Privacy policy

The controller responsible for processing personal data on this website is:

The website is hosted by STRATO. Access involves processing connection data needed for technical operation. This may include your IP address, time, requested URL, HTTP status, data volume, browser and operating system details, and referring page. IP addresses can be personal data.

This processing serves website delivery, stability and security, as well as detecting errors and abuse. The legal basis is Article 6(1)(f) GDPR. My legitimate interest is the secure and reliable operation of this website. The hosting provider processes the data needed for operation.

Technical data is retained only as long as necessary for operation, troubleshooting and security. In a specific security incident, relevant data may be retained until the matter is resolved and, where necessary, to assert or defend legal claims.

Fonts, icons and website files are served locally. Google Fonts is not contacted.

After you choose, your privacy preferences are stored in this browser’s Local Storage under mm:personal:privacy:v1 for up to 180 days. The record contains categories, policy and service versions, the timestamp and expiry. This website does not send the complete preference record to its own server. When Google Analytics is configured, Google receives consent-state signals, including a denied state, as part of Advanced Consent Mode. You are asked again when the choice expires or services change.

The necessary storage access remembers and respects your explicitly requested privacy choice (section 25(2)(2) TDDDG). Where personal data is processed to meet data protection obligations, Article 6(1)(c) GDPR applies.

The first-party cookie mm_personal_locale remembers your selected or detected language for up to one year. It contains only a language code, supports delivery of the requested language and is not used for analytics or advertising. You can change it through the language menu or delete it in your browser.

You can change your choice and withdraw analytics consent at any time through “Cookie settings” in the footer or the button at the lower left edge of the screen. If browser storage is blocked, the choice applies only in the current tab until reloading.

When enabled with a valid configuration, this website loads Google Analytics 4 in Advanced Consent Mode on personal-site pages. The Google tag loads before you choose. Analytics storage, advertising storage, advertising user data and advertising personalization default to denied. Without acceptance, and after rejection, Google receives cookieless page-view and consent measurements.

These requests still transmit technical connection data, such as your IP address and browser details, to Google. Cookieless does not mean anonymous or that no personal data is processed. Analytics cookies and cookie-based identifiers are enabled only after your explicit acceptance.

If the service is available and you agree, page views, technical device and browser details, and a cookie identifier are processed to evaluate and improve website use. The legal bases are Article 6(1)(a) GDPR and section 25(1) TDDDG.

The provider for users in the European Economic Area is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Google LLC in the USA may also process data. Google LLC is certified under the EU–US Data Privacy Framework; an adequacy decision applies within its scope. Further details: Google’s privacy policy and Google’s data processing terms.

The website uses cookies prefixed mm_personal_ga, with intended retention of up to 180 days. Advertising personalization and Google Signals are disabled in the website configuration. Query parameters, URL fragments and form entries are not included in page views explicitly sent by this website.

You can withdraw your permission for analytics cookies at any time through Cookie settings. Withdrawal sets analytics storage to denied, removes this site’s analytics cookies and reloads the page to discard in-memory identifiers. Cookieless measurements continue in Advanced Consent Mode. Data already sent to Google is not automatically deleted retrospectively. You may exercise your privacy rights using the contact details below.

When you contact me, I process your contact details and inquiry to reply. For contract-related inquiries, Article 6(1)(b) GDPR applies. For other inquiries, the legal basis is Article 6(1)(f) GDPR; my legitimate interest is handling communications.

Inquiries are deleted when fully addressed and no further retention is necessary. Statutory retention duties and necessary retention to assert or defend claims remain unaffected.

The contact form on the personal portfolio is currently inactive; please use email or telephone instead. The separate website-service enquiry form is active and is described in the website-service section below.

External websites, such as LinkedIn or linked project sites, are opened only when you follow the relevant link. Their providers’ privacy notices apply to processing on those sites.

Subject to legal conditions, you have rights of access, rectification, erasure, restriction of processing and data portability (Articles 15–20 GDPR). You may withdraw consent at any time with future effect.

To exercise your rights, contact moritz@mergenthaler.cloud.

For processing under Article 6(1)(f) GDPR, you may object under Article 21 GDPR on grounds relating to your particular situation. Please use the contact address above.

You may complain to a data protection supervisory authority, particularly in the member state of your habitual residence, workplace or the alleged infringement (Article 77 GDPR).

The website service processes company and contact details, enquiries, authorised recipient email addresses, feedback, commissions and billing details to handle requests and perform agreed services. Contact: info@mergenthaler.cloud. Viewing a preview does not place an order.

Access to private previews requires an invitation and authentication for the assigned recipient. One-time email codes expire after ten minutes and can be used once; a recipient-specific password is an explicitly enabled exception. Access sessions last up to two hours and can be revoked. The required mm_websites_session cookie is restricted to the module API path; the chosen language is stored in mm_personal_locale for up to one year.

Administrator sign-in uses Microsoft Entra ID; configured email delivery uses Microsoft Graph. Only the authorised administrator may manage records, send invitations, export websites and record payments. Protected previews and administration do not use the portfolio analytics integration. Customer files are held in private storage.

Data is processed to take steps at your request before a contract and to fulfil contracts (Article 6(1)(b) GDPR), to comply with accounting and retention obligations (Article 6(1)(c)), and to secure access and prevent misuse (Article 6(1)(f)). Data is retained only as needed for these purposes and applicable legal retention obligations. The rights and contact information in this privacy notice also apply to this service.

For individually prepared website offers, sales emails can include an image used to record image-load signals and links assigned to the particular message. Image loads do not reliably establish whether a person read an email. We distinguish image-load and link-request signals, authenticated preview access, replies and commissions. A link click can set an authenticated-encrypted attribution cookie named mm_sales_attribution, restricted to the preview API path, for up to 90 days. Telemetry does not store IP addresses or complete browser identifiers. Individual event records are deleted after 90 days by scheduled cleanup; message-level totals and the correspondence history remain associated with the offer. The configured sender mailbox is checked for reply metadata, without copying message bodies into the platform. Every sales email is sent manually after review. A confirmation link in each message lets you stop further reminders about that offer.