Privacy Policy

This page explains what personal data is processed when you visit andrewegner.de, why, on which legal basis, and which choices you have. Short version: nothing is measured until you say so, one first-party cookie remembers your choice, the contact form is delivered to me by e-mail, and there is no advertising tracking.

1. Controller

André Wegner
Danziger Straße 15
40670 Meerbusch, Germany
E-mail: he@andrewegner.de

No data protection officer is required to be appointed for this website.

2. Hosting and server log files

The website is hosted by IONOS SE, Elgendorfer Str. 57, 56410 Montabaur, Germany, which processes the data described here on my behalf as a processor (Art. 28 GDPR). When you open a page, the web server processes your IP address and records in its log files the requested page, date and time, transferred data volume, referrer and browser/operating-system identifier. This is necessary to deliver the site and to keep it stable and secure (Art. 6(1)(f) GDPR). IONOS deletes these log files after eight weeks.

3. Consent management (privacy settings)

The site uses its own consent layer — no third-party consent service is loaded. On your first visit a notice offers Accept all, Reject all and Settings (granular choice, nothing optional pre-selected). Your choice is stored in one first-party cookie:

Storing this choice is strictly necessary to honour it (§ 25(2) no. 2 TDDDG; Art. 6(1)(c) and (f) GDPR). You can reopen the settings at any time via Privacy settings in the footer and change or withdraw your consent; withdrawal takes effect immediately for the future.

4. Google Tag Manager

Measurement services are loaded and controlled through Google Tag Manager (GTM), a technical tag-management layer provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. GTM itself performs no analysis and sets no cookies; it only loads and controls the measurement service described in section 5 according to the consent state you have chosen. GTM is not loaded before you give consent. Without consent, no request of any kind is sent to Google. When GTM is loaded after your consent, your browser technically transmits your IP address to Google in order to retrieve the container script.

5. Google Analytics 4 (only with your consent)

If you enable Analytics, the site uses Google Analytics 4 (GA4), provided by Google Ireland Limited (address above), loaded through Google Tag Manager, to understand how the site is used: pages viewed, traffic sources, and clicks on calls to action, contact links, navigation and content sections, and whether the contact form was sent (as a bare event — none of its content). Legal basis: your consent (Art. 6(1)(a) GDPR; § 25(1) TDDDG).

Configuration facts:

• Google Consent Mode v2 is used in its basic form: before consent, Google Analytics is not loaded at all and no data — not even cookieless “pings” — is sent to Google.
• Only after Analytics consent is the signal analytics_storage set to “granted”. The advertising signals ad_storage, ad_user_data and ad_personalization always remain “denied”.
• No Google Ads tags, no remarketing, no Enhanced Conversions, no Google Signals, no User-ID and no advertising personalisation are used.
• Google Analytics 4 does not log or store IP addresses; for visitors from the EU, IP data is only used to derive coarse location data and is discarded afterwards (per Google’s documentation).
• Event and user data retention in Google Analytics is set to 2 months.
• No personal data such as names or e-mail addresses is passed to Google Analytics in event parameters, page titles or URLs.

Cookies set by Google Analytics after consent:

Data may be processed by Google on servers outside the EU, including in the United States. Google LLC is certified under the EU-U.S. Data Privacy Framework; in addition, Google’s standard data-processing terms with EU standard contractual clauses apply. Google’s privacy information: policies.google.com/privacy.

Withdrawal: open Privacy settings in the footer and switch Analytics off (or choose Reject all). Collection stops immediately for the future, and the Google Analytics cookies listed above are deleted from your browser by this site.

6. No advertising tracking

This website currently uses no advertising, remarketing or conversion-tracking services and offers no “Marketing” consent category. Should this change in the future, this policy and the consent settings will be updated first, and any such service will be off by default and used only with your separate consent.

7. Contact form and e-mail

If you use the contact form, the data you enter — name, company, e-mail address, your message and, optionally, your company’s website — is transmitted encrypted (TLS) to the web server and delivered to me as an e-mail. It is not stored in the website’s database. The form carries a technical anti-spam check (a hidden field, a signed time stamp and a short-term limit on the number of messages per connection); no CAPTCHA service and no third party is involved. If you write to me directly by e-mail, the same applies to the data you send. Processing serves to answer your request and any follow-up (Art. 6(1)(b) GDPR for pre-contractual or contractual matters, otherwise Art. 6(1)(f) GDPR). Correspondence is kept only as long as required by the purpose and statutory retention obligations.

8. LinkedIn link

The footer contains a plain link to my LinkedIn profile (LinkedIn Ireland Unlimited Company). No LinkedIn code is embedded in this site and no data is transmitted to LinkedIn until you follow the link; from then on LinkedIn’s privacy policy applies.

9. Fonts, embeds and other third parties

All fonts are served from this website’s own server; no external font service is used. The site embeds no third-party videos, maps, social-media widgets or chat tools. Apart from the hosting provider (section 2) and — only after your consent — Google (sections 4 and 5), no third party receives data when you visit.

10. Your rights

You have the right to access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and to object to processing based on legitimate interests (Art. 21). Consent you have given can be withdrawn at any time with effect for the future (Art. 7(3)). You also have the right to lodge a complaint with a data protection supervisory authority (Art. 77), in particular in the EU member state of your residence, workplace or the place of the alleged infringement. For the controller’s seat the competent data-protection authority is the Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen (LDI NRW), Kavalleriestr. 2–4, 40213 Düsseldorf, Germany, poststelle@ldi.nrw.de.

To exercise your rights, write to he@andrewegner.de.

11. Changes

This policy describes the current state of the website and is updated whenever the services in use change. The date of the last update is shown below.