Skip to content
Blackforestweb – home page

Privacy policy

Privacy policy

Last updated: 10 October 2026

This privacy policy explains how we process personal data when you visit our website https://blackforestweb.de and when you contact us.

Personal data is any information relating to an identified or identifiable natural person.

This is a translation of the German privacy policy. In case of any discrepancy, the German version shall prevail.

1. Controller

The controller responsible for data processing is:

Lazic & Grether / blackforestweb GbR
Represented by the partners Oliver Lazic and Benedikt Grether
Hafnergasse 2
79379 Müllheim im Markgräflerland
Germany

Phone: +49 178 9216759
Email: info@blackforestweb.de

If you have any questions about data protection or wish to exercise your rights, you can reach us using these contact details. We have not appointed a data protection officer, as we are not legally required to do so.

2. Hosting and technical provision

Our website is hosted by:

Mittwald CM Service GmbH & Co. KG
Königsberger Straße 4–6
32339 Espelkamp
Germany

When you access our website, the hosting provider processes technically necessary connection data. This includes in particular:

  • the IP address of the accessing device,

  • the date and time of access,

  • the pages and files accessed,

  • the amount of data transferred and the HTTP status code,

  • browser type and version as well as operating system,

  • where applicable, the previously visited page, if your browser transmits it.

This data is processed in order to deliver the website, to ensure its functionality and security, and to detect technical errors and misuse.

The legal basis is Art. 6(1)(f) GDPR. Our legitimate interest lies in providing the website in a stable and secure manner and in being able to detect and fix attacks and errors.

According to our hosting provider, IP addresses in the access logs are shortened and thus stored in anonymised form. Access logs are deleted after 60 days, error logs after 7 days. In the event of specific security incidents, individual log data may be kept longer where this is necessary to investigate the incident or to establish, exercise or defend legal claims.

The hosting provider processes the data on our behalf. We have concluded a data processing agreement with it pursuant to Art. 28 GDPR. The data is processed in Germany.

Further information: https://www.mittwald.de/datenschutz

3. Cookies and storage functions of your browser

Our website uses cookies and comparable storage functions of your browser (local storage and session storage). We distinguish between functions that are strictly necessary to provide the website and optional functions that we only use with your consent.

Strictly necessary functions

Information is stored on and accessed from your device on the basis of Section 25(2) No. 2 of the German Telecommunications Digital Services Data Protection Act (TDDDG), because this is strictly necessary for the functions you use. Where personal data is processed in this context, the legal basis is Art. 6(1)(f) GDPR. Our legitimate interest lies in providing the respective function securely and as requested by you.

  • kirby_session (cookie): session identifier that protects the contact form against forged and automated submissions (section 7). It is only set on pages that contain the contact form. Storage period: 2 hours.

  • cc_cookie (cookie): stores your choice in the cookie banner (section 4). Storage period: 182 days.

  • blw_language (cookie): stores the language of the page you last visited (German, English or Spanish) so that the home page is shown in that language on your next visit. On your first visit to the home page, we choose the language based on your browser's language setting; this information is not stored. Storage period: 1 year.

  • uranus-theme (local storage): stores your choice between light and dark mode. Storage period: until you change your choice or delete the website data in your browser.

  • uranus-notices-dismissed (session storage): remembers which notices you have closed. Storage period: until the end of the browser session.

Optional functions

We only use optional cookies and comparable storage access with your consent. The legal bases are Section 25(1) TDDDG and Art. 6(1)(a) GDPR. At present, this only concerns Google Analytics (section 5).

You can change your choice and withdraw your consent with effect for the future at any time via "Cookie settings" in the footer of the website.

4. Management of your consent

To request and manage your consent, we use the open-source solution CookieConsent, which we provide ourselves on our own domain. No data is transferred to third parties in this process.

We store your choice in the cookie "cc_cookie" for 182 days. It contains the selected categories, a randomly generated consent identifier, the time of your decision and the version of the consent request. This allows the website to respect your decision on subsequent visits and allows us to demonstrate that consent has been given. Once the storage period has expired or the consent request changes, we will ask you again.

