Privacy Policy

Last updated: September 2026

Binding version: This is a translation provided for convenience. The legally binding version is the German Datenschutzerklärung. In the event of any discrepancy, the German text prevails.

1. Controller

The controller within the meaning of the General Data Protection Regulation (GDPR), other national data protection laws and further data protection provisions is:

represented by Johann Gosniz and Paul Mill

34346 Hann. Münden
Germany

Phone: +49 160 2171594
E-mail: hallo@paulmill.com

2. General information on data processing

Protecting your personal data is important to us. This privacy policy informs you about the nature, scope and purpose of the collection and use of personal data on this website in accordance with the General Data Protection Regulation (GDPR) and the German Federal Data Protection Act (BDSG).

Personal data is only collected insofar as this is necessary to provide a functioning website as well as our content and services.

3. Hosting and content delivery

This website is hosted by Cloudflare, Inc., 101 Townsend St, San Francisco, CA 94107, USA, and delivered via their content delivery network (CDN).

When you access this website, information is automatically transmitted to the server and temporarily stored in server log files:

• IP address of the requesting device
• Date and time of access
• Name and URL of the page accessed
• Volume of data transferred
• Access status (HTTP status code)
• Browser and operating system used
• Referrer URL (previously visited page)

Legal basis: Art. 6 (1) (f) GDPR (legitimate interest in the technically error-free presentation and security of the website).

Storage period: Server log files are deleted automatically after 30 days.

Transfer to third countries: Cloudflare also processes data in the USA. Cloudflare is certified under the EU-US Data Privacy Framework (DPF), so an adequate level of data protection is ensured. Further information: Cloudflare privacy policy.

4. Contact by e-mail

If you contact us by e-mail, the data you provide (name, e-mail address, content of the message) will be stored for the purpose of processing your enquiry and in case of follow-up questions.

Legal basis: Art. 6 (1) (b) GDPR (performance of pre-contractual measures) or Art. 6 (1) (f) GDPR (legitimate interest in responding to your enquiry).

Storage period: Your data will be deleted once your enquiry has been dealt with conclusively, unless statutory retention obligations apply (for example commercial or tax retention periods of up to 10 years).

Disclosure: No data is passed on to third parties without your express consent.

5. Contact form

If you use the contact form on this website, the following data is collected:

Mandatory information:

• Name
• E-mail address
• Service requested
• Project description

Optional information:

• Phone number
• Budget range
• Preferred time frame

5.1 Storage and processing

The form data is stored in a Cloudflare D1 database. Processing takes place exclusively on servers within the Cloudflare network (region: Western Europe). The data is used solely to process your enquiry.

Legal basis: Art. 6 (1) (b) GDPR (performance of pre-contractual measures).

5.2 IP address and abuse prevention

In addition, your IP address is processed to protect the contact form against misuse (rate limiting). A maximum of 5 requests per IP address per hour is permitted.

Legal basis: Art. 6 (1) (f) GDPR (legitimate interest in protection against misuse and spam).

Storage period: The IP address is deleted after 30 days. A daily automated job removes it from the database; the remaining details of your enquiry are not affected (see 5.5).

5.3 Spam protection (honeypot)

The contact form uses a technical anti-spam measure (honeypot method). A form field that is invisible to human users is included and is only filled in by automated programs (bots). No personal data is collected or transmitted to third parties. No behavioural analysis takes place.

Legal basis: Art. 6 (1) (f) GDPR (legitimate interest in protection against spam).

5.4 Bot protection (Cloudflare Turnstile)

To protect the contact form against automated submissions, we use Cloudflare Turnstile, a service provided by Cloudflare, Inc., 101 Townsend St, San Francisco, CA 94107, USA.

Turnstile checks whether the request originates from a human. To do so, a script is loaded from challenges.cloudflare.com when the page is accessed and a check is carried out in the background. The following data is transmitted to and processed by Cloudflare:

• IP address of the requesting device
• Information about the browser and operating system
• Technical characteristics of the device and interaction data within the browser
• A token set by Cloudflare for one-time verification of the request

No cross-site tracking takes place, and Cloudflare does not use the data for advertising purposes. The check runs without any puzzle for you to solve.

