Privacy Policy

This is a courtesy translation. Only the German version is legally binding.

The Most Important Points First

This website is small and gets by with little. There is no shop, no newsletter, no contact form, and no advertising. Still, visiting a website inevitably generates data, and I analyze part of it to see which content is being read.

What that means in concrete terms:

• When you simply open the site, my host processes technical connection data, including your IP address. No website works without that.
• An audience measurement runs alongside, without cookies and without recognizing you again.
• Google Analytics only runs if you consent in the cookie dialog. If you say no, nothing is sent to Google.
• If you write to me or book an appointment, I process what you tell me in the process.

The details are below. If you want to know something that isn’t covered here, just write to me.

Who Is Responsible

The controller for data processing on this website within the meaning of the GDPR (DSGVO, the EU General Data Protection Regulation) is me:

Jan Hoppe
Schäferkampsallee 50
20357 Hamburg
Email: jan@produktkraft.com

The controller is whoever decides on the purposes and means of a data processing operation. For everything that happens on produktkraft.com, that is me. As a sole proprietor, I am not required to appoint a data protection officer – so your concerns come directly to me.

What Happens When You Open the Site

Hosting via Cloudflare Pages

The website is hosted on Cloudflare Pages. The provider is Cloudflare Inc., 101 Townsend St., San Francisco, CA 94107, USA; represented in Germany by Cloudflare Germany GmbH, Rosental 7, c/o Mindspace, 80331 München.

Cloudflare delivers the pages via a worldwide server network. Your request therefore passes through a Cloudflare server, which in the process processes, among other things, your IP address, information about your browser and operating system, and the address requested. This is not an additional feature, but the prerequisite for the site reaching you – and at the same time it protects the site against overload attacks.

The legal basis is my legitimate interest under Art. 6(1)(f) GDPR in a website that is reachable, fast, and secure. A data processing agreement under Art. 28 GDPR is in place with Cloudflare: Cloudflare may only process the data for the purpose I specify.

For the transfer to the USA, see the section “Data Transfer to the USA” further below.

Server Logs

Every page request leaves a technical entry in the server’s log. The following is recorded:

• Browser type and version

• Operating system

• The previously visited page (referrer)

• Time of the request

• IP address

I use these entries exclusively to detect technical faults and to fend off attacks. I do not combine them with any other data source and do not use them to create any analysis of individual persons. The legal basis is Art. 6(1)(f) GDPR; my legitimate interest lies in functioning and secure operation.

Fonts

The fonts of this website are stored on my own web space and are loaded from there. Your browser does not establish a connection to Google Fonts or any other third-party server for this. So no data flows out just so that text appears in the right font.

Cookies and Your Consent

Cookies are small pieces of text that a website stores in your browser. Some disappear as soon as you close the window; others remain until you delete them or they expire. They do no harm to your device.

I distinguish between two cases, and the difference matters:

Necessary cookies I set without asking. This essentially concerns storing your own cookie decision – without it, I would have to ask you again every time you change pages. The legal basis is Art. 6(1)(f) GDPR in conjunction with § 25(2) TDDDG (German Telecommunications Digital Services Data Protection Act).

All other cookies – in practice, those of Google Analytics – I only set once you have consented in the cookie dialog. The legal basis is then your consent under Art. 6(1)(a) GDPR and § 25(1) TDDDG.

Your decision is not final. You can change it at any time via the cookie dialog; this does not affect the processing carried out until the withdrawal. Independently of this, you can specify in your browser settings whether cookies are accepted at all, and which ones, and whether they disappear automatically when you close the browser. If you block everything, parts of the site may no longer work as intended.

Audience Measurement and Statistics

Cloudflare Web Analytics

This measurement runs as soon as you open the site. The provider is Cloudflare Inc., address as above.

It works without cookies and does without fingerprinting: nothing is stored on your device and nothing is read from it. What is counted are page views, the referring address, the approximate country of origin, rough device and browser information, and load times – all aggregated, without a profile and without tracking across other websites.

The legal basis is Art. 6(1)(f) GDPR. My legitimate interest: I want to know which episodes and articles are being read so that I keep writing about the right things. Because there is no access to your device, no consent under § 25(1) TDDDG is required for this.

More details in Cloudflare’s privacy policy: https://www.cloudflare.com/de-de/privacypolicy/

Google Analytics

Google Analytics only starts after your consent in the cookie dialog. If you decline or ignore the dialog, no Google cookie is set and not a single data packet goes to Google. Consequently, the sole legal basis is your consent under Art. 6(1)(a) GDPR and § 25(1) TDDDG, which can be withdrawn at any time with effect for the future.

The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Irland. Google acts as my processor; a contract under Art. 28 GDPR is in place.

If you have consented, Google learns, among other things, during your visit:

• which pages you open

• whether you perform an action relevant to me, such as getting in touch

• how you move around the pages – time spent, clicks, scroll depth

• your approximate location at the level of country and city

• your IP address

• technical key data such as browser, internet provider, device, and screen resolution

• where you came from, i.e., via which page or which link

• a randomly generated identifier

Google does not receive your name, your address, or your contact details from me.

The random identifier is stored as a cookie in your browser for two years from your last visit and makes it possible to recognize you on a later visit. The analyses attached to it are pseudonymous and are automatically deleted after 14 months. What remains after that are pure totals without any reference to individual visits.

