Privacy

This English version is an AI-generated translation of the original German Privacy Policy. It is provided solely for convenience and informational purposes. In the event of any discrepancies, disputes, or interpretational differences, the original German version shall prevail and be exclusively legally binding.

This statement describes what personal data is processed when visiting this website and within the scope of the business relationship, for what purposes and on what legal basis this is done, how long the data is stored, and what rights you have.

1. Controller

Controller within the meaning of Art. 4 No. 7 GDPR is:

Mr. JustinTime
Justin Wiegmann
Hohenzollernstr. 63
45128 Essen
Germany

Email: datenschutz@mr-justintime.de
Phone: +49 155 61 81 82 77

Legal Notice: https://mr-justintime.de/impressum

For all questions regarding data protection and the exercise of your rights under Art. 15 to 22 GDPR, an informal message to the email address or postal address mentioned above is sufficient.

Data Protection Officer. A Data Protection Officer has not been appointed. The requirements of § 38 (1) BDSG (usually at least 20 persons constantly employed with the automated processing of personal data) do not apply to this sole proprietorship without employees; a data protection impact assessment pursuant to Art. 35 GDPR is not required for the processing operations described here, and no professional transmission or market or opinion research takes place.

2. Overview of Processing Operations

2.1 Types of Data Processed

• Master data (name, address, customer number)
• Contact data (email address, phone number)
• Content data (text of the inquiry, messages, submitted project documents)
• Contract data (subject matter, term, conditions)
• Payment and billing data
• Usage data (pages visited, time spent, referrer website)
• Meta and communication data (IP address, timestamps, browser device identifiers)
• Log data (server log files)

Special categories of personal data within the meaning of Art. 9 GDPR (such as health data, data concerning religious or political beliefs) are not collected. Should such information be included unasked in a message, it will not be evaluated separately and will be deleted along with the message.

2.2 Categories of Data Subjects

Interested parties, customers, clients, communication partners, and visitors to the website.

No employees — the company has none. No application procedure takes place.

2.3 Purposes of Processing

Provision and delivery of the website, ensuring security and availability, communication and processing of inquiries, initiation and fulfillment of contracts, accounting and fulfillment of tax and commercial law obligations, reach measurement, defense against abuse and automated attacks, public relations via a profile on a social network.

3. Relevant Legal Bases

The processing operations are based on the following legal bases of the GDPR:

• Performance of a contract and pre-contractual inquiries — Art. 6 (1) lit. b GDPR
• Compliance with a legal obligation — Art. 6 (1) lit. c GDPR
• Legitimate interests — Art. 6 (1) lit. f GDPR

For each individual processing operation below, the relevant basis is explicitly stated; where legitimate interests are relied upon, the specific interest is specified.

Currently, none of the processing operations described below are based on consent (Art. 6 (1) lit. a GDPR). Should consent be obtained in the future, the information on withdrawal in Section 13 applies.

In addition, the Federal Data Protection Act (BDSG) applies, and, for storing information on your terminal equipment or accessing information already stored there, § 25 TDDDG (Telecommunications-Digital-Services-Data-Protection-Act).

Change of purpose. Processing for a purpose other than that originally stated will only take place in accordance with Art. 6 (4) GDPR. In this case, you will be informed in advance about the new purpose.

4. Data Security

The transmission between your browser and this website is encrypted end-to-end (TLS/HTTPS); you can recognize this by the address https:// and the lock symbol in the address bar of your browser. This also applies to information transmitted via forms.

In addition, the following are in place: access restrictions to the systems used, an additional access control in front of the content management system, encrypted storage of access data and backups, as well as a recovery procedure after data loss (Art. 32 (1) lit. b and c GDPR). The measures are reviewed and adjusted if changes to the systems used or new insights give cause to do so.

Data transmission over the internet may nevertheless have security vulnerabilities; complete protection against access by third parties is not technically possible.

5. Provision of the Website and Hosting

5.1 Railway — Processor

The website, the content management system, the databases, and the reach measurement run on infrastructure from:

Railway Corporation
548 Market St PMB
68956 San Francisco, California 94104, USA
Email: privacy@railway.com · Web: https://railway.com

A Data Processing Agreement pursuant to Art. 28 GDPR has been concluded (https://railway.com/legal/dpa).