Legal basis: Art. 6 (1) (f) GDPR. Our legitimate interest lies in protecting the contact form against abusive automated use and spam.

Transfer to third countries: Cloudflare also processes data in the USA. Cloudflare is certified under the EU-US Data Privacy Framework (DPF), so an adequate level of data protection is ensured.

Further information: Cloudflare privacy policy

5.5 Storage period and deletion

Your form data will be deleted once the enquiry has been concluded or once statutory retention periods have expired. You may request deletion of your data at any time (see section 9).

5.6 Disclosure to third parties

Your form data is not passed on to third parties.

5.7 E-mail delivery (Cloudflare Email Service)

The confirmation of receipt for your enquiry and the internal notification are delivered via Cloudflare Email Service, a service provided by Cloudflare, Inc., 101 Townsend St, San Francisco, CA 94107, USA. The e-mails are sent from the domain paulmill.com.

The details you entered in the form (name, e-mail address, phone number where given, service, number of pages, timeline and your message) are transmitted in the process — they form the content of the confirmation e-mail to you and of the notification to us.

No additional e-mail provider is involved: delivery runs with the same processor that already hosts this website (see section 3).

Legal basis: Art. 6 (1) (b) GDPR (steps taken prior to entering into a contract).

Transfer to third countries: Cloudflare also processes data in the USA. Cloudflare is certified under the EU-US Data Privacy Framework (DPF), so an adequate level of data protection is ensured.

A data processing agreement pursuant to Art. 28 GDPR is in place with Cloudflare. Further information: Cloudflare privacy policy

6. Cookies and tracking

This website uses no cookies for marketing, analytics or tracking purposes. No tracking tools (such as Google Analytics, Matomo or similar services) are used.

Only technically necessary cookies are used, which are strictly required for the operation of the website (for example Cloudflare session cookies for protection against attacks).

Legal basis: Art. 6 (1) (f) GDPR (legitimate interest in the secure operation of the website). Consent pursuant to Section 25 (2) TDDDG (formerly TTDSG) is not required for technically necessary cookies.

7. Fonts

This website uses the typefaces Manrope and Inter. The font files are stored locally on the server and delivered directly by this website.

No connection is made to external servers (such as Google Fonts). No data is transmitted to third parties.

8. SSL/TLS encryption

For security reasons, this website uses SSL/TLS encryption. You can recognise an encrypted connection by the padlock symbol in your browser’s address bar and by the address bar starting with “https://”.

When SSL/TLS encryption is active, the data you transmit to us cannot be read by third parties.

9. Your rights as a data subject

Under the GDPR you have the following rights regarding your personal data:

• Right of access (Art. 15 GDPR) — you may request information about the data we hold about you.
• Right to rectification (Art. 16 GDPR) — you may request the correction of inaccurate data.
• Right to erasure (Art. 17 GDPR) — you may request the deletion of your data, provided no statutory retention obligations apply.
• Right to restriction of processing (Art. 18 GDPR) — you may request that the processing of your data be restricted.
• Right to data portability (Art. 20 GDPR) — you may request that we provide your data in a common, machine-readable format.
• Right to object (Art. 21 GDPR) — you may object to the processing of your data at any time insofar as the processing is based on Art. 6 (1) (f) GDPR.

To exercise your rights, please contact: hallo@paulmill.com

You may withdraw any consent given at any time with effect for the future by contacting us by e-mail.

10. Right to lodge a complaint with a supervisory authority

Without prejudice to any other administrative or judicial remedy, you have the right to lodge a complaint with a data protection supervisory authority if you consider that the processing of your personal data infringes the GDPR.

The supervisory authority responsible for us is:

Die Landesbeauftragte für den Datenschutz Niedersachsen
Prinzenstraße 5
30159 Hannover, Germany
Phone: +49 511 120-4500
E-mail: poststelle@lfd.niedersachsen.de
Website: www.lfd.niedersachsen.de

11. Validity and changes to this privacy policy

This privacy policy is currently valid and dated September 2026. As our website develops further, or due to changed statutory or regulatory requirements, it may become necessary to amend this privacy policy. The current version is always available on this page.