The legal basis for storage in your browser is Section 25(2) No. 2 TDDDG. Where personal data is processed, the legal basis is Art. 6(1)(c) GDPR in conjunction with Art. 7(1) GDPR (proof of consent).

If you decline optional services, you can still use the website without restriction.

5. Google Analytics

With your consent, we use Google Analytics 4 to statistically evaluate the use of our website and to improve our services.

The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland ("Google").

Google Analytics is only loaded after you have agreed to the category "Measurement" in the cookie banner. Without your consent, neither is the script loaded nor are any cookies set.

The following data is processed in particular:

  • pages visited and interactions on the website,

  • time and duration of use,

  • technical information about browser, operating system and device,

  • the origin of the visit, for example a referring website,

  • approximate location information derived from the IP address,

  • pseudonymous identifiers to recognise the browser and session.

According to Google, IP addresses of users in the EU are only used to derive approximate location information and are then discarded; they are neither logged nor stored in Google Analytics.

Google Analytics sets the cookies "_ga" and "_ga_BRP9CBGBLD". They are used to distinguish visitors and sessions and are deleted after two years, unless you delete them earlier or withdraw your consent. User- and event-level data is automatically deleted in our Analytics property after 14 months at the latest. Aggregated statistical reports without personal reference may be kept longer.

The legal bases are Section 25(1) TDDDG and Art. 6(1)(a) GDPR. You can withdraw your consent at any time with effect for the future via "Cookie settings" in the footer of this website. The lawfulness of processing carried out before the withdrawal remains unaffected.

Google processes the data on our behalf. We have concluded the Google Ads Data Processing Terms with Google as a data processing agreement pursuant to Art. 28 GDPR.

Transfer to the USA: It cannot be ruled out that data is transferred to Google LLC in the USA. Google LLC is certified under the EU-US Data Privacy Framework; such transfers are covered by an adequacy decision of the European Commission of 10 July 2023 (Art. 45 GDPR). In addition, Google has included the European Commission's standard contractual clauses (Art. 46(2)(c) GDPR) in its data processing terms; you can obtain a copy from Google at https://business.safety.google/processorterms/. Please note that the adequacy decision is currently being challenged before the Court of Justice of the European Union and that US authorities may be able to access data without you having the same legal remedies as in the EU.

Further information:
https://policies.google.com/privacy?hl=en
https://policies.google.com/technologies/partner-sites?hl=en

6. Contact form

When you use our contact form, we process the information you enter: the topic of your enquiry, your name, your email address, your message and, optionally, your company and your phone number.

We use this data to process your enquiry, to answer any questions and, where applicable, to prepare a collaboration.

If your enquiry relates to the conclusion or performance of a contract, the legal basis is Art. 6(1)(b) GDPR. In all other cases, the legal basis is Art. 6(1)(f) GDPR; our legitimate interest lies in answering enquiries addressed to us. If you are acting on behalf of a company, our legitimate interest lies in communicating with that company.

We need the information marked as required in order to process your enquiry; without it, the form cannot be submitted. Alternatively, you can contact us by email or phone. By ticking the box regarding the privacy policy, you merely confirm that you have read this information.

Your message is delivered to us by email. Email delivery and our mailbox are provided by our hosting provider Mittwald (section 2) as a processor in Germany. No transfer to other service providers or to third countries takes place.

We delete your enquiry as soon as it has been fully processed and further storage is no longer necessary. If an enquiry leads to an order, we keep the necessary documents for as long as required by commercial and tax retention obligations (usually six to ten years, Art. 6(1)(c) GDPR). Longer storage is also possible where the data is needed to establish, exercise or defend legal claims.

7. Protection of the contact form against misuse

To protect against spam and misuse, our contact form checks every submission on our own server. We do not use third-party services (such as a CAPTCHA) for this purpose.

These checks include:

  • a control field that is invisible to visitors and is only filled in by automated programs,

  • the time at which the form was loaded and a technical signature of the form,

  • a security token linked to your session (cookie "kirby_session") that prevents forged submissions.