Place of Processing. The services used run in the europe-west4 region — Amsterdam, Netherlands, i.e., within the European Union. However, Railway Corporation is a US company; access from the United States in the context of operations, administration, and support can therefore not be ruled out. Such a transfer to a third country is based on the Standard Contractual Clauses of the EU Commission incorporated by Railway (Implementing Decision (EU) 2021/914, Modules 2 and 3) as well as additionally on the certification declared by Railway under the EU-U.S. Data Privacy Framework and the adequacy decision of the European Commission issued for this purpose on July 10, 2023. An appeal against this decision is pending before the Court of Justice of the European Union (Case C-703/25 P); it remains valid until a contrary decision is made. If the adequacy decision falls away, the standard contractual clauses will continue to support the transfer.

You can request a copy of the standard contractual clauses using the contact details provided in Section 1; the wording is also available in the Official Journal of the EU at eur-lex.europa.eu.

In this context, in particular IP addresses, access times, accessed addresses, and the information transmitted in forms are processed.

Legal basis: Art. 6 (1) lit. b GDPR, insofar as the provision serves the fulfillment of a contract or the answering of a pre-contractual inquiry, as well as Art. 6 (1) lit. f GDPR — legitimate interest in a secure, available, and efficient provision of the online offer.

5.2 Cloudflare — Processor

A Content Delivery Network with protection functions against overload and abuse is connected upstream of the website and the media storage:

Cloudflare, Inc.
101 Townsend Street
San Francisco, CA 94107, USA

Cloudflare processes every request to the website, in particular IP address, time, accessed address, and technical details of the browser. Delivery takes place via the geographically closest location of the worldwide network; for accesses from Germany, this is generally a location within Germany (in a measurement on September 22, 2026: Düsseldorf). A restriction of processing to the European Union is not configured in the setup used, so processing can also take place outside the EU.

Additionally used are:

• Cloudflare R2 as storage for images and media (bucket.mr-justintime.de)
• Cloudflare Access and Tunnel as access protection for the content management system

A Data Processing Agreement pursuant to Art. 28 GDPR is in place (https://www.cloudflare.com/cloudflare-customer-dpa/). For transfers to the United States, the incorporated Standard Contractual Clauses apply, as well as the certification declared by Cloudflare under the EU-U.S. Data Privacy Framework; what is stated in Section 5.1 regarding the adequacy decision and the copy of the guarantees applies accordingly.

Legal basis: Art. 6 (1) lit. f GDPR — legitimate interest in availability, short loading times, and defense against automated attacks.

5.3 Server Log Files

When accessing this website, log data is generated, which your browser automatically transmits:

• accessed address
• date and time of access
• transferred data volume and status code
• browser type and version
• operating system
• referrer URL (the previously visited page)
• IP address

This data is not merged with other data sources; it is not evaluated for advertising purposes.

Storage period: maximum of 90 days; after that, the log data is automatically deleted. Exceptionally, only those entries that are required for clarifying a specific security-relevant incident are kept longer — and even these only until final clarification.

Legal basis: Art. 6 (1) lit. f GDPR — legitimate interest in trouble-free operation, clarification and defense against attacks, and traceability of technical errors.

Note: For log data that your browser transmits anyway when a page is accessed, no consent under § 25 TDDDG is required, as neither information is stored on your terminal equipment nor is information stored there read out.

6. Cookies and Storage on the Terminal Equipment

This website does not set cookies during a normal visit and does not store any information on your terminal equipment. A consent banner is deliberately not used for this reason.

Cookies are only created in two cases, which do not concern regular visitors:

Both cookies are strictly necessary for the explicitly requested function and contain no identifier that would allow recognition beyond the session. The legitimate interest lies in the maintainability and editorial care of the website.

Read access to your browser's local storage takes place in a single location: The reach measurement script checks whether the plausible_ignore flag is set there and refrains from measurement in this case (see Section 7). This access serves exclusively to respect your own wish not to be counted and is strictly necessary for this purpose within the meaning of § 25 (2) No. 2 TDDDG. No information is stored in your terminal equipment, and no identifier is read out that would allow recognition.

