Privacy policy

This English version is provided for your convenience. The legally binding version is the German Datenschutzerklärung.

Protecting your data matters to me. This privacy policy explains which personal data I process when you visit this website, contact me or work with me, and which rights you have.

In short: this website embeds no third-party content, so no external fonts, videos, maps or social media plugins. The only exception is the Calendly booking calendar on the booking page, and it only loads with your consent (in the cookie banner or by a click). Analytics and marketing tools only run if you agree in the banner (see “Consent, cookies and tracking”). Without consent, I only count anonymously which pages are viewed, entirely without cookies (see “Audience measurement without cookies”). Otherwise, personal data is only processed when the site is technically delivered (server log files), when you contact me or when we work together.

The controller responsible for data processing within the meaning of the General Data Protection Regulation (GDPR) is:

Martin Reza Tschapke
Brandvorwerkstraße 56
04275 Leipzig, Germany
Phone: +49 176 24 24 20 80
Email: martin@tschapke.com

No data protection officer has been appointed, as there is no legal obligation to do so.

I only process personal data where a legal basis permits it. The relevant legal bases are in particular:

• Art. 6(1)(a) GDPR: your consent,
• Art. 6(1)(b) GDPR: the performance of a contract or pre-contractual measures, such as answering a project inquiry,
• Art. 6(1)(c) GDPR: compliance with legal obligations, such as retention obligations under tax and commercial law,
• Art. 6(1)(f) GDPR: legitimate interests, such as the secure and stable operation of this website.

The legal basis that applies in each case is stated with the respective processing activity.

This website is hosted by Vercel Inc., 440 N Barranca Ave #4133, Covina, CA 91723, USA, and delivered via its global server network (content delivery network). Requests from Europe are usually answered by servers in the EU.

When you visit the website, Vercel automatically processes technical access data transmitted by your browser in so-called server log files: IP address, date and time of access, page or file requested, amount of data transferred, HTTP status code, the previously visited page (referrer), browser type and version, and operating system.

This data is technically necessary to deliver the website and to ensure its stability and security, for example to fend off attacks. It is not combined with other data sources and not used for user profiles. The legal basis is Art. 6(1)(f) GDPR; my legitimate interest lies in providing the website securely, reliably and quickly. The log data is only stored for as long as necessary for these purposes and is then deleted.

Vercel processes the data on my behalf on the basis of its data processing terms (Data Processing Addendum, Art. 28 GDPR). For transfers to the USA, see “Transfers to third countries”.

For security reasons, this website uses TLS encryption (HTTPS). You can recognize an encrypted connection by “https://” in the address bar and the lock icon in your browser. Data transferred between your browser and this website therefore cannot be read by third parties.

So that I can see which pages are read and how visitors arrive, for example via a LinkedIn post, this website counts page views in its own data-minimizing way. With each page view, your browser sends to a server function at Vercel Inc.: the page viewed, the domain of the page you came from (for example linkedin.com, without the exact path) and, if present, the campaign identifier in the link (parameters “utm_source”, “utm_medium”, “utm_campaign”, “utm_content”). This is stored with date and time in my CRM (database of Supabase Inc., data center in London, United Kingdom).

No cookies are set and no information is stored on or read from your device. I store neither your IP address nor any device or user identifier, cannot attribute page views to any person and cannot combine them into profiles. If you arrive via a link with a campaign identifier, this identifier is carried along in the address when you click on to other pages of this website, again without storing anything on your device. If you have enabled “Do Not Track” or “Global Privacy Control” in your browser, nothing is counted.

The legal basis is Art. 6(1)(f) GDPR; my legitimate interest lies in understanding the reach of my website and my posts and improving my offering. The counts are deleted automatically after 14 months.

