Privacy Policy
Controller
The controller within the meaning of the GDPR is Contiva GmbH, Yokohamastraße 2, 20457 Hamburg, Germany, represented by its managing director Robert John Fels. Contact: [email protected].
Hosting & server log files
This website is hosted by Vercel Inc., 340 S Lemon Ave #4133, Walnut, CA 91789, USA, served from the Frankfurt am Main region. The content delivery network of Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107, USA sits in front of it. Both act as processors. When you access the site, access data (including IP address, date and time, the requested resource, the amount of data transferred, browser type and referrer) is processed automatically. This serves the secure and stable operation of the site and the mitigation of attacks (Art. 6(1)(f) GDPR). As both providers are US companies, data may be transferred to the USA; such transfers are safeguarded by standard contractual clauses and certification under the EU-US Data Privacy Framework. For details see the privacy notices of Vercel and Cloudflare.
Cookies & local storage
This website sets no tracking or marketing cookies. Only two strictly necessary entries are stored, both triggered by your own interaction: the cookie “NEXT_LOCALE” stores your language choice (German/English), and the local storage entry “RF_MOTION” records whether you paused animations. Neither contains a personal identifier, neither leaves your device for analytics purposes, and both are required for the functions you requested (Sec. 25(2) no. 2 TDDDG, Art. 6(1)(f) GDPR). No consent is required for them, which is why this site works without a cookie banner.
Audience measurement & analytics
Vercel Web Analytics and Vercel Speed Insights by Vercel Inc. are used for audience measurement. Both operate without cookies and without accessing information stored on your device; no cross-device profile is built and no identifier is followed across websites. Aggregated data such as the page visited, referrer, country, device type, browser and loading-performance metrics is collected. A visit is attributed via a pseudonymous checksum that rotates daily; IP addresses are not stored. The legal basis is our legitimate interest in a data-minimising evaluation of site usage (Art. 6(1)(f) GDPR). No consent is required under Sec. 25 TDDDG because no information is stored on or read from your device. Vercel describes the details in its analytics privacy statement. No data is shared with advertising networks.
Appointment booking (Calendly)
Available slots are only fetched server-side via the Calendly API after you actively click. No contact details are transmitted at that point. Only when you confirm a booking are your name, email address, time zone and the selected slot transmitted to Calendly LLC (USA) with your consent (Art. 6(1)(a) GDPR). No Calendly script and no iframe are loaded. Calendly describes how it safeguards international data transfers via the EU-US Data Privacy Framework and standard contractual clauses in its Data Processing Addendum.
Your rights
You have the right at any time to access, rectification, erasure, restriction of processing, data portability and withdrawal of consent. The competent supervisory authority is the Hamburg Commissioner for Data Protection and Freedom of Information; you also have the right to lodge a complaint with any other supervisory authority.
Last updated: 2026-08-04