Apart from these three cases, consent under § 25 (1) TDDDG is not required because neither information is stored in your terminal equipment nor is information stored there read out.

7. Contact

7.1 By Email, Phone or Message on Instagram

If you contact us by email or phone, your details will be stored for processing the request and in case of follow-up questions. They are not passed on to third parties without your consent, unless there is a legal obligation. The recipient in this respect is the processor named in Section 9.1, via whose environment the business email runs.

Necessity of the data (Art. 13 (2) lit. e GDPR). You are neither legally nor contractually obliged to provide us with your contact details. However, without a means of contact, your request cannot be answered.

Storage period: until final processing of your request, thereafter for the duration of possible follow-up questions, but no longer than six months — unless the inquiry results in a contractual relationship (then the periods from Section 12 apply) or statutory retention obligations apply, e.g., because the correspondence constitutes a commercial or business letter.

Contact via Instagram. For direct messages and comments on Instagram, the above applies only to a limited extent: Such messages initially lie in Meta's systems, which are not subject to the controller's control. What is stored there and for how long it is kept is determined by Meta; the storage period mentioned above and the commitment not to pass data on without consent can therefore only relate to our own processing. Details on this in Section 11.2. For confidential matters, the channels from Section 1 are the safer route.

Legal basis: Art. 6 (1) lit. b GDPR, insofar as the inquiry serves the initiation or fulfillment of a contract; otherwise Art. 6 (1) lit. f GDPR — legitimate interest in answering inquiries.

7.2 Via the Inquiry Form

Note: The inquiry form is currently not yet activated. This section describes the processing that will take effect upon activation. Until then, the processing described here does not take place.

Which data is collected. In a first step, the form asks for three mandatory details: your name, a contact channel (email address or phone number, in one field), and your request. A second, expressly voluntary step asks about budget scope, desired timeframe, and goal of the project. Additionally, the time is recorded at which this privacy policy was brought to your attention in the form. The sole purpose is to prove that the information obligation under Art. 13 GDPR was fulfilled; the legal basis in this respect is Art. 6 (1) lit. f GDPR — legitimate interest in verifiability. This is expressly not consent: Taking note of information is not consent, and none is requested.

Necessity of the data (Art. 13 (2) lit. e GDPR). You are neither legally nor contractually obliged to provide this data. However, without the three mandatory details, your request cannot be processed and no offer can be created; the form cannot be submitted without them. You can omit the details of the second step without consequences — they serve solely to tailor the offer more suitably.

What is expressly not collected. The form collects no IP address, no browser identifier, and sets no cookie. (Independent of this, the log data described in Section 5.3 is generated server-side, as with any other page view.)

Spam protection without third-party involvement. Instead of a Captcha service, your browser solves a small computational task (Proof-of-Work, ALTCHA). The task comes from our own server, is calculated in your browser, and returns to the same server. No third-party server is called, no third-party script is loaded, and no cookie is set. A service like reCAPTCHA or Turnstile is deliberately not used here. Legal basis: Art. 6 (1) lit. f GDPR — legitimate interest in defense against automated form abuse.

Where inquiries are stored. Inquiries are stored in a dedicated PostgreSQL database that is not shared by any other service (Railway, Region Netherlands, see Section 5.1).

Notification. Every received inquiry is delivered via email through the Gmail interface of the own Google Workspace account (see Section 9.1). The message contains name, contact channel, and request, as well as, if filled in, budget scope, timeframe, and goal. The access data for this transmission lies encrypted in the database, not in plain text and not in configuration files.

Storage period: as in Section 8.1.

Legal basis: Art. 6 (1) lit. b GDPR — implementation of pre-contractual measures upon your request.

8. Business Services, Customer Administration, and Invoices

For the initiation, execution, and billing of orders, master, contact, content, contract, and payment data are processed. The purpose is the provision of the agreed services, communication during the project, invoicing, and the fulfillment of tax and commercial law obligations.

Recipients of this data are — only to the extent necessary in each case — the processors named below, the account-holding credit institution for processing payments, the tax consultant, and, in the event of an audit, the tax administration. Data is not passed on for advertising purposes or to other third parties.