On your first visit, a banner asks whether I may use analytics and marketing tools. Only if you agree are these tools loaded and cookies or similar identifiers stored on your device. Without consent, only technically necessary processing takes place. I store your choice in your browser’s local storage (entry “tschapke-einwilligung”, 12 months) so the banner does not appear on every visit; this is technically necessary (Section 25(2) no. 2 TDDDG).

The legal basis for these tools is your consent (Section 25(1) TDDDG, Art. 6(1)(a) GDPR). You can change or withdraw it at any time with effect for the future via “Cookie settings” in the footer of every page.

Google Analytics. With your consent, I use Google Analytics 4 by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. It analyzes which pages are visited, where visitors come from and how they use the website. For this, Google sets cookies (such as “_ga”, stored for up to two years). Google Analytics 4 does not store IP addresses. Google processes the data as a processor; data may be transferred to Google LLC in the USA, which is certified under the EU-U.S. Data Privacy Framework.

If you email or call me, I process the information you provide, usually your name, email address, possibly your phone number and company, and the content of your message. I use it to answer your inquiry and to clarify follow-up questions.

The legal basis is Art. 6(1)(b) GDPR if your inquiry relates to a contract or its initiation, otherwise Art. 6(1)(f) GDPR (my legitimate interest in answering inquiries). I delete the data once your inquiry has been fully dealt with, unless statutory retention obligations apply, for example for business correspondence under commercial and tax law.

My email inbox is operated by IONOS SE, Elgendorfer Str. 57, 56410 Montabaur, Germany, as a processor. Emails are only encrypted in transit if your email provider supports this too. For confidential content, feel free to ask me about a secure channel first.

On the contact page, you can send me an inquiry via a form. I process the information you enter there: the services you are interested in, details about you and your project (such as the type of business, timeframe, budget, website or social media profile and your message) and your contact details (first name, if provided last name, email address, phone number, company and preferred way of contact). Only the service, your first name and your email address are required; everything else is voluntary.

When you submit the form, your inquiry is transmitted in encrypted form to a server function at Vercel Inc. It stores the inquiry in my CRM (database of Supabase Inc., data center in London, United Kingdom) and sends a notification to my email inbox at IONOS SE. I use the information solely to handle your inquiry and to get in touch with you. There is no sharing with third parties, apart from the processors mentioned.

If you came to the website via a link with a campaign identifier, for example from one of my LinkedIn posts, this identifier (source and campaign name) is stored together with your inquiry. This lets me see which posts lead to inquiries.

To protect against automated spam submissions, the form contains a field that is invisible to humans and checks that it was not submitted unrealistically fast. No cookies are set for this and no third-party services such as CAPTCHAs are used.

The legal basis is Art. 6(1)(b) GDPR (pre-contractual measures taken at your request), otherwise Art. 6(1)(f) GDPR (my legitimate interest in answering inquiries). I delete the information once your inquiry has been fully dealt with and no collaboration results from it, unless statutory retention obligations apply. If we start working together, the section “Clients and projects” applies.

On the booking page, you can book a call with me. For this, I use Calendly, a service of Calendly LLC, 115 E Main St., Ste A1B, Buford, GA 30518, USA. The calendar only loads with your consent: either right away when you open the booking page, if you agreed to the category “External content” in the cookie banner (also via “Accept all”), or as soon as you click “Load calendar”. Without consent, no connection to Calendly is established and no data is transferred to Calendly.

If you load the calendar, your browser connects to Calendly’s servers. Technical data such as your IP address, browser information and the page visited is transmitted, and Calendly may store cookies or similar identifiers on your device. If you book a call, Calendly processes the information you enter there, usually your name, email address, the chosen slot and, if applicable, your answers to questions about the call. Calendly sends you and me a confirmation and reminders by email.

