Privacy policy

1. Controller

The controller responsible for data processing on this website within the meaning of the General Data Protection Regulation (GDPR) is:

Wien IT Solutions, owner: Nico Leon Wien
Hinter dem Anger 5, 42855 Remscheid, Germany
Email: nicoleon@wien-it.solutions
Phone: +49 175 7451381

2. The key points

• The website runs on a server that I rent from Hetzner in Germany and manage myself. Cloudflare sits in front of it as a protection and delivery service.
• Fonts, images and scripts are served from my own server. There is no embedded third-party content such as Google Fonts, maps or videos.
• Without your consent I do not set any analytics or advertising cookies. Google Analytics only loads once you agree in the cookie notice.
• Whatever you send via the contact form reaches me as an email and is not stored in a database of the website.

3. Hosting with Hetzner

This website runs on a dedicated server that I rent from Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany ("Hetzner"). The server is located in a data centre in Germany. Hetzner provides the hardware, power and network connection; I manage the operating system, the website and the data myself. A data processing agreement pursuant to Art. 28 GDPR is in place with Hetzner.

The legal basis is Art. 6(1)(f) GDPR. My legitimate interest lies in providing the website securely and reliably.

4. Cloudflare

To deliver the website quickly and securely, I use services of Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107, USA ("Cloudflare"). Cloudflare manages the DNS records of the domain and routes all requests to the website through its own network to my server (reverse proxy). In doing so, Cloudflare filters out attacks and malicious requests and may cache files such as images.

For this purpose Cloudflare processes the data your browser sends with every request, in particular your IP address, the requested address, date and time, browser and device information and security characteristics of the request. To detect automated access, Cloudflare may set technically necessary cookies, for example "__cf_bm" (valid for up to 30 minutes) and "cf_clearance" (remembers a passed security check, valid for up to one year).

The legal basis is Art. 6(1)(f) GDPR. My legitimate interest lies in delivering the website securely and quickly and in fending off attacks. Where Cloudflare stores information in your browser, this is strictly necessary for secure operation (Section 25(2) no. 2 TDDDG, German Telecommunications Digital Services Data Protection Act).

Cloudflare also processes data outside the EU, in particular in the USA (see section 11). Cloudflare's Data Processing Addendum applies. More in Cloudflare's privacy policy: cloudflare.com/privacypolicy.

5. Server log files

With every request, my server automatically stores information in so-called log files: IP address, date and time, requested page or file, status code, amount of data transferred, the previously visited page (referrer) as well as browser and operating system.

I need this to keep operations secure, find errors and detect attacks. The legal basis is Art. 6(1)(f) GDPR. The log files are deleted after 14 days at the latest, unless a security incident needs to be investigated for longer. I do not combine this data with other data and do not pass it on.

6. Encryption

The connection to this website is encrypted with TLS. You can recognise this by "https://" in your browser's address bar.

7. Contact form, WhatsApp, email and phone

If you write to me via the contact form, I process your name, your email address, the selected topic, your message and, if you provide it, your phone number. I need the required fields to be able to reply to you. The enquiry is sent as an email to my inbox and is not stored in a database of the website.

If you email me directly or call me, I process your contact details and the content of your message or the conversation for the same purpose. I do not record phone calls.

For first contact you can also message me on WhatsApp. The link on this website only opens WhatsApp when you click it; no data is sent to WhatsApp before that. If you message me there, WhatsApp Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland, processes your phone number, your profile name, the messages and metadata such as time and device information. WhatsApp's privacy policy applies to this processing: whatsapp.com/legal/privacy-policy-eea. This may involve a transfer to WhatsApp LLC and Meta Platforms, Inc. in the USA (section 11). I only use the messages to answer your enquiry and arrange an appointment. If you would rather not use WhatsApp, simply write to me via the contact form or by email.

My email inbox is operated with Google Workspace, a service of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Google processes the emails on my behalf (Art. 28 GDPR); this may involve a transfer to the USA (see section 11).

The legal basis is Art. 6(1)(b) GDPR if your enquiry relates to a contract, otherwise Art. 6(1)(f) GDPR (my legitimate interest in answering enquiries). I delete the data once your enquiry has been dealt with, unless statutory retention obligations under commercial and tax law require longer storage, for example if it leads to an order.

