Privacy Policy

Protecting your data matters a great deal to us. That is why we comply with the statutory data protection rules (in particular the GDPR and the BDSG) and go further to protect your data.

This Privacy Policy applies to the website fjnland.de and to other processing of personal data by fjnland GmbH in the course of our work as a creative agency (e.g. project work, communications, accounting). The controller within the meaning of the General Data Protection Regulation and other data protection provisions is:

fjnland GmbH
Frankfurter Straße 87
Gebäude 13 (Picherei)
D-97082 Würzburg
Email: dse@fjnland.de

Basics

1.1. Processing of personal data

Data protection applies to the processing of personal data. Personal means any data by which you can be identified personally. That is, for example, the IP address of the device (PC, laptop, smartphone, etc.) you are sitting in front of, or a name and email address in project communications. Such data are processed when "something happens with them". Here, for example, the IP is transmitted by the browser to our hoster and stored there automatically. That is then processing (within the meaning of Art. 4 No. 2 GDPR) of personal data (within the meaning of Art. 4 No. 1 GDPR). These and further legal definitions can be found in Art. 4 GDPR.

1.2. Applicable rules and laws

The scope of data protection is governed by law. In this case that means the GDPR (General Data Protection Regulation) as a European regulation and the BDSG (Federal Data Protection Act) as national law. In addition, the TDDDG (Telecommunications Digital Services Data Protection Act) supplements the GDPR rules insofar as the storage of information on end devices or access to information stored there is concerned (e.g. cookies or comparable techniques). That mainly affects the website.

1.3. The controller

The party responsible for data processing is the controller within the meaning of the GDPR. That is the natural or legal person who, alone or jointly with others, determines the purposes and means of the processing of personal data. You can reach the controller using the contact details given above.

1.4. Basic data processing

Some data (e.g. the IP address) are collected automatically when you visit the website. Those data are needed mainly for the technical provision of the website. In addition, we process data that you consciously provide to us or that arise in the course of enquiries, projects, contracts and invoices, for example by email, appointment booking, chat or in shared workspaces. Where we use personal data beyond that or collect other data, we will inform you or ask for consent. You will find detailed information in the following sections.

1.5. Your rights

The GDPR gives you extensive rights. These include, for example, free information about the origin, recipients and purpose of your stored personal data. You can also request rectification, erasure or restriction of processing, object, request data portability, or lodge a complaint with the competent data protection supervisory authority. You can withdraw consent you have given at any time. How these rights work in detail and how you can exercise them is set out in the last section of this Privacy Policy.

1.6. Our view of data protection

Data protection is more to us than a tiresome duty. Personal data have great value, and careful handling of them should be a matter of course in our digitised world. As a data subject, you should also be able to decide for yourself what happens with your data, when and by whom. That is why we commit to complying with the statutory rules, collect only the data we need, and treat them confidentially.

1.7. Disclosure and erasure

Disclosure and erasure of data are likewise important and sensitive topics. That is why we want to briefly explain our general approach up front. Disclosure takes place only on a legal basis and only where necessary. That can be the case in particular where a so-called processor is involved and a data processing agreement under Art. 28 GDPR has been concluded. We erase your data when the purpose and legal basis for processing cease to apply and no other statutory obligations stand in the way of erasure. Art. 17 GDPR also gives a good overview. Please take further details from the following sections, and for specific questions reach us using the contact details above.

1.8. Legal bases

Processing of personal data always needs a legal basis. In the following sections we state the concrete legal basis for each processing. Art. 6(1) GDPR provides in particular for:

• consent (lit. a)

• contract or pre-contractual measures at your request (lit. b)

• legal obligation (lit. c)

• vital interests (lit. d)

• public task or exercise of official authority (lit. e)

• legitimate interests, provided your interests or fundamental rights do not override (lit. f)

What happens on our website

By visiting our website we process personal data about you. To protect these data as well as possible against unauthorised interference by third parties, we use TLS encryption. You can recognise this encrypted connection by an https:// or a padlock symbol in your browser's address bar. Below you will learn which data are collected when you visit our website, for what purpose, and on what legal basis.

2.1. Hosting and Framer Events

This website is provided externally via Framer. The personal data collected on this website are stored on the hoster's servers. That includes the automatically collected and stored log files (more on that below) as well as further data that you as a website visitor provide.