The legal basis for loading the calendar is your consent in the cookie banner or by the click (Section 25(1) TDDDG, Art. 6(1)(a) GDPR). You can withdraw it at any time for the future via “Cookie settings” in the footer of every page; you can delete cookies already set by Calendly in your browser. For the booking itself, the legal basis is Art. 6(1)(b) GDPR (pre-contractual measures taken at your request). Calendly processes the booking data as a processor on the basis of its data processing agreement (Art. 28 GDPR). Calendly is certified under the EU-U.S. Data Privacy Framework. I delete the booking data once it is no longer needed for the call and a possible collaboration; if we start working together, the section “Clients and projects” applies. Instead of Calendly, you can always reach me by email, phone or via the contact form.

You can subscribe to my newsletter in the footer of every page and at /newsletter. All I need is your email address. I use the double opt-in procedure: after signing up you receive an email with a confirmation link, and only after clicking it are you subscribed. This way nobody can sign up with someone else’s address.

I store your email address, the language of the page you signed up on, and the times of sign-up, confirmation and, if applicable, unsubscription. The times serve as proof of your consent. The data is kept in my CRM (database of Supabase Inc., data center in London, United Kingdom); the confirmation email and the newsletter are sent via my email inbox at IONOS SE. Both process the data as processors.

The legal basis is your consent (Art. 6(1)(a) GDPR). You can withdraw it at any time with effect for the future, via the unsubscribe link in every issue or by email to martin@tschapke.com. After you unsubscribe, I keep your address marked as “unsubscribed” so that you are not contacted again by mistake and so that I can prove the earlier consent (Art. 6(1)(c) and (f) GDPR); on request I delete it completely. I delete unconfirmed sign-ups after 30 days at the latest.

If we work together, I process the data needed to carry out the project: contact and company details, project information, correspondence, and billing and payment data. The legal basis is Art. 6(1)(b) GDPR. I retain invoices and business records in accordance with the periods required by German commercial and tax law (§ 257 HGB, § 147 AO, up to ten years); the legal basis for this is Art. 6(1)(c) GDPR.

To manage contacts, quotes and invoices, I use my own CRM system. It runs on Vercel Inc. (hosting), and the data is stored in a database operated by Supabase Inc. (USA); both process the data as processors. Where required by law, I pass data on to tax advisors and tax authorities.

For businesses that use my CRM, I process personal data of their customers on behalf of the respective business (Art. 28 GDPR). The business is the controller; I only process the data in accordance with its instructions.

If a business connects its WhatsApp Business number via the Meta app “tschapke CRM”, the following data is transmitted via Meta’s WhatsApp Business Platform: phone number and profile name of the contacts, content and time of the messages, and files sent (e.g. images, voice messages, documents). This data is stored exclusively in the business’s CRM and shown only to its authorized employees so that customer inquiries can be handled. The legal basis is Art. 6(1)(b) and (f) GDPR (handling the inquiry, legitimate interest in orderly customer communication).

Via Meta’s interfaces, inquiries from the business’s ad forms on Facebook and Instagram (lead ads) can also be transferred to the CRM, i.e. the information a person enters in the form, such as name, phone number, email address and answers to form questions. If I manage a business’s ad campaigns, I access its ad account via the Meta interface with its consent; in doing so, I process campaign and performance data such as budget, reach, clicks and cost per inquiry, which is not attributed to individual persons.

The data is not sold, not used for my own advertising and not passed on to third parties, with the exception of the technical service providers required to run the CRM (hosting: Vercel Inc.; database and file storage: Supabase Inc.) and Meta Platforms Ireland Ltd., Merrion Road, Dublin 4, D04 X2K5, Ireland, as the provider of WhatsApp, Facebook and Instagram. Messages and inquiries are deleted as soon as the business requests it or ends the connection; customers can request the deletion of their data from the business or directly at martin@tschapke.com.

I operate a company page on LinkedIn and publish posts via my personal profile, in part scheduled through my own CRM. The provider is LinkedIn Ireland Unlimited Company, Wilton Place, Dublin 2, Ireland.

