Privacy Policy

1. Overview and principles

Protecting your personal data matters to us. This website is deliberately data-minimal and does not use advertising networks. In addition to our own cookie-free audience measurement, we use Google Analytics 4 through Google Tag Manager only with your consent and with advertising personalisation disabled. We process personal data only where necessary to provide the website, perform consented analytics and handle your inquiries.

In accordance with the General Data Protection Regulation (GDPR), this policy informs you about which data we process, for which purposes, on which legal basis, and which rights you have.

2. Controller

The controller within the meaning of the GDPR is: Kostiantyn Mykhailov, SaaleWeb, Hettstedter Str. 64, 06124 Halle (Saale), Germany.

Phone: +49 176 71764743 · Email: mykhailov@saaleweb.de

No data protection officer has been appointed, as the legal requirements for a mandatory appointment are not met.

3. Hosting and server log files

This website is hosted by Hostinger (Hostinger operations, UAB, Švitrigailos g. 34, 03230 Vilnius, Lithuania) within the European Union. A data processing agreement pursuant to Art. 28 GDPR is in place with the provider.

When you access the website, the server automatically processes technical access data (server log files): IP address, date and time of the request, page accessed, amount of data transferred, browser type and version, operating system and the previously visited page (referrer URL).

This data serves the technical provision, stability and security of the website (e.g. defence against attacks) and is automatically deleted after a short period. The legal basis is our legitimate interest in secure and stable operation (Art. 6(1)(f) GDPR).

4. Database

Website content and inquiries submitted via the contact form are stored in a database operated by Neon (Neon, Inc.). The database runs in the Frankfurt am Main region (Germany, EU); the data therefore remains within the European Union. A data processing agreement pursuant to Art. 28 GDPR, including EU standard contractual clauses, is in place with the provider.

5. Contact form and inquiries

If you send us an inquiry via the contact form or by email, we process the data you provide: name, email address, optionally phone number and company, and your message.

Processing takes place to handle your inquiry and for possible follow-up questions. The legal basis is Art. 6(1)(b) GDPR (pre-contractual measures or contract performance) and, in addition, our legitimate interest in answering inquiries (Art. 6(1)(f) GDPR).

To protect our public inquiry forms from automated spam and misuse, we use Cloudflare Turnstile (Cloudflare, Inc., 101 Townsend St, San Francisco, CA 94107, USA). Technical connection, browser, device and interaction data, including the IP address, is transmitted to Cloudflare to distinguish human submissions from automated access. The resulting verification token is validated once on the server; we do not store the IP address transmitted for this check together with your inquiry. Processing is necessary to provide the forms securely and is based on our legitimate interest in preventing misuse under Art. 6(1)(f) GDPR. Cloudflare's data protection and transfer mechanisms apply to possible transfers to the United States. More information: https://www.cloudflare.com/privacypolicy/.

If you use the AI assistant, we store the conversation history together with technical context data (IP address, technical visitor identifier, user agent, language version, page accessed and – where transmitted by the hosting or proxy provider – country, region or city). This is used to answer your request, review quality, detect misuse and block spam IP addresses. The legal basis is Art. 6(1)(f) GDPR; where this results in a concrete inquiry, Art. 6(1)(b) GDPR also applies.

Your details are deleted as soon as they are no longer required for processing and no statutory retention obligations (e.g. under commercial or tax law) prevent deletion.

6. Email notifications and SMTP delivery

We use the business email mailbox mykhailov@saaleweb.de and Hostinger's SMTP server to send internal notification emails about new inquiries and newsletter confirmation emails. The data required for the respective email (for example email address, name, message, language and technical delivery data) may be processed by Hostinger.

Hostinger processes this data as a technical email and hosting provider under its privacy and data processing terms. The legal basis is Art. 6(1)(b) GDPR for handling inquiries, Art. 6(1)(f) GDPR for reliable technical delivery and, for newsletter confirmations, your consent pursuant to Art. 6(1)(a) GDPR.

7. Newsletter (double opt-in)

You can subscribe to our newsletter with practical tips on websites, local SEO and AI visibility. For this purpose we process your email address and the selected language version.

Subscription uses the double opt-in procedure: after signing up, you receive an email with a confirmation link. The subscription only becomes effective with this confirmation; unconfirmed sign-ups do not receive the newsletter. Confirmation and newsletter emails are sent via the business SMTP mailbox described in section 6.

The legal basis for the processing is your consent (Art. 6(1)(a) GDPR). You can withdraw your consent at any time with effect for the future – via the unsubscribe link in every newsletter email or informally by emailing us. Upon unsubscribing, your email address is deleted from the list.

8. Cookie-free reach measurement (first-party statistics)

We collect anonymous usage statistics with our own privacy-friendly solution – without third parties, without cookies and without storing or reading information on your device. No access within the meaning of Section 25 TDDDG takes place; consent is therefore not required.