External hosting is for the purpose of secure, fast and reliable provision of our website. The legal basis for operation is Art. 6(1) lit. f GDPR (legitimate interest in stable, secure operation and abuse prevention). Insofar as hosting serves the initiation or performance of contracts with (potential) clients, Art. 6(1) lit. b GDPR may also apply.

Our hoster processes only such data as are necessary to fulfil its service obligations and acts, where applicable, as our processor under Art. 28 GDPR.

• Provider: Framer B.V., Rozengracht 207B, 1016 LZ Amsterdam, Netherlands

• Privacy Statement: https://www.framer.com/legal/privacy-statement/

According to its own information, Framer uses sub-processors and infrastructure including in the USA (including AWS). A transfer to third countries may therefore take place. Where required, the transfer is based on appropriate safeguards under Art. 44 et seq. GDPR (e.g. adequacy decision / EU-US Data Privacy Framework and/or Standard Contractual Clauses), as described in Framer's documentation or DPA.

In addition, Framer by default embeds an events/analytics script (events.framer.com) on published sites. The script is a platform default and currently cannot be disabled; we leave it in place deliberately and do not run a consent banner for it. Technical usage information may be processed (e.g. page views/events, path, locale/time zone, device/browser details). According to Framer, the built-in analytics operate without cookies and without persistent identifiers. Legal basis for the subsequent processing: Art. 6(1) lit. f GDPR (interest in understanding usage as well as stability and optimisation of the website).

Insofar as the script stores information on the end device or accesses information stored there, Section 25(1) TDDDG may additionally apply. We do not rely here on Section 25(2) TDDDG and currently do not obtain consent for this script.

2.2. Data collection when the website is accessed

When the website is accessed, information is automatically stored in so-called server log files. In particular, this includes:

• browser type and browser version

• operating system used

• referrer URL

• host name of the accessing computer

• time of the server request

• IP address

These data are needed temporarily so that we can display our website to you continuously and without problems. In particular, they serve the following purposes:

• system security of the website

• system stability of the website

• troubleshooting on the website

• establishing the connection to the website

• displaying the website

Data processing takes place pursuant to Art. 6(1) lit. f GDPR on the basis of our legitimate interest in the functionality and security of the website. These data are stored in pseudonymised form where possible and erased once the respective purpose has been achieved. Insofar as the server log files enable identification of the data subject, the data are as a rule stored for a maximum of 14 days. An exception applies if a security-relevant event occurs; then until remediation and final clarification. There is no combination with other data to form profiles.

2.3. Cookies and storage on the end device

Cookies and comparable techniques store information in your browser or access it. They can make navigation easier, but they are not always necessary.

What we do (and do not) set: On fjnland.de we do not set marketing or tracking cookies and currently do not operate a cookie consent banner. Technically necessary storage or access that is strictly required for the telecommunications service you have requested or the service you have expressly requested may be based on Section 25(2) TDDDG.

Local settings: In addition, we store, only in connection with settings you make, locally in the browser:

• sounds on/off (localStorage: fjn-sounds-enabled)

• theme preference (localStorage and/or sessionStorage)

These data are not transmitted to us and serve only display or operation according to your setting. You can delete them in your browser settings.

Note on Framer Events: The Framer Events script described under 2.1 is independent of this; see also there regarding Section 25 TDDDG.

You can refuse or delete cookies and website data in your browser settings. Here are links for commonly used browsers:

• Mozilla Firefox: https://support.mozilla.org/en-US/kb/clear-cookies-and-site-data-firefox

• Google Chrome: https://support.google.com/chrome/answer/95647?hl=en

• Microsoft Edge: https://support.microsoft.com/en-us/windows/delete-and-manage-cookies-168dab11-0753-043d-7c16-ede5947fc64d

• Safari: https://support.apple.com/guide/safari/manage-cookies-and-website-data-sfri11471/mac

If you use another browser, it is advisable to enter the name of your browser and "delete and manage cookies" in a search engine and follow the official link. Please note: comprehensive blocking may impair use of the website.