Necessity of the data (Art. 13 (2) lit. e GDPR). Providing name, address, and contact details is necessary for the conclusion and execution of a contract; without them, no contract can be concluded and no service rendered. The details required for a proper invoice are furthermore legally prescribed (§ 14 UStG); without them, billing is not possible. There is no obligation to provide data beyond this.

Legal basis: Art. 6 (1) lit. b GDPR (performance of a contract) and Art. 6 (1) lit. c GDPR (tax and commercial law retention and recording obligations), additionally Art. 6 (1) lit. f GDPR for retention for the assertion and defense of claims — the legitimate interest lies in defending against claims within the limitation periods.

8.1 Google Workspace — Processor

Business email, calendar, and file storage run via Google Workspace. Therefore, messages and documents containing personal data of customers and interested parties are also located there. The notification of new form inquiries described in Section 8.2 takes place via the same environment.

Google Ireland Limited
Gordon House, Barrow Street
Dublin 4, D04 E5W5, Ireland

A Data Processing Agreement pursuant to Art. 28 GDPR exists in the form of the Cloud Data Processing Addendum (https://cloud.google.com/terms/data-processing-addendum). The contracting party and controller for processing in the European Economic Area is the Irish company. For transfers to group companies in the United States, the Standard Contractual Clauses are incorporated; Google LLC is additionally certified under the EU-U.S. Data Privacy Framework. What is stated in Section 5.1 applies accordingly.

Legal basis: Art. 6 (1) lit. b and lit. f GDPR.

8.2 Lexware Office — Processor

Accounting, invoicing, and receipt management take place via Lexware Office.

Provider: Haufe-Lexware GmbH & Co. KG, Munzinger Straße 9, 79111 Freiburg, Germany. Processor under the Data Processing Agreement is Haufe Service Center GmbH, Munzinger Straße 9, 79111 Freiburg.

Processing of the core functions takes place in Germany. Individual additional functions of the provider use sub-processors, partly also outside the European Union; such transfers are based on an adequacy decision or standard contractual clauses, according to the provider. What is stated in Section 5.1 regarding guarantees and the possibility of obtaining a copy applies accordingly.

Legal basis: Art. 6 (1) lit. b GDPR (performance of a contract) and Art. 6 (1) lit. c GDPR (tax and commercial law obligations).

8.3 Hetzner — Processor for Backups

Extracts of the database are created regularly and kept outside the operating environment. This is intentional and has a simple reason: A backup stored with the same provider as the database does not survive an outage of this provider.

Hetzner Online GmbH
Industriestraße 25
91710 Gunzenhausen, Germany
Commercial Register: Ansbach Local Court, HRB 6089
VAT ID: DE 812871812

The S3-compatible Object Storage is used at a German location (Falkenstein or Nuremberg). Processing thus takes place in Germany; it does not involve a transfer to a third country. A Data Processing Agreement pursuant to Art. 28 GDPR has been concluded.

A backup contains the same personal data as the database — inquiries, customer data, projects, and notes. From a data protection perspective, it is therefore not a side issue but the same matter as the database itself. Backups are stored encrypted and deleted after three months.

Legal basis: Art. 6 (1) lit. f GDPR — legitimate interest in the recoverability of data; at the same time a measure under Art. 32 (1) lit. b and c GDPR (availability and resilience of systems).

What the three months mean for a deletion request

If a record is deleted at your request, it disappears immediately from the active database. It remains in the backups for up to three months until the respective backup is routinely deleted.

This is stated here to avoid a gap between promise and reality. Backups during this time are used exclusively for recovery after a data loss and are not evaluated for any other purpose. If a backup has to be restored, the deletion is subsequently carried out again.

9. Fonts

The fonts used (Archivo, Archivo Narrow, JetBrains Mono) are installed locally and delivered from our own server. A connection to servers of Google or other font providers is not established when visiting this website; no IP address is transmitted to third parties.

10. Profile on Social Networks — Instagram

10.1 The Link on this Website

This website links to the controller's Instagram profile. This is a simple hyperlink, not an embedded widget or social plugin. Therefore, simply accessing this website transfers no data to Meta, and no connection to Meta's servers is established. Data processing by Meta only begins when you click the link and access the Instagram page. The symbol for the link is also delivered from our own server.

