die angeführte Rechtsgrundlage verwiesen wird:

• Right of access according to Art. 15 GDPR;
• Right to rectification according to Art. 16 GDPR;
• Right to erasure according to Art. 17 GDPR;
• Right to restriction of processing according to Art. 18 GDPR;
• Right to be informed according to Art. 19 GDPR;
• Right to data portability according to Art. 20 GDPR;
• Right to withdraw consent according to Art. 7 (3) GDPR;
• Right to lodge a complaint according to Art. 77 GDPR.

9.2 RIGHT TO OBJECT

IF WE PROCESS YOUR PERSONAL DATA ON THE BASIS OF A BALANCING OF INTERESTS DUE TO OUR OVERRIDING LEGITIMATE INTEREST, YOU HAVE THE RIGHT TO OBJECT TO THIS PROCESSING AT ANY TIME FOR REASONS ARISING FROM YOUR PARTICULAR SITUATION, WITH EFFECT FOR THE FUTURE.

IF YOU EXERCISE YOUR RIGHT TO OBJECT, WE WILL STOP PROCESSING THE DATA CONCERNED. FURTHER PROCESSING REMAINS RESERVED IF WE CAN DEMONSTRATE COMPELLING LEGITIMATE GROUNDS THAT OVERRIDE YOUR INTERESTS, FUNDAMENTAL RIGHTS AND FREEDOMS, OR IF PROCESSING SERVES THE ESTABLISHMENT, EXERCISE OR DEFENCE OF LEGAL CLAIMS.

IF WE PROCESS YOUR PERSONAL DATA FOR DIRECT MARKETING, YOU HAVE THE RIGHT TO OBJECT AT ANY TIME TO THE PROCESSING OF PERSONAL DATA CONCERNING YOU FOR SUCH MARKETING. YOU CAN EXERCISE THE OBJECTION AS DESCRIBED ABOVE.

IF YOU EXERCISE YOUR RIGHT TO OBJECT, WE WILL STOP PROCESSING THE DATA CONCERNED FOR DIRECT MARKETING PURPOSES.

10) Duration of storage of personal data

The duration of storage of personal data is based on the respective legal basis, the purpose of processing and — where applicable — the respective statutory retention period (e.g. commercial and tax retention periods).

When processing personal data on the basis of express consent according to Art. 6 (1) (a) GDPR, the data concerned is stored until you withdraw your consent.

If statutory retention periods apply to data processed on the basis of Art. 6 (1) (b) GDPR in the context of contractual or similar obligations, this data is routinely deleted after the retention periods expire, unless it is still required to perform or initiate a contract and/or we have no legitimate interest in further storage.

When processing personal data on the basis of Art. 6 (1) (f) GDPR, this data is stored until you exercise your right to object under Art. 21 (1) GDPR, unless we can demonstrate compelling legitimate grounds that override your interests, rights and freedoms, or processing serves the establishment, exercise or defence of legal claims.

When processing personal data for direct marketing on the basis of Art. 6 (1) (f) GDPR, this data is stored until you exercise your right to object under Art. 21 (2) GDPR.

Unless otherwise stated in the information on specific processing situations in this statement, stored personal data is deleted when it is no longer necessary for the purposes for which it was collected or otherwise processed.

Addendum: es.booking

The following sections apply additionally to the use of the platform es.booking (appointment booking software), available at https://es-booking.vercel.app.

11) es.booking – registration and user accounts

11.1

If you register on the platform es.booking (https://es-booking.vercel.app) we process personal data to provide you with a user account and to enable the platform functions.

11.2 Data collected

• First name and last name if applicable
• Email address
• Company / business name
• Business URL (optional)
• Time zone
• Password (stored as a cryptographic hash, not in plain text)
• When signing up via Google: Google account ID, email address and profile information that Google transmits to us
• Usage and log data (login time, IP address in anonymised/hashed form, browser type)

11.3 Purpose and legal basis

Processing takes place to set up and manage your user account, to perform the contract and to provide the platform functions according to Art. 6 (1) (b) GDPR.

11.4 Storage period

Account data is stored as long as your user account exists. After the account is deleted, personal data is deleted within 30 days unless statutory retention obligations apply.

12) es.booking – appointment bookings (for booking end customers)

12.1

Via the booking forms set up by our users (service providers) at /book/{slug} end customers can book appointments. In this context we process the following data:

• Name of the person booking
• Email address
• Phone number (if requested in the form)
• Desired date and time of the appointment
• Optional notes/comments from the booker
• Payment status, amount, deposit and remaining balance (if payment is enabled)
• Time of privacy consent and its wording
• Technical data: IP address (stored as a hash, to prevent abuse)

12.2 Responsibility

controller towards the booking end customer is the respective User (service provider) who operates the booking form. We (Elias Schultze / es.design) act as processor within the meaning of Art. 28 GDPR and process the data exclusively on the user’s instructions to provide the booking system technically.

12.3 Purpose and legal basis

Processing takes place to carry out the appointment booking and, where applicable, payment according to Art. 6 (1) (b) GDPR (performance of a contract). The booker’s privacy consent is documented — if enabled in the form — on the basis of Art. 6 (1) (a) GDPR.