2.4. Data processing through user input

Email: If you contact us by email, we process your email address and any further data contained in the email. These may be stored on the mail server and in part on the respective end devices. Depending on the matter, the legal basis is regularly Art. 6(1) lit. b GDPR (enquiry / contract initiation) or Art. 6(1) lit. f GDPR (answering general enquiries). The data are erased as soon as the respective purpose ceases to apply and erasure is possible under statutory requirements; statutory retention periods remain unaffected.

Telephone: If you contact us by telephone, call data may arise at the telecommunications provider used. Personal data collected during the call are processed by us solely to handle your enquiry. Depending on the matter, the legal basis is regularly Art. 6(1) lit. b or lit. f GDPR. Erasure as for email.

Appointment booking (cal.com): To enable you to book an appointment with us, we link to the functions of cal.com. This service is offered by cal.com Inc., 2261 Market Street #4382, San Francisco, CA 94114, USA (e.g. via fjn.land/hej). For the purpose of appointment booking, personal data, in particular name, email address, desired appointment and any further fields you provide, are entered in the form provided and processed at cal.com. The data entered are used for planning, conducting and, where applicable, following up on the appointment. Legal basis: Art. 6(1) lit. b GDPR (pre-contractual measures at your request). The data are stored until the purpose ceases to apply, you request erasure or, where applicable, consent is withdrawn; mandatory statutory retention periods remain unaffected. For data transfers to the USA, cal.com cites appropriate safeguards (including Standard Contractual Clauses). Further information: https://cal.com/privacy

2.5. Website chat

Site-wide you can open a chat popup via the navigation or footer. The widget is loaded from https://fjnland-chat.vercel.app/widget (optionally with a language parameter). This lets you ask us questions without having to write an email straight away.

In particular, your chat messages and technical data (including IP address for abuse prevention / rate limiting) are processed. To generate replies, messages are transmitted via the Vercel AI Gateway to a language model (currently OpenAI / gpt-4o-mini). In the widget's browser, the history may be stored locally (localStorage) insofar as that is required for the chat service you have expressly requested (Section 25(2) TDDDG). Widget chats are not stored permanently in our database; technical logs and limits may be stored for a short time.

Legal basis: Art. 6(1) lit. f GDPR (legitimate interest in efficient information about the website and our services). Insofar as the chat recognisably serves the initiation or performance of a contract (e.g. a concrete project enquiry), we base the processing additionally or primarily on Art. 6(1) lit. b GDPR.

Recipients / processing on behalf: Vercel Inc. (hosting, functions, and where applicable Redis / further infrastructure) and, via the gateway, the model provider (OpenAI OpCo, LLC or affiliated companies). With these providers there exist, where applicable, processing relationships under Art. 28 GDPR or corresponding provider contract frameworks. A transfer to the USA may take place on the basis of appropriate safeguards (e.g. SCCs / EU-US Data Privacy Framework, where applicable).

API / training: Chat content transmitted via the API is, to our knowledge and under the providers' usual API/contract terms, not used to train the models. Use for fjnland's own training purposes does not take place.

Transparency: The chat is supported by AI. A corresponding notice appears in the chat UI (in addition to this policy). Please do not transmit special categories of personal data or confidential secrets that are not necessary for the enquiry.

2.6. Newsletter (Loops)

For newsletters and comparable email communication we use Loops. This service is offered by Astrodon Corporation, 9450 SW Gemini Dr, PMB 22902, Beaverton, OR 97008-7105, USA (service: https://loops.so/).

When you subscribe, we process in particular your email address and the fields you provide (e.g. name), the time of subscription and the confirmation in the double opt-in process. Legal basis: Art. 6(1) lit. a GDPR (consent). Consent is voluntary and may be withdrawn at any time with effect for the future, e.g. via the unsubscribe link in every email or by message to dse@fjnland.de. The lawfulness of processing carried out until withdrawal remains unaffected.

Loops processes the data on our behalf for sending and administering subscriptions. Where applicable, a processing relationship under Art. 28 GDPR exists (see https://loops.so/dpa). A transfer to the USA may take place; the provider cites appropriate safeguards for this (including EU-US Data Privacy Framework and/or Standard Contractual Clauses). Details: https://loops.so/privacy

Storage: until withdrawal or until deletion of your subscription, longer only insofar as statutory proof or retention obligations exist (e.g. proof of consent).

Measurement (opens/clicks): Insofar as we use open or click measurement in newsletters, this happens only where your consent expressly covers it or we obtain separate consent. Otherwise we forgo such tracking.

