Privacy Policy

How personal data is processed on philhalfmann.com.

Last updated: 10 September 2026

1. Controller

Hubert Philipp Halfmann, Hauptstr. 3, 59379 Selm, Germany
Email: Phil@PhilHalfmann.com
Phone: +49 170 1045390

2. How this website processes data

Personal data is processed only where necessary to operate this website, answer inquiries, provide requested downloads, measure site performance, or meet legal obligations. Depending on the activity, processing is based on Art. 6(1)(a), (b), (c), or (f) GDPR.

3. Hosting and server logs

The hosting provider may process IP address, browser and device information, requested URL, referring URL, and access time in server logs. This is necessary to deliver and secure the website and is based on legitimate interests under Art. 6(1)(f) GDPR. Log retention depends on the hosting provider’s security and operational settings.

4. Contact, Visual Audit, and project inquiry forms

When you contact me or submit a form, I process the information you provide—such as name, email address, company, website, project details, timing, and message—to respond and, where applicable, take steps before entering into a contract. The legal basis is Art. 6(1)(b) GDPR and, for general inquiries, Art. 6(1)(f) GDPR. Form submissions are retained only as long as needed for the inquiry, project, statutory recordkeeping, or the establishment, exercise, or defence of legal claims.

5. Downloads and email marketing

If you request a resource or subscribe to email updates, your contact details and consent record may be processed through Kit (formerly ConvertKit). Marketing emails are sent only with consent under Art. 6(1)(a) GDPR. You may unsubscribe at any time using the link in each email. Transactional delivery of a requested resource may be processed under Art. 6(1)(b) GDPR.

6. Consent management and cookies

This website uses CookieYes to record and manage consent choices. Strictly necessary technologies may operate without consent where required for the website or consent mechanism. Optional analytics, marketing, or embedded-media technologies are activated only after the relevant consent where required. The consent record is processed under Art. 6(1)(c) GDPR; access to or storage of information on your device is governed by § 25 TDDDG.

7. Analytics

Google Analytics

Subject to consent, Google Analytics may process page views, interactions, device and browser information, approximate location, and online identifiers to measure use of the website. The legal basis is Art. 6(1)(a) GDPR. Google may process data outside the EEA under applicable transfer safeguards. Consent can be withdrawn at any time through the cookie settings.

PostHog

Subject to consent, PostHog may process page views, navigation paths, CTA interactions, form interactions, device/browser information, and session data to understand how visitors use the site and improve its conversion paths. The legal basis is Art. 6(1)(a) GDPR. Data is retained only for the configured analytics period and may be processed by PostHog’s service infrastructure under applicable contractual and transfer safeguards.

8. Embedded media and external platforms

Pages may link to or embed content from third-party services such as YouTube and social networks. Embedded content may transmit data to the provider when loaded; where required, it is blocked until consent. Ordinary external links transfer data only after you choose to follow them. The provider’s own privacy terms then apply.

9. Recipients and international transfers

Data may be processed by service providers that support hosting, forms, email delivery, consent management, analytics, security, or website maintenance. They receive only the data needed for their task and are bound by applicable data-protection requirements. Where data is transferred outside the EEA, appropriate safeguards such as an adequacy decision or Standard Contractual Clauses are used where required.

10. Retention

Data is deleted or anonymised when it is no longer needed for its stated purpose, unless legal retention duties or legitimate legal claims require longer storage. Consent remains valid until withdrawn; withdrawal does not affect processing already carried out lawfully.

11. Your rights

You may have rights to access, rectification, erasure, restriction, data portability, and objection, and to withdraw consent at any time. To exercise a right, email Phil@PhilHalfmann.com. You may also complain to a supervisory authority. The competent authority in North Rhine-Westphalia is the State Commissioner for Data Protection and Freedom of Information North Rhine-Westphalia (LDI NRW).

12. Changes to this policy

This notice may be updated when services, legal requirements, or processing activities change. The current version is published on this page.