In your session, we also store the time of your last submission and the signatures of forms already sent, so that the same message cannot be submitted more than once. This information is deleted when the session expires.

To prevent mass submissions, we limit the number of messages per IP address. For this purpose, we do not store your IP address itself, but only a hash value generated with a secret key that changes daily. The hash value is deleted after 10 minutes, the key after one day.

The legal basis is Art. 6(1)(f) GDPR. Our legitimate interest lies in protecting our website and our communication against spam, automated attacks and misuse.

8. Contact by email or phone

If you contact us by email or phone, we process your contact details and the content of your enquiry in order to deal with your request. The legal bases, legitimate interest and storage period correspond to the information in the section "Contact form".

Please only send us particularly sensitive information after prior agreement on a suitable means of transmission.

9. Locally hosted fonts

Our website uses the fonts "Archivo" and "JetBrains Mono". They are delivered from our own server; no connection to external font providers such as Google Fonts is established. The connection data generated in this process is processed as described in the section "Hosting and technical provision".

10. Recipients and transfers to third countries

Within our company, only those persons who need personal data for their tasks have access to it.

External recipients are:

  • Mittwald CM Service GmbH & Co. KG (hosting, email) as a processor in Germany,

  • Google Ireland Limited and, where applicable, Google LLC (USA), exclusively after your consent to Google Analytics (section 5).

Beyond this, we only disclose data if we are legally obliged to do so or if there is another legal basis, for example to authorities or courts.

Data is only transferred to countries outside the European Union and the European Economic Area in connection with Google Analytics (section 5).

11. Storage period

We only store personal data for as long as is necessary for the respective purpose. You will find the specific periods in the individual sections.

Where statutory retention obligations exist, we store the data concerned for the prescribed period (Art. 6(1)(c) GDPR). In addition, data may be stored where it is necessary to establish, exercise or defend legal claims (Art. 6(1)(f) GDPR). The data is then deleted.

12. Your rights

Subject to the statutory requirements, you have the following rights:

  • access to your personal data (Art. 15 GDPR),

  • rectification of inaccurate and completion of incomplete data (Art. 16 GDPR),

  • erasure of your data (Art. 17 GDPR),

  • restriction of processing (Art. 18 GDPR),

  • data portability (Art. 20 GDPR),

  • objection to certain processing (Art. 21 GDPR),

  • withdrawal of consent with effect for the future (Art. 7(3) GDPR),

  • lodging a complaint with a data protection supervisory authority (Art. 77 GDPR).

To exercise your rights, simply send a message to info@blackforestweb.de.

Right to object

Where we process your personal data on the basis of Art. 6(1)(f) GDPR, you may object to this processing at any time on grounds relating to your particular situation. We will then no longer process the data concerned, unless we can demonstrate compelling legitimate grounds that override your interests, rights and freedoms, or the processing serves to establish, exercise or defend legal claims.

Where we process your data for direct marketing, you may object to this at any time without giving reasons. We will then no longer process the data for this purpose.

Withdrawal of consent

You can withdraw any consent you have given at any time with effect for the future. For optional website services, please use "Cookie settings" in the footer of the website. The lawfulness of processing carried out before the withdrawal remains unaffected.

Right to lodge a complaint

You can lodge a complaint with any data protection supervisory authority, in particular in the member state of your habitual residence, your place of work or the place of the alleged infringement. The authority responsible for us is:

Der Landesbeauftragte für den Datenschutz und die Informationsfreiheit Baden-Württemberg (State Commissioner for Data Protection and Freedom of Information of Baden-Württemberg)
Heilbronner Straße 35
70191 Stuttgart
Germany
https://www.baden-wuerttemberg.datenschutz.de/

13. No automated decision-making

No automated decision-making, including profiling, within the meaning of Art. 22 GDPR takes place.

14. Security of data transmission

Our website is delivered exclusively in encrypted form via HTTPS. We take appropriate technical and organisational measures to protect personal data. However, nobody can guarantee completely secure data transmission over the internet.

15. Changes to this privacy policy

We will adapt this privacy policy if the data processing on our website or the legal requirements change. The version published on this website applies.