Privacy notice

The controller responsible for processing personal data on this website within the meaning of Art. 4 (7) GDPR is:

We have not appointed a data protection officer, as we are not required to do so.

Server log data. When you load a page, our hosting provider records the technical data required to deliver it: IP address, timestamp, requested resource, referring page and browser identification. This is processed on the basis of our legitimate interest in delivering and securing the site, Art. 6 (1) (f) GDPR.

Contact form and email. If you write to us we process your name, email address, any company name you supply and the content of your message, in order to answer you and, where relevant, to take steps prior to entering into a contract, Art. 6 (1) (b) and (f) GDPR.

We do not ask for more than we need, and we do not use what you send us for anything other than replying to you.

Nothing is stored on or read from your device until you have agreed to it. On your first visit a banner asks whether we may measure usage; until you accept, no analytics script is loaded at all and no analytics cookie exists.

If you accept, we use Google Analytics 4 (measurement ID G-Q4F3LRNZT8), provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. It sets first-party cookies (_ga and _ga_*) with a lifetime of up to two years to recognise returning browsers, and processes your shortened IP address, the pages you view, referrer, approximate location, device and browser information. IP anonymisation is enabled and Google Consent Mode is set to deny advertising storage.

The legal basis is your consent under Art. 6 (1) (a) GDPR and § 25 (1) TDDDG. You can withdraw it at any time, with effect for the future, using the Cookie settings link in the footer — withdrawal also deletes the analytics cookies from your browser.

Google may transfer data to the United States. Google LLC is certified under the EU–US Data Privacy Framework, and Standard Contractual Clauses under Art. 46 GDPR apply in addition. Analytics data is retained for 14 months and then deleted automatically. Google acts as our processor under Art. 28 GDPR.

Your choice itself is remembered in local storage under the key befzy.consent.v1. That is strictly necessary to honour the decision and is not a cookie. Fonts are served from our own infrastructure rather than a third-party font network, so loading a page never discloses your IP address to a font provider.

We use a small number of service providers to operate the site and our correspondence. Each acts as a processor under a data processing agreement pursuant to Art. 28 GDPR:

• Hosting: Hostinger International Limited. The server is located in Frankfurt am Main, Germany.
• Business email and contact form delivery: Hostinger International Limited, which hosts the mailbox behind hello@befzy.com.
• Analytics, only with your consent: Google Ireland Limited (Google Analytics 4).

We do not sell personal data and we do not share it with advertising networks. Where a provider processes data outside the EEA, the transfer is covered by an adequacy decision or by Standard Contractual Clauses under Art. 46 GDPR.

Server logs are retained for a short technical period and then deleted or anonymised. Enquiries are kept for as long as the conversation is live and for a reasonable period afterwards in case you come back to it. Where statutory retention duties apply — for example under commercial or tax law — we keep only what those duties require, and only for as long as they require it.

If you ask us to delete an enquiry before then, we will, unless a retention duty prevents it.

This notice covers the website. When we work on a project, any personal data contained in your systems is processed on your instructions under a separate data processing agreement, in which you are the controller and we are the processor.

In those engagements we work on the minimum data required, name every sub-processor before it is used, and agree deletion at the end of the engagement in writing.

Under the GDPR you have the right to:

• access the personal data we hold about you (Art. 15)
• have inaccurate data corrected (Art. 16)
• have data erased (Art. 17)
• restrict processing (Art. 18)
• receive your data in a portable format (Art. 20)
• object to processing based on legitimate interests (Art. 21)

To exercise any of these, write to hello@befzy.com. You will reach a person, not a workflow.

You also have the right to lodge a complaint with a supervisory authority under Art. 77 GDPR. The authority responsible for us is the State Commissioner for Data Protection and Freedom of Information Baden-Württemberg. You may also complain to the authority where you live or work.

We update this notice when our processing changes — for example if we add an analytics provider or change host. The current version always applies and is dated at the top of this page.