10.2 The Instagram Profile Itself

The controller maintains a profile on Instagram for external presentation and communication with interested parties. The provider of Instagram in Europe is:

Meta Platforms Ireland Limited Merrion Road Dublin 4, D04 X2K5, Ireland

Responsibility. When you visit or interact with the profile, Meta processes personal data — in particular your IP address, information about your device, browser, and operating system, information about what content you view and interact with, and, for logged-in users, the link to your Meta account. Meta uses cookies and similar technologies for this. This processing is carried out under Meta's own responsibility and on bases determined by Meta itself; there is no influence over this, and there is also no access to this raw data.

From this processing, the controller receives exclusively aggregated statistics ("Insights"): Reach, profile and post views, interactions, follower development, and rough evaluations by age groups, gender, and region of origin. Conclusions about individual persons are not possible. For the creation of these statistics, according to the case law of the Court of Justice of the European Union (Judgment of June 5, 2018, Case C-210/16), there is joint controllership pursuant to Art. 26 GDPR with Meta.

Meta provides an agreement on joint controllership for Insights data at https://www.facebook.com/legal/terms/page_controller_addendum, which, according to Meta, also includes Instagram Insights. In it, Meta assumes primary responsibility for information obligations towards data subjects and the handling of data subject rights. You can therefore assert your rights under the GDPR with regard to this processing directly against Meta as well — Meta is the better-suited point of contact for this because the underlying data is located there. An inquiry directed to the controller will of course also be processed and, if necessary, forwarded to Meta.

Further information: Instagram Privacy Policy at https://privacycenter.instagram.com/policy, Information on Insights Data at https://www.facebook.com/legal/terms/information_about_page_insights_data, contact options for privacy matters at Meta at https://help.meta.com/support/privacy/.

Third Country Transfer. Meta also processes data in the United States. Meta Platforms, Inc. is certified under the EU-U.S. Data Privacy Framework; the transfer is based on the European Commission's adequacy decision of July 10, 2023, and additionally on the Standard Contractual Clauses incorporated by Meta. What is stated in Section 5.1 regarding the status of this decision and the copy of the guarantees applies accordingly.

Messages and Comments. Messages, comments, and posts directed by you to the profile are processed for answering; in this respect, Section 8.1 applies.

Legal basis: Art. 6 (1) lit. f GDPR — legitimate interest in external presentation, public relations, and the opportunity to be reachable where interested parties are present anyway; for direct messages serving the initiation of a contract, additionally Art. 6 (1) lit. b GDPR.

Note. If you wish to avoid processing of your data by Meta, please use the contact channels mentioned in Section 1 instead of the Instagram profile.

11. Retention and Deletion

Personal data is deleted as soon as the purpose of its processing ceases to apply, consent is revoked, or a justified objection prevails — and no statutory retention obligation opposes this. If deletion is not possible due to such an obligation, the further processing of the data is restricted: They are blocked and kept solely to fulfill the retention obligation.

In particular, the following periods apply:

All periods of at least one year begin at the end of the calendar year in which the triggering event occurred — e.g., the invoice was issued, the business letter was received, or the claim arose and became known (§ 147 (4) AO, § 257 (5) HGB, § 14b (1) p. 3 UStG, § 199 (1) BGB).

Suspension of Expiry. Tax retention periods do not end as long as the documents are relevant for taxes whose assessment period has not yet expired (§ 147 (3) p. 5 AO). In individual cases — e.g., during a tax audit — the stated periods can therefore be extended.

Backups. The retention of backups described in Section 9.3 affects every deletion request retroactively. What this means specifically is explained there.

12. Your Rights as a Data Subject

You have the following rights regarding the personal data concerning you:

