Privacy policy

The controller within the meaning of Art. 4(7) GDPR is:

Matthias Wöhlte

W. Consulting & Travel

Routa 103

Potrerillos

Panama

Phone: 015678140509

Email: matthias.woehlte@gmail.com

No data protection officer has been appointed; there is no obligation to appoint one under § 38 BDSG.

Personal data are any information relating to an identified or identifiable natural person. This website is designed to process as little personal data as possible.

The website can be used without providing personal data. Data are collected only when you actively submit them — in particular via the contact form — or when they are technically necessary to deliver the site.

No automated decision-making, including profiling, within the meaning of Art. 22 GDPR takes place.

This website is hosted by Vercel Inc., 340 S Lemon Ave #4133, Walnut, CA 91789, USA. Vercel provides the server infrastructure and processes personal data exclusively on our behalf and on our instructions.

A data processing agreement pursuant to Art. 28 GDPR is in place with Vercel.

The legal basis for using a hosting provider is our legitimate interest in the secure, performant and reliable operation of this website, Art. 6(1)(f) GDPR.

As far as technically possible, processing takes place in a data centre within the EU (Frankfurt region).

Each time this website is accessed, the hosting provider automatically records information transmitted by your browser. This usually includes:

• the IP address of the requesting device,
• the date and time of the request,
• the specific page or file requested,
• the HTTP status code and the volume of data transferred,
• the previously visited page (referrer), where transmitted,
• browser type, browser version and operating system.

These data are technically necessary in order to deliver the website, to ensure its stability and security, and to detect and defend against attacks. The legal basis is Art. 6(1)(f) GDPR; our legitimate interest lies in the technical operation described.

These data are not merged with other data sources and are not evaluated for marketing purposes. Individual visitors are not identified.

The retention period for log data follows our hosting provider's specifications; the data are not kept longer than is necessary for technical operation.

We use service providers whose servers are partly located in the USA. Depending on the provider, the transfer of personal data to the USA rests on different safeguards:

Vercel Inc.

• Basis: adequacy decision of the European Commission (Art. 45(3) GDPR).
• Safeguard: Vercel Inc. is certified under the EU-U.S. Data Privacy Framework (DPF). A level of data protection equivalent to the EU standard is therefore legally recognised.

Formspree Inc.

• Basis: appropriate safeguards (Art. 46(2)(c) GDPR).
• Safeguard: Formspree Inc. is not certified under the Data Privacy Framework. The transfer is instead covered by the Standard Contractual Clauses approved by the European Commission. A data processing agreement has also been concluded in order to guarantee an adequate level of protection.

You can send us a message via the contact form. The following details are processed: name, email address, the selected subject and your message; providing an organisation is optional.

We use these data solely to handle and answer your enquiry, and for follow-up questions arising from it.

The legal basis is your consent under Art. 6(1)(a) GDPR, which you give explicitly when submitting the form. Where your enquiry aims at concluding or performing a contract, Art. 6(1)(b) GDPR is an additional legal basis.

You may withdraw your consent at any time with effect for the future, for example by an informal message to the email address given above. The lawfulness of processing carried out until withdrawal remains unaffected.

Your details remain with us until you ask us to delete them, withdraw your consent, or the purpose of storage ceases to apply — for example once your enquiry has been dealt with. Mandatory statutory retention periods, in particular under commercial and tax law, remain unaffected.

We use the Formspree service, provided by Formspree, Inc., USA, to handle form delivery technically. Your input is transmitted to Formspree exclusively server-side: no script and no embedded frame belonging to the provider is loaded in your browser, and no direct connection is established between your device and Formspree.

Formspree processes the data on our instructions as a processor under Art. 28 GDPR. On the transfer to the USA, see section 5.

The form contains an additional field, invisible to you, that detects automated submissions. It processes no personal data and sets no cookies.

This website sets no cookies. There is no reach measurement, no web analytics and no tracking. Consent under § 25 TDDDG is therefore not required; a cookie banner is deliberately absent.

Fonts are not loaded from external servers but shipped with the site when it is built and served by our host. No connection is made from your browser to Google Fonts or any comparable service.

No third-party content is embedded — no videos, maps, social networks or external forms.

Your data are disclosed to third parties only to the extent described in this policy, namely to the hosting provider and to the provider of the form service, each acting as a processor.

Beyond that we disclose data where we are legally obliged to do so or where an official or judicial order exists. Data are neither sold nor rented out.

This website is delivered exclusively over an encrypted connection (TLS); you can recognise this by the padlock symbol and the prefix “https://” in your browser's address bar. The data you transmit are thus protected against interception by third parties in transit.

In respect of the personal data concerning you, you have the following rights:

• access to the data processed (Art. 15 GDPR),
• rectification of inaccurate data (Art. 16 GDPR),
• erasure (Art. 17 GDPR),
• restriction of processing (Art. 18 GDPR),
• data portability (Art. 20 GDPR),
• withdrawal of consent given, with effect for the future (Art. 7(3) GDPR).

Right to object: where we process data on the basis of a legitimate interest under Art. 6(1)(f) GDPR, you may object at any time on grounds relating to your particular situation (Art. 21 GDPR).

An informal message to the address given under section 1 is sufficient to exercise these rights.

The controller is established outside the European Union. Irrespective of this, data subjects may lodge a complaint with the data protection supervisory authority of their habitual residence, their place of work or the place of the alleged infringement (Art. 77 GDPR).

Status of this privacy policy: September 2026.

We adapt this policy whenever the technical implementation of the website, the services used, or the legal framework change. The version available here applies to each new visit.