12.4 Storage period

Booking data is stored as long as the respective user (service provider) keeps it in their account. After deletion by the user or termination of the contractual relationship, the data is deleted within 30 days unless statutory retention obligations (e.g. the user’s tax retention periods) apply.

12.5 Data subject rights

Booking end customers should address requests for access, rectification or erasure of their booking data first to the respective service provider (user) whose contact details are given on the booking page or in the booking confirmation. We support the user as processor in fulfilling these requests.

13) Online payments via PayPal

13.1

If the respective user (service provider) has enabled PayPal payments for prepayments or deposits, you will be redirected in the booking process to PayPal Checkout . Payment is processed directly between you and the service provider’s PayPal merchant account.

13.2 Payment service provider

PayPal (Europe) S.à r.l. et Cie, S.C.A.
22–24 Boulevard Royal
L-2449 Luxemburg

Further information on privacy at PayPal: https://www.paypal.com/de/legalhub/privacy-full

13.3 Payment data processed by us

We store keine full payment data (e.g. credit card or account numbers). To track and process bookings we store only:

• PayPal Order ID
• PayPal Capture ID (transaction ID)
• PayPal refund ID (in case of refund)
• Payment status (e.g. pending, paid, refunded)
• Amount paid, total price, deposit and remaining balance
• Currency

13.4 Purpose and legal basis

Processing takes place to carry out the agreed prepayment/deposit for the appointment booking according to Art. 6 (1) (b) GDPR (performance of a contract).

13.5 Payment data security

The transfer of payment data between your browser and PayPal uses an encrypted SSL/TLS connection. The platform itself does not store payment instrument data.

13.6 Data transfers to third countries

PayPal may transfer data to countries outside the EU/EEA. PayPal has joined the EU-US Data Privacy Framework. Further information is available in PayPal’s privacy policy.

14) Hosting, database and technical infrastructure

14.1 Supabase (database and backend)

For storing user accounts, booking data and form settings we use the services of:

Supabase, Inc.
970 Toa Payoh North #07-04
Singapore 318992

Server locations may be in the EU (e.g. Frankfurt). Processing is based on Art. 6 (1) (f) GDPR (legitimate interest in a secure and scalable infrastructure) and Art. 6 (1) (b) GDPR (performance of a contract).

Weitere Informationen: https://supabase.com/privacy

14.2 Vercel (frontend hosting)

The web application is delivered via the following provider:

Vercel Inc.
440 N Barranca Ave #4133
Covina, CA 91723, USA

Processing takes place to provide the platform according to Art. 6 (1) (f) GDPR. Vercel is certified under the EU-US Data Privacy Framework.

Weitere Informationen: https://vercel.com/legal/privacy-policy

14.3 Data processing

Data processing agreements (Art. 28 GDPR) exist or will be concluded with both providers where required.

15) Google Calendar sync (optional)

15.1

Platform users can optionally enable sync with Google Kalender to automatically add booked appointments to their calendar.

15.2

Anbieter: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland.

15.3 Data processed

• OAuth access token (stored encrypted)
• User calendar ID
• Appointment data (date, time, title, participant email) of bookings received via es.booking

15.4 Purpose and legal basis

Processing is based on the user’s consent according to Art. 6 (1) (a) GDPR. The user can disconnect the link at any time in the settings.

Weitere Informationen: https://policies.google.com/privacy?hl=de

16) Google reCAPTCHA (optional)

16.1

If the respective user (service provider) has enabled reCAPTCHA in their booking form, we use the service Google reCAPTCHA to protect against automated bookings (spam/bots).

16.2

Anbieter: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland.

16.3 Data processed

• IP address
• Device and browser information
• Interaction data (e.g. mouse movements, time on page)
• reCAPTCHA-Token

16.4 Purpose and legal basis

Processing is based on our legitimate interest in the security and integrity of the booking forms according to Art. 6 (1) (f) GDPR.

Weitere Informationen: https://policies.google.com/privacy?hl=de

17) Email sending

17.1 Platform emails (by us)

As part of es.booking we send the following emails:

• Registration confirmation and password reset (via Supabase Auth)
• Booking confirmations and reminder emails (on behalf of the user)
• System notifications to users

17.2 Emails via the user’s SMTP (optional)

Users can optionally configure their own SMTP server. In that case email data (recipient, subject, content) is sent via the email server chosen by the user. The user is responsible for configuring their SMTP server in a privacy-compliant way.

17.3 Data processed

• Recipient email address
• Name of the person booking
• Appointment details (date, time)
• Email content according to the user’s template

17.4 Purpose and legal basis

Processing takes place to carry out the appointment booking and to perform the contract according to Art. 6 (1) (b) GDPR.

18) Data processing agreement (DPA)

18.1

Where we process personal data on behalf of our users (service providers) as part of es.booking, the following applies:

• The User is the controller within the meaning of the GDPR.
• We (Elias Schultze / es.design) are a processor according to Art. 28 GDPR.

18.2

On request we provide users with a data processing agreement. Please send requests to: info@eliasschultze.de

Copyright notice: This privacy policy was created by the specialist lawyers of IT-Recht Kanzlei and is protected by copyright (https://www.it-recht-kanzlei.de)

As of: 09.06.2026, 20:14:15