If you visit my page or my posts or interact with them, LinkedIn processes your data according to its own rules and provides me with aggregated statistics (Page Insights), for example on views, reactions and broad audience characteristics such as industry or region. For these statistics, LinkedIn and I are joint controllers within the meaning of Art. 26 GDPR. The allocation of responsibilities is set out in LinkedIn’s addendum at legal.linkedin.com/pages-joint-controller-addendum. LinkedIn fulfils the main part of the information obligations, because only LinkedIn holds the underlying data.

I only see aggregated figures, not individual profiles, and I do not combine these statistics with my CRM or with the audience measurement of this website. If you send me a message or comment on LinkedIn, I process its content like a contact inquiry (see “Contacting me”). The legal basis is Art. 6(1)(f) GDPR; my legitimate interest lies in presenting my business publicly and in communicating with prospective clients.

You can exercise your data subject rights both with LinkedIn and with me (Art. 26(3) GDPR). For data held solely by LinkedIn, please contact LinkedIn directly. LinkedIn may transfer data to LinkedIn Corporation in the USA; the company is certified under the EU-US Data Privacy Framework.

This website contains links to external websites, such as my LinkedIn profile. These are simple links, not embedded plugins: a connection to the respective provider is only established when you click a link. The respective provider is responsible for data processing there; for LinkedIn, this is LinkedIn Ireland Unlimited Company, Wilton Place, Dublin 2, Ireland.

I do not sell personal data and only pass it on where necessary for the purposes described. Recipients may be:

• Vercel Inc. (hosting of the website and the CRM),
• IONOS SE (email),
• Supabase Inc. (CRM database),
• Calendly LLC (only when booking a call via Calendly),
• Meta Platforms Ireland Ltd. (only for the WhatsApp and lead ads integration for businesses),
• tax advisors and authorities, where there is a legal obligation.

Service providers that process data on my behalf are contractually bound by the requirements of the GDPR.

Some of the service providers mentioned are based in the USA or may transfer data there: Vercel Inc., Supabase Inc., Calendly LLC and Meta Platforms Inc. as the parent company of Meta Platforms Ireland Ltd. Transfers only take place with appropriate safeguards. Vercel, Calendly and Meta are certified under the EU-U.S. Data Privacy Framework, for which the European Commission has adopted an adequacy decision (Art. 45 GDPR). In addition, and in the case of Supabase, the European Commission’s Standard Contractual Clauses apply (Art. 46(2)(c) GDPR).

I only store personal data for as long as necessary for the respective purpose. It is then deleted, unless statutory retention obligations require longer storage. In that case, processing is restricted and the data is deleted once the retention period has expired.

Under the GDPR, you have the following rights:

• access to your stored data (Art. 15 GDPR),
• rectification of inaccurate data (Art. 16 GDPR),
• erasure (Art. 17 GDPR),
• restriction of processing (Art. 18 GDPR),
• data portability (Art. 20 GDPR),
• objection to processing (Art. 21 GDPR),
• withdrawal of consent with effect for the future (Art. 7(3) GDPR).

An informal message to martin@tschapke.com is all it takes.

If I process your data on the basis of legitimate interests (Art. 6(1)(f) GDPR), you have the right to object to this processing at any time on grounds relating to your particular situation (Art. 21(1) GDPR). I will then no longer process the data unless I can demonstrate compelling legitimate grounds that override your interests, or the processing serves the establishment, exercise or defense of legal claims.

You have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR). The authority responsible for me is:

Die Sächsische Datenschutz- und Transparenzbeauftragte (Saxon Data Protection and Transparency Commissioner)
Maternistraße 17, 01067 Dresden, Germany
Postal address: P.O. Box 11 01 32, 01330 Dresden
www.datenschutz.sachsen.de

You are under no legal or contractual obligation to provide me with personal data. Without your contact details, however, I cannot answer an inquiry. There is no automated decision-making, including profiling (Art. 22 GDPR).

I update this privacy policy whenever the website or my data processing changes. Last updated: November 2026.