Who is behind
this site.

The German version (Impressum) is legally binding; this is a translation.

Information pursuant to § 5 DDG

Nicolas Jäschke
Sieboldstraße 5
35398 Gießen
Germany

Under the name Webmanufaktur Jäschke I design, build and maintain websites.

Contact

Email: hello@njworks.studio

VAT

Small business under § 19 of the German VAT Act (UStG): no VAT is charged.

Responsible for content pursuant to § 18 (2) MStV

Nicolas Jäschke, address as above.

Liability for links

This website may link to external sites. Their operators alone are responsible for their content. If I become aware of any infringement, I will remove the link immediately.

Consumer dispute resolution

I am neither willing nor obliged to take part in dispute resolution proceedings before a consumer arbitration board.

This policy covers njworks.studio.

1. Controller

Nicolas Jäschke, Sieboldstraße 5, 35398 Gießen, Germany
Email: hello@njworks.studio

2. Hosting and delivery

The website is delivered via Cloudflare, Inc., 101 Townsend St, San Francisco, CA 94107, US. When you open a page, Cloudflare processes technically necessary data: IP address, date and time, the address requested, browser and operating system, and the referring page. This is needed to deliver the site and protect it against attacks.

The legal basis is Art. 6(1)(f) GDPR; my legitimate interest is a secure, working website. Cloudflare is certified under the EU-US Data Privacy Framework, so processing in the US is covered by an adequacy decision of the European Commission.

3. Audience measurement without cookies

To see which pages are read, I use Cloudflare Web Analytics (provider Cloudflare, see above). The measurement sets no cookies and builds no profiles of individual visitors; it only records aggregated figures such as page views, referring site, country, browser and load times. The legal basis is Art. 6(1)(f) GDPR; my legitimate interest is understanding which content is used. If you prefer not to be counted, block the script from static.cloudflareinsights.com with a content blocker; the site works just the same.

Apart from that, this website itself sets no cookies and uses no other analytics or tracking services. In your browser’s session storage it only remembers display settings: whether the intro animation has already played and, on the example sites, whether the insight panel is open, which tab is selected and the last check result for the example. None of this is personal data, nothing is sent to me, and it is all deleted when you close the tab (§ 25(2) no. 2 TDDDG). Only if Cloudflare suspects an attack may a technically necessary cookie be set for protection (§ 25(2) no. 2 TDDDG).

4. Package picker, advisor and order details form

The calculations in the package picker and the advisor run only in your browser. No data is sent to me until you send the prepared email yourself.

Once you’ve accepted my quote, you can put together your contract and invoice details (business, address, authorised representatives and contact persons, domain, email) in a form I send you as a link. This form doesn’t store or transmit anything either; the details only reach me with the email you send yourself. I use them to prepare the contract, invoices and the set-up of your site (Art. 6(1)(b) GDPR) and keep them with the contract documents for as long as statutory retention periods apply.

5. Fonts

All fonts are served from this server. No connection is made to Google or any other font provider.

6. Website check

If you enter an address in the website check, my server (Cloudflare, see above) fetches the home page at that address once and analyses it. Unless you request the result by email, neither the address nor the result is stored permanently; the result is only sent back to your browser. Only the result for my example sites is kept in the server’s memory for up to 10 minutes, so not every visit triggers a new check. If you open the “Website check” tab on an example site, the server checks that example’s home page in the same way. Your IP address is briefly held in memory to limit misuse (at most eight checks per minute) and is not stored. The legal basis is Art. 6(1)(f) GDPR (your request for the check, my interest in a secure service).

