Legal & privacy

Imprint (Impressum)

Information pursuant to section 5 of the German Digital Services Act (DDG).

Privacy Policy

Who is responsible?

Falko Baeker, at the address above, is the controller for this website and its design previews. For any privacy question or to exercise your rights, email falko@falkobaeker.com.

Hosting and server logs

This website and its previews are hosted by Netlify, Inc., USA. To deliver and secure the website, Netlify processes technical request data, including IP addresses, request times, requested URLs, and browser information in server logs. Netlify participates in the EU–US Data Privacy Framework, which provides a framework for transfers of personal data to certified US companies. See Netlify's privacy information. Hosting and security are based on our legitimate interest in providing a reliable, secure website (Article 6(1)(f) GDPR).

Cookieless preview statistics

I record whether a design preview is opened and how it is used, so I can understand whether the preview was useful and follow up appropriately. This also covers the landing page and its work and contact links. There are no cookies, advertising trackers, browser visitor IDs, or fingerprinting.

Every event sent by the page contains only the preview identifier (slug), event type, kennel name where applicable, kit version, and the optional r channel parameter from that page's own URL. Opening the preview sends open; opening the landing page sends landing_open. The landing page uses the from parameter that the preview's pricing link adds to its own destination URL to associate the visit with a preview. It does not read a referrer.

The interaction events are panel_open, interest, later, decline, pricing_click, work_click, contact_click, and form_blocked. These carry no additional details. engaged records visible seconds and maximum scroll depth on this page. summary, sent when the page is hidden or left (up to three times per page view), also records identifiers of this page's sections viewed for at least a second and its click count. These usage values describe only interactions with our own page.

The only other event details are information you explicitly submit: interest_details contains your required email address and any optional name and question; decline_reason may contain your optional feedback. The server rejects unexpected client fields.

The page scripts do not read or send screen or window dimensions, pixel ratio, browser language, browser time zone, touch capabilities, automation flags, referrers, or other device or browser properties. They do not read the browser's User-Agent value. Form fields in the demo are not transmitted.

Separately, the server adds the event time and the User-Agent HTTP request header (limited to 200 characters), which the browser sends automatically. A coarse device category (mobile, tablet, or desktop) and an automated-traffic flag are derived exclusively from that header on the server, without client-side device detection. Netlify supplies an approximate city, region, country, and geographic time zone derived from the connection IP address. These geographic estimates are not read from browser settings.

I never store the connection IP address in these statistics. The server uses it with the User-Agent header, current UTC date, and a secret salt to generate a SHA-256 pseudonymous visitor code shortened to 16 hexadecimal characters. This code changes daily and is not saved in your browser.

The legal basis is Article 6(1)(f) GDPR: my legitimate interest in assessing interest in individually prepared previews and making relevant follow-ups. Statistics and notification throttle records are deleted after 180 days by a daily cleanup.

Notifications

When notifications are enabled, selected non-bot events are sent from the server to ntfy.sh, which uses Google Firebase Cloud Messaging (FCM) as a delivery service for push notifications. Firebase delivery remains enabled. Notification titles and text contain only the event type, kennel name, and country code. They contain no contact details, messages, decline reasons, city, region, or device information. A link opens my protected dashboard; submitted details are available there, not in push notifications. The legal basis is Article 6(1)(f) GDPR for timely follow-up, and Article 6(1)(b) GDPR where the notification concerns your request for services. The browser does not connect directly to ntfy.sh or FCM.

Details you choose to send

The interest panel requires your email address so I can reply. Your name and question are optional. I use these details only to respond to your request and discuss your website. The panel shows a success message only after the server confirms receipt. If sending fails, your entries stay in the form so you can retry or contact me directly by email. When notrack or owner mode is active, the panel does not submit details and offers direct email instead. Optional decline feedback helps me understand your response. The basis is Article 6(1)(b) GDPR for pre-contractual requests, or Article 6(1)(f) GDPR for other replies and feedback. These form events are stored with the statistics for up to 180 days. If we continue by email or become contractual partners, correspondence may be retained as needed for that relationship and any applicable legal retention duties.

The demonstration form's fields have no submission names, so their values are not transmitted even if JavaScript is disabled. With JavaScript enabled, the kit blocks submission and records only form_blocked, without field contents. The separate interest panel is created by JavaScript and sends only the details you choose to submit to me.

Your choice and browser storage

To view any page without sending statistics, add ?notrack=1 to its URL (or &notrack=1 if it already has a query). This applies to that page view. An owner opt-out flag, fb_owner, is stored locally only when owner mode is enabled with ?owner=1 or the administration page is opened. ?owner=0 removes that flag. The administration page can also remember the owner's access key locally. No other local storage is used by this website.

Your rights

Subject to the GDPR's conditions, you have rights of access, rectification, erasure, restriction of processing, and data portability. You may object at any time to processing based on legitimate interests under Article 21 GDPR, particularly to follow-ups and the associated preview statistics. Email me at the address above. Because visitor codes change daily, a preview link and approximate visit time can help locate relevant records; please do not send unnecessary sensitive information.

You also have the right to lodge a complaint with a data protection supervisory authority, in particular in the EU member state of your habitual residence, workplace, or the place of the alleged infringement.

Links to other websites

Reference websites open only when you follow their links. Fonts, screenshots, and other page assets are hosted with this site; this website embeds no third-party analytics, fonts, or media services.

Last updated: October 2026