The following is recorded: page accessed, language version, referrer (referring page) and a technical visitor value. This value is generated server-side as a one-way hash (SHA-256) from the current date, the IP address, the browser user agent and a secret random value (salt). The IP address itself is not stored; the hash changes daily and does not allow identification of a person or cross-site tracking. Requests from known bots are discarded.

The purpose is the statistical evaluation of the use of our website (e.g. which pages are accessed how often). The legal basis is our legitimate interest in analysing and improving our services (Art. 6(1)(f) GDPR).

9. Google services: Tag Manager, Analytics 4 and Maps reviews

Google Tag Manager is integrated on the public pages. For users in the European Economic Area, the provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Tag Manager controls the technical delivery of analytics tags and may transmit technical connection data, particularly IP address, browser and device information, time and the URL accessed, to Google.

Google Analytics 4 is controlled through Tag Manager in advanced consent mode. Before you make a choice, analytics_storage, ad_storage, ad_user_data and ad_personalization are set to “denied” by default; Google may receive technically restricted cookieless signals in this state. Cookie-based measurement is activated only after your voluntary consent. We then measure page views, approximate location, device type, referrer and interactions such as successful form submissions, contact and messenger clicks, scroll depth and opening the AI assistant. Advertising storage and personalised advertising remain disabled.

The legal basis is your consent under Art. 6(1)(a) GDPR and Section 25(1) TDDDG. You can change your decision at any time for the future using the “Privacy settings” button. The choice itself is stored in local storage. Google may also process data on servers outside the EU; Google's applicable data protection terms and transfer mechanisms apply. More information is available at https://policies.google.com/privacy.

In the client testimonials section, we currently show two review texts and the 5.0-star rating that we checked directly in the public Google Business Profile in July 2026. The German originals are editorially translated for the English and Russian versions and are explicitly labelled as translations. Until automatic retrieval is enabled, loading this section does not establish a connection to Google. Once enabled, the current review selection may additionally be requested server-side through the Google Places API; the browser still does not establish a direct Google connection for review text or author images, and API content is stored neither in our database nor in an application cache. Only when you open a Google Maps, author, reporting or write-review link do you leave our website and connect to Google yourself. The purpose and legal basis are the transparent presentation of publicly available client experiences and our legitimate interest in building trust (Art. 6(1)(f) GDPR). The Google Maps Platform Terms at https://cloud.google.com/maps-platform/terms and Google's privacy policy at https://policies.google.com/privacy also apply.

10. Cookies and local storage

Google Analytics cookies or comparable identifiers may only be set or read after your explicit consent. Analytics storage remains disabled without consent.

Technically necessary storage may be used for language selection, authorised administrator login and remembering your privacy choice. It is required for the requested function (Section 25(2) no. 2 TDDDG); the legal basis for the associated processing is Art. 6(1)(f) GDPR.

The AI assistant may additionally store a randomly generated technical visitor identifier in your browser's local storage so that follow-up questions can be assigned to the same conversation. The identifier does not contain message texts or contact details.

11. SSL/TLS encryption

For security reasons and to protect the transmission of confidential content, such as inquiries via the contact form, this website uses SSL/TLS encryption. You can recognise an encrypted connection by the prefix “https://” and the lock symbol in your browser's address bar.

12. Your rights

You have the following rights regarding your personal data:

• Right of access to the processed data (Art. 15 GDPR)
• Right to rectification of inaccurate data (Art. 16 GDPR)
• Right to erasure (Art. 17 GDPR)
• Right to restriction of processing (Art. 18 GDPR)
• Right to data portability (Art. 20 GDPR)
• Right to object to processing based on Art. 6(1)(f) GDPR (Art. 21 GDPR)
• Right to withdraw consent with effect for the future (Art. 7(3) GDPR)

To exercise your rights, an informal message to mykhailov@saaleweb.de is sufficient.

You also have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR). The authority responsible for us is the State Commissioner for Data Protection of Saxony-Anhalt (Landesbeauftragter für den Datenschutz Sachsen-Anhalt), Otto-von-Guericke-Str. 34a, 39104 Magdeburg, Germany.

13. Storage period, obligation to provide data, automated decisions

Unless a more specific storage period is stated in this policy, personal data remains with us until the purpose of processing ceases to apply or you exercise a right to erasure or objection – subject to statutory retention periods (in particular under commercial and tax law).

The provision of personal data is neither legally nor contractually required; however, we cannot answer inquiries without contact details. Automated decision-making, including profiling within the meaning of Art. 22 GDPR, does not take place.

14. Validity and changes to this privacy policy

We reserve the right to adapt this privacy policy if the legal situation, the website or the services used change. The version published on this page at the respective time applies.