girweb.

This is a courtesy translation. The German version is the legally binding one.

Privacy Policy

Controller

Daniel Girnjak, girweb
Ernst-Thälmann-Straße 26, 01809 Heidenau, Germany
Email: kontakt@girweb.eu

Contact form and subscription inquiry

If you use the contact form or the subscription inquiry form, the data you enter (name, email address, project type if applicable, desired plan, website, message) is stored on our server and we are notified by email. We use this data solely to process your inquiry (Art. 6(1)(b) GDPR, pre-contractual measures). Inquiries are deleted once they have been handled and no statutory retention obligations apply. To protect against automated submissions, we use an invisible form field (honeypot) and a rate limit on the number of requests per period; your IP address is briefly processed in memory for this purpose.

Client portal

Clients receive access to the client portal from us. There we process name, email address, a securely hashed password, project and subscription data, and support tickets for the performance of the contract (Art. 6(1)(b) GDPR). A technically necessary session cookie (girweb.sid, 8 hours) is set for login. For password resets, we send a time-limited link by email on request.

Payment processing (Stripe)

Subscriptions can be paid online in the client portal (card, Apple Pay, Google Pay). Payment is processed by Stripe Payments Europe, Ltd., 1 Grand Canal Street Lower, Dublin 2, Ireland. You enter payment details (e.g. card number) directly into a form provided by Stripe; they are not stored on our server. Name, email address, billing address (if applicable), the chosen plan and the amount are transmitted to Stripe. The legal basis is performance of the contract (Art. 6(1)(b) GDPR). Stripe sets its own technically necessary cookies for fraud detection (§ 25(2) TTDSG). Stripe may transfer data to the USA; this is based on the EU Standard Contractual Clauses and certification under the EU-US Data Privacy Framework. More information: stripe.com/en-de/privacy. We retain invoices and payment records in accordance with commercial and tax law retention periods (§ 147 AO, § 257 HGB).

Email delivery

For sending notifications (e.g. access credentials, password reset) we use the service Brevo (Sendinblue GmbH, Köpenicker Straße 126, 10179 Berlin, Germany) as a processor (Art. 28 GDPR). Your email address and the content of the message are transmitted to this service.

Hosting

This website is hosted by STRATO GmbH, Otto-Ostrowski-Straße 7, 10249 Berlin, Germany. When you access the site, the hosting provider processes technically necessary access data (e.g. IP address, date and time of access, page accessed, browser) in the form of server log files (Art. 6(1)(f) GDPR, legitimate interest in secure operation). Log files are deleted after 14 days.

Fonts

The fonts used (Inter, IBM Plex Mono) are loaded locally from our server. No connection is made to Google Fonts or other font providers.

Cookies and consent

On your first visit, we ask via a banner which optional services you allow. Without your consent, only technically necessary cookies and storage technologies are used (§ 25(2) TTDSG). Optional services only load after you have given consent (Art. 6(1)(a) GDPR). You can change or withdraw your decision at any time with effect for the future: via Cookie settings or the link of the same name in the footer of every page. Your decision is stored in your browser's local storage under girweb-consent (with date and version) and asked again after at most 12 months.

Necessary (always active)

Statistics – Google Analytics 4

Only with your consent do we use Google Analytics 4, a web analytics service by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Google Analytics sets cookies (_ga, _ga_*, 2 years each) and records page views, time on page, approximate location and technical data about your device. IP addresses are shortened; advertising features and Google signals are disabled. Data may be transferred to Google LLC servers in the USA; Google is certified under the EU-US Data Privacy Framework. Data is deleted after 14 months. More information: Google's privacy policy, browser add-on to opt out. Legal basis: your consent (Art. 6(1)(a) GDPR), which you can withdraw at any time via the cookie settings.

External media

Embedded third-party content (e.g. YouTube videos via youtube-nocookie.com, Google Maps) is only loaded with your consent. Without consent, you see a placeholder and can allow each item individually. When loaded, your IP address and browser data are transmitted to the respective provider (Google Ireland Limited), which may set its own cookies. Legal basis: your consent (Art. 6(1)(a) GDPR).

Your rights

You have the right at any time to access, rectify, erase or restrict the processing of your personal data stored with us, as well as a right to object to processing and a right to data portability. You can withdraw any consent given at any time with effect for the future. Please contact the email address above. You also have the right to lodge a complaint with a data protection supervisory authority. The authority responsible for us is the Saxon Data Protection and Transparency Commissioner (datenschutz.sachsen.de).

Last updated: 14 Sep 2026