In addition to withdrawing consent in the cookie dialog, you can also permanently disable tracking in your browser with Google’s opt-out browser add-on: https://tools.google.com/dlpage/gaoptout

How Google handles user data is described here: https://policies.google.com/privacy?hl=de

When You Get in Touch

By Email or Phone

If you write or call, I process what you tell me in the process – your name and the content of your request – in order to reply to you. I do not pass any of it on to third parties.

The legal basis is Art. 6(1)(b) GDPR if it concerns a possible or existing collaboration. In all other cases, I rely on Art. 6(1)(f) GDPR, because anyone who is written to has a legitimate interest in being able to reply.

Your request stays with me until it has been dealt with and I no longer need it – or until you ask me to delete it. Statutory retention obligations, for example under tax law, take precedence.

Appointment Booking via Cal.com

Intro call appointments are handled via Cal.com. The provider is Cal.com, Inc., 2261 Market Street #4382, San Francisco, CA 94114, USA. Felix Kolodrej has been designated as the representative in the EU under Art. 27 GDPR and can be reached at felix@cal.com.

The booking calendar is not embedded in this website. As long as you do not click the appointment link, Cal.com learns nothing about your visit. Only with the click do you leave my site and land at Cal.com – from that point on, their privacy policy applies. Cal.com then processes, among other things, your IP address and what you enter into the booking form: name, email address, and, where applicable, a short message.

This information reaches me as an entry in my calendar. I use it to prepare for and attend the appointment. The legal basis for this is Art. 6(1)(b) GDPR, because the booking is a pre-contractual step.

What Cal.com processes in detail is described in its privacy policy: https://cal.com/privacy

Data Transfer to the USA

Cloudflare, Google, and Cal.com are US companies. Part of the data described above is therefore processed in the USA. There is no level of data protection there that, by itself, corresponds to the European one – you should know that before you consent.

The transfer is safeguarded in two ways. Cloudflare and Google are certified under the EU-US Data Privacy Framework, under which US companies commit to the US Department of Commerce to comply with European data protection standards. You can find Cloudflare’s entry at https://www.dataprivacyframework.gov/participant/5666. In addition, the standard contractual clauses of the EU Commission under Art. 46(2) and (3) GDPR apply, and for Cal.com they are the sole basis: model texts that contractually extend the European level of protection to the USA. The underlying decision including the clauses: https://eur-lex.europa.eu/eli/dec_impl/2021/914/oj?locale=de

Who Else Gets to See Your Data

Beyond the service providers named on this page, I only pass on personal data if a contract requires it, if the law obliges me to – for example, toward the tax office – or if you have consented. If I work with service providers who process data on my behalf, this only happens on the basis of a contract under Art. 28 GDPR.

How Long Data Is Stored

Where a specific period is stated above, that period applies. Otherwise, I delete data as soon as the purpose for which I collected it has been fulfilled. If you withdraw consent or rightfully request deletion, this happens without delay – unless I have to retain the data due to statutory retention periods. In that case, it is blocked and deleted after the period expires.

Your Rights

You have all the rights under the GDPR with respect to me. To exercise them, an informal message to jan@produktkraft.com is sufficient; it is free of charge for you.

• Access (Art. 15 GDPR): You can find out whether and which data I process about you, where it comes from, who receives it, and what I use it for.

• Rectification (Art. 16 GDPR): What is incorrect, I have to correct; what is incomplete, I have to complete.

• Erasure (Art. 17 GDPR): You can request the erasure of your data insofar as I do not have to retain it for legal reasons.

• Restriction of processing (Art. 18 GDPR): Instead of deleting data, I can also merely store it without using it any further. This may be considered, for example, while it is being checked whether the data is correct, or while an objection has not yet been decided. I then only process restricted data with your consent or to assert and defend legal claims.

• Data portability (Art. 20 GDPR): Data that I process automatically on the basis of your consent or a contract you receive on request in a common, machine-readable format – or I transmit it directly to another body, insofar as this is technically feasible.

• Withdrawal of consent (Art. 7(3) GDPR): You can withdraw any consent at any time with effect for the future. What was lawfully processed until then remains lawful.

• Complaint (Art. 77 GDPR): You can lodge a complaint with a data protection supervisory authority, either where you live or work or where the suspected infringement took place. The authority responsible for me is the Hamburg Commissioner for Data Protection and Freedom of Information (Hamburgische Beauftragte für Datenschutz und Informationsfreiheit). Other legal remedies remain open to you in addition.

Your Right to Object

If I process data on the basis of a legitimate interest under Art. 6(1)(f) GDPR, you can object to this processing. On this website, this concerns the server logs, hosting via Cloudflare, and the cookie-free audience measurement.

The objection must arise from your particular situation and also applies to profiling based on it. If you object, I will no longer process the data concerned – unless I can demonstrate compelling legitimate grounds that override your interests, rights, and freedoms, or the processing serves to assert, exercise, or defend legal claims (Art. 21(1) GDPR).

If I were to process your data for direct marketing, you could object to this at any time – without giving reasons and with immediate effect, including for any related profiling (Art. 21(2) GDPR). For the sake of completeness: I do not engage in direct marketing via this website.

An email to jan@produktkraft.com is sufficient for an objection.

Technical Notes

Encrypted Transmission

This website is delivered exclusively in encrypted form (SSL/TLS). You can recognize this by the “https://” in the address bar and the lock icon in your browser. What you send me over the encrypted connection cannot be read by third parties along the way.

Limits of Security

For all the encryption: a transmission over the internet – especially by email – can never be completely secured against third-party access. Email is not a suitable channel for truly confidential content. Talk to me, and we’ll find a better one.

Status of this privacy policy: August 2026.