• Right of access (Art. 15 GDPR) — You can request confirmation as to whether data about you is being processed, and obtain information about this data as well as about purposes, recipients, storage period, and origin; you can also request a copy of the processed data.
• Right to rectification (Art. 16 GDPR) — You can request the immediate correction of inaccurate data and the completion of incomplete data.
• Right to erasure (Art. 17 GDPR) — You can request the deletion of your data if one of the grounds mentioned in Art. 17 (1) GDPR applies and no statutory retention obligation opposes it (see Section 12).
• Right to restriction of processing (Art. 18 GDPR) — You can request the restriction of processing instead of deletion, e.g., while examining an objection or as long as the accuracy of your data is contested.
• Right to data portability (Art. 20 GDPR) — Insofar as the processing is based on consent or a contract and is carried out by automated means, you can receive the data concerning you in a structured, commonly used, and machine-readable format, or request its transmission to another controller.
• Right to object (Art. 21 GDPR) — see the separately highlighted section in Section 14.
• Right to withdraw consent (Art. 7 (3) GDPR) — Insofar as processing is based on your consent, you can withdraw this at any time and without stating reasons with effect for the future. The lawfulness of the processing carried out until the withdrawal remains unaffected. Withdrawal is just as easy as giving consent, informally via the contact details mentioned in Section 1.

The exercise of these rights is free of charge for you. Inquiries are answered without undue delay, at the latest within one month of receipt; for particularly complex matters, this period may be extended by up to two further months, of which you will be informed within the first month (Art. 12 (3) GDPR). In the event of justified doubts about your identity, additional information for identification may be required (Art. 12 (6) GDPR).

No Automated Decision-Making. Automated decision-making in individual cases, including profiling, which produces legal effects concerning you or similarly significantly affects you (Art. 22 GDPR), does not take place.

Right to Lodge a Complaint (Art. 77 GDPR). Without prejudice to any other administrative or judicial remedy, you have the right to lodge a complaint with a data protection supervisory authority — in particular with the authority of your habitual residence, your place of work, or the place of the alleged infringement.

The supervisory authority responsible for the controller is:

State Commissioner for Data Protection and Freedom of Information North Rhine-Westphalia (Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen) PO Box 20 04 44, 40102 Düsseldorf Office Address: Kavalleriestraße 2–4, 40213 Düsseldorf Phone: 0211 38424-0 Email: poststelle@ldi.nrw.de Web: https://www.ldi.nrw.de

An overview of all German supervisory authorities can be found at https://www.datenschutzkonferenz-online.de/datenschutzaufsichtsbehoerden.html.

13. Right to Object

⚑ Information about your Right to Object under Art. 21 GDPR

Objection against processing based on legitimate interests

You have the right to object at any time to the processing of personal data concerning you that is carried out on the basis of Art. 6 (1) lit. e or lit. f GDPR — including profiling based on those provisions. The prerequisite is that the objection arises from reasons relating to your particular situation.

In this statement, this applies to: the provision of the website including CDN and server log files (Sections 5.1 to 5.3), the two technically necessary cookies and read access to plausible_ignore (Section 6), reach measurement with Plausible (Section 7), answering inquiries insofar as it does not serve contract initiation (Section 8.1), spam protection for the inquiry form and proof of providing information (Section 8.2), retention of contract data for defending against claims and the use of Google Workspace (Sections 9 and 9.1), retention of backups (Section 9.3), and the operation of the Instagram profile (Section 11.2).

If you object, your data will no longer be processed for these purposes, unless compelling legitimate grounds for the processing can be demonstrated which override your interests, rights, and freedoms, or the processing serves the establishment, exercise, or defense of legal claims.

Objection against direct marketing

Processing for the purpose of direct marketing does not currently take place. Should this change, the following applies: If your personal data is processed for direct marketing purposes, you have the right to object at any time and without stating reasons to processing for such marketing; this also applies to profiling related to it. If you object, your data will subsequently no longer be used for marketing purposes. This objection is not tied to any further conditions and is not subject to a balancing of interests.

How to lodge an objection

The objection can be made informally — one sentence is sufficient, reasons are only required for situational objections. Address it to:

Mr. JustinTime, Justin Wiegmann, Hohenzollernstr. 63, 45128 Essen Email: datenschutz@mr-justintime.de

14. Objection against Promotional Emails

The use of contact data published in the context of the imprint obligation (under § 5 DDG) for sending explicitly unsolicited advertising and informational materials is hereby objected to. The right to take legal action in the event of unsolicited promotional emails is expressly reserved.

15. Changes to this Policy

This statement will be updated as soon as the processing operations described change or the legal situation requires it. The version published here is the authoritative one; you can find the date of the last update at the beginning of this document.

A change is specifically imminent: Upon activation of the inquiry form, Section 8.2 will become effective. Until then, the section is marked as not yet applicable.