To fight spam I use a hidden field and a timing check, but no third-party services such as reCAPTCHA. To slow down mass submissions, the server derives a hash value from your IP address using a random key that only exists in memory. This value stays in memory for no more than 15 minutes and is never stored permanently.

8. Cookies and local storage (cookie policy)

Cookies and entries in your browser's local storage are small data records on your device. Without your consent, this website only uses entries that are strictly necessary for the functions you request (Section 25(2) no. 2 TDDDG). They stay on your device and are not transmitted to me:

• "wit-consent": your choice in the cookie notice with date and version, so that I don't ask again on every visit. After twelve months I ask again.
• "wit-theme": your colour theme (light or dark), if you changed it.
• "wit-locale-hint": that you closed the notice about the other language version.

You can delete these entries at any time in your browser settings. Google Analytics cookies are only set with your consent (section 10). Cloudflare may set technically necessary security cookies (section 4). The website's admin area, which only I use, sets a login cookie; this does not affect visitors.

9. Consent and withdrawal

On your first visit, a notice asks whether you agree to statistics with Google Analytics. "Reject" is just as easy as "Accept all". Without your consent, no Google code is loaded and no connection to Google is made.

You can change or withdraw your consent at any time with effect for the future via the "Cookie settings" link at the bottom of every page. When you withdraw, the analytics cookies in your browser are deleted. This does not affect the lawfulness of processing up to the withdrawal.

10. Google Analytics 4

If you have given your consent, I use Google Analytics 4, a web analytics service of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland ("Google"). This shows me which pages are read and how visitors find the site, so I can improve what I offer.

For this, Google Analytics sets the cookies "_ga" and "_ga_<ID>" (stored for up to two years) and processes pseudonymous usage data: pages viewed, time spent, where the visit came from, approximate location as well as device and browser information. Google Analytics 4 does not store your IP address; Google only uses it briefly to determine the approximate location.

Google Signals and data sharing for advertising purposes are disabled. I use Google's consent mode (Consent Mode v2); storage for advertising purposes always remains denied. The analytics data is deleted after two months. A data processing agreement is in place with Google.

The legal basis is your consent pursuant to Art. 6(1)(a) GDPR and Section 25(1) TDDDG. This may involve a transfer to Google LLC in the USA (section 11). More in Google's privacy policy: policies.google.com/privacy.

11. Transfers to the USA

Cloudflare, Google and, if you message me there, WhatsApp may process data in the USA. For the USA there is an adequacy decision of the European Commission, the EU-US Data Privacy Framework (Art. 45 GDPR). Cloudflare, Inc., Google LLC, WhatsApp LLC and Meta Platforms, Inc. are certified under it. In addition, the data processing agreements of Cloudflare and Google contain the EU standard contractual clauses (Art. 46(2)(c) GDPR).

12. Links to other websites

This website links to other services, for example WhatsApp, my Google profile, my Fiverr profile and websites from my projects. Merely visiting my website does not transfer any data to these providers. Only when you click a link do the privacy policies of the respective provider apply.

13. Storage period

Unless a specific period is stated above, I delete personal data as soon as the purpose of processing no longer applies and no statutory retention obligations prevent this.

14. Your rights

You have the right of access (Art. 15 GDPR), rectification (Art. 16 GDPR), erasure (Art. 17 GDPR), restriction of processing (Art. 18 GDPR) and data portability (Art. 20 GDPR). A short email to nicoleon@wien-it.solutions is enough.

15. Right to object

Where I process data on the basis of Art. 6(1)(f) GDPR, you can object at any time on grounds relating to your particular situation (Art. 21 GDPR). I will then no longer process the data unless I can demonstrate compelling legitimate grounds that override your interests, or the processing serves the establishment, exercise or defence of legal claims.

16. Right to lodge a complaint

You can lodge a complaint with a data protection supervisory authority (Art. 77 GDPR). The authority responsible for me is the State Commissioner for Data Protection and Freedom of Information of North Rhine-Westphalia (Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen), Kavalleriestraße 2–4, 40213 Düsseldorf, Germany, ldi.nrw.de.

17. Provision of data and automated decisions

You are not obliged to provide me with any data. Without the required fields in the contact form, however, I cannot reply to you. There is no automated decision-making or profiling within the meaning of Art. 22 GDPR.

18. Changes

This privacy policy was last updated in October 2026. If the website or the legal situation changes, I will update it. The version published here applies.