Unlocking the result: Without any further input you only see the overall score. Only if you submit your email address in the “Unlock my result” window are your email address, the name of your business (if given), the address checked, the result, the language, the time, the confirmation status and the wording of your consent stored with Cloudflare; your IP address is only held briefly in memory to limit misuse. By clicking “Unlock my result” you agree that I may email you the result and offers for websites, care plans and the website review; the wording is shown directly above the button. You first receive an email with the link to your result. Only when you open that link and the page loads your result does the request count as confirmed; you then see the score for each area and the most important finding in each, and I may write to you. That email is sent on my behalf by the email service Brevo (Brevo GmbH, Köpenicker Str. 126, 10179 Berlin, Germany); for this, Brevo receives your email address and the content of that email. A data processing agreement (Art. 28 GDPR) is in place with Brevo; where Brevo uses providers outside the EU, the EU Commission’s standard contractual clauses apply. Opens and clicks are not analysed on a personal level. When a request is confirmed, I receive a notice via Brevo with the address checked, the score and the name of the business, without your email address. The legal basis is your consent (Art. 6(1)(a) GDPR, § 7(2) no. 2 UWG). You can withdraw it at any time with a short email to hello@njworks.studio; I will then stop writing to you and delete the result and the address checked, and in any case this happens automatically after 90 days. As soon as I have collected a confirmed request, the email address, business name and wording are deleted at Cloudflare; until the 90 days are up, only what the result link needs stays there (a random identifier, the address checked, score, language, and the times of request, confirmation and collection). So that the same address is not written to repeatedly, Cloudflare also stores a non-reversible check value of your email address for 14 days. Brevo keeps delivery logs (recipient, subject, time, delivery status) for a limited time. Requests that are not confirmed within 14 days are deleted; without confirmation I will not write to you a second time. To be able to prove your consent (Art. 7(1) GDPR), after confirmation I keep your email address, the time of the request and of the confirmation, the wording of the consent and the dates of the emails sent, separately and with restricted access, until the end of the third year after the last email (Art. 6(1)(f) GDPR).

Ordering the website review: If you order a website review through the order form, your name, business, invoice address, email address, the website address and the time are stored with Cloudflare until I have collected the order, for 90 days at most; a non-reversible check value of your email address stays for 24 hours so that the same order is not confirmed twice. You receive a confirmation of receipt by email straight away, sent via Brevo (see above). The legal basis is the performance of the contract (Art. 6(1)(b) GDPR); I keep invoice data for the statutory retention periods.

7. Contact by email and booking

If you write to me, I process your details to answer your enquiry and, where relevant, prepare a quote (Art. 6(1)(b) or (f) GDPR). Emails are received via Apple iCloud Mail, provided by Apple Distribution International Ltd., Hollyhill Industrial Estate, Cork, Ireland. From there they are forwarded to Gmail, where I read and answer them; the provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Both act as processors. Processing in the US is possible: Google is certified under the EU-US Data Privacy Framework, which is covered by an adequacy decision of the European Commission (Art. 45 GDPR); Apple safeguards transfers with EU standard contractual clauses (Art. 46 GDPR). I delete the data once it is no longer needed and no statutory retention period applies.

The “Book a first call” and “Book a callback” buttons are plain links to Cal.com; nothing is loaded on this site for them. You only enter your name, email address and request on the booking page, and for a callback your phone number. The provider is Cal.com, Inc., US, which processes the details on my behalf to arrange the appointment (Art. 6(1)(b) GDPR); the appointment is added to my Google Calendar (Google Ireland Limited, see above). Cal.com processes data in the US and, according to its own information, bases transfers on EU standard contractual clauses or the EU-US Data Privacy Framework. Cal.com’s notice: cal.com/privacy.

8. Files from clients (Proton Drive)

Photos, logos and documents for a project are received via Proton Drive, a service of Proton AG, Route de la Galaise 32, 1228 Plan-les-Ouates, Switzerland. Files are end-to-end encrypted; Proton cannot read their content. Switzerland is covered by an adequacy decision of the European Commission (Art. 45 GDPR). The legal basis is the performance of the contract (Art. 6(1)(b) GDPR). I delete the folder when we stop working together: without a care plan after the handover, with a care plan when it ends.

9. Contacting businesses (outreach)

I contact businesses by post, email or phone when I think I could improve their website. The business data (business name, address, business phone number and email address, field, website, contact person from the legal notice) comes from public sources: OpenStreetMap (© OpenStreetMap contributors, ODbL) and the business website. The purpose is promotional contact with the business, the legal basis my legitimate interest (Art. 6(1)(f) GDPR). You can object at any time (Art. 21 GDPR), a short message is enough; I then put you on a block list and never write again. Without a reply, I delete the data after six months at the latest.

10. External links

Links to other sites only transfer data to that provider once you click them.

11. Your rights

You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and to object to processing (Art. 21). An informal email to the address above is enough.

Right to object: where I process data on the basis of Art. 6(1)(f) GDPR, you may object at any time on grounds relating to your particular situation.

You may also lodge a complaint with a data protection authority (Art. 77 GDPR), for example the Hessian Commissioner for Data Protection and Freedom of Information.

Last updated: October 2026