Insofar as we also use Loops for purely contractual / client-related emails (without marketing newsletter), the legal basis may be Art. 6(1) lit. b GDPR.

2.7. Links to third parties

When you click links to third parties (e.g. social media, Spotify, Notion, maps), their privacy notices apply. On fjnland.de we currently do not operate a Spotify embed plugin and no separate analytics tool such as Plausible.

2.8. Video conferences (Google Meet)

For communication with clients and interested parties we use Google Meet. Google Meet is an online conference tool. This service is offered by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland.

In video or audio conference communication, personal data are processed by us and by the tool provider. That includes information you provide when using the tool, conference metadata and technical information needed for the online communication to function. Files shared within the tool may be stored on the provider's servers.

Legal basis: Art. 6(1) lit. b GDPR insofar as the communication relates to performance of a contract or pre-contractual duties; otherwise Art. 6(1) lit. f GDPR (interest in efficient communication). Meet is not operated as an embedded service on fjnland.de; processing takes place via Google.

These data are stored until the purpose ceases to apply, you request erasure or, where applicable, consent is withdrawn. Mandatory statutory retention periods remain unaffected. Further details: https://policies.google.com/privacy?hl=en

What happens at our agency

Alongside the website, we process personal data in ongoing agency operations, for example if you are a client, interested party, supplier or other contact person. Here we explain the most important systems. The list is not exhaustive; we will add to it as needed.

3.1. Google Workspace (email, Drive, collaboration)

For email, calendar, documents, file storage and collaboration we use Google Workspace. Provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland; affiliated companies and infrastructure may also be located outside the EEA (including the USA).

There, in particular names, contact details, communication content, appointments and project and client files may be processed, including files you provide to us in the course of an order or that we create for you. Legal basis: Art. 6(1) lit. b GDPR (contract / pre-contractual measures) or Art. 6(1) lit. f GDPR (efficient, secure organisation of agency work) where no contract exists. Where statutory retention obligations exist, Art. 6(1) lit. c GDPR may also apply.

With Google there exists, where applicable, a processing relationship under Art. 28 GDPR. A transfer to third countries may take place and is based on appropriate safeguards under Art. 44 et seq. GDPR (e.g. EU-US Data Privacy Framework and/or Standard Contractual Clauses) where required. Storage: for the duration of the business relationship and thereafter in accordance with statutory or contractual retention periods; then erasure or anonymisation insofar as there is no duty of further storage. Further information: https://policies.google.com/privacy?hl=en

3.2. Accounting (sevdesk)

For accounting and invoicing we use sevdesk. Provider: sevDesk GmbH, Im Unteren Angel 1, 77652 Offenburg, Germany.

In particular, data needed for quotes, invoices, payments and the legally required bookkeeping are processed, e.g. name, address, contact details, tax number/VAT ID (where provided), invoice line items and payment information. Legal basis: Art. 6(1) lit. b GDPR (contract) and Art. 6(1) lit. c GDPR (legal obligations, in particular commercial and tax retention).

sevdesk acts, where applicable, as a processor under Art. 28 GDPR (DPA available via sevdesk). According to the provider, storage takes place among other places in Germany; details and subcontractors can be taken from sevdesk's information. Storage period: in accordance with statutory retention periods (often up to 10 years for tax-relevant records), then erasure insofar as no other duty stands in the way. Further information: https://sevdesk.de/datenschutz/

3.3. AI services in agency work

In project and office work we use AI-assisted tools (currently including ChatGPT Business / Workspace and further assistants in development environments). Our aim is not to enter personal or confidential client data into such systems unnecessarily. That cannot always be ruled out completely, for example where tools ship fixed with software packages or content already contains personal details.

Insofar as personal data are nonetheless processed, this is to support our internal work (e.g. drafting, structuring, research, code). Legal basis: Art. 6(1) lit. f GDPR (legitimate interest in efficient service delivery) or Art. 6(1) lit. b GDPR insofar as the use directly serves contract performance.

For this we use, where available, business/team subscriptions under whose contract and product terms use of content to train the models is excluded or not provided for. Use for fjnland's own training purposes does not take place. Recipients are the respective providers (including OpenAI and affiliated companies); a transfer to the USA may take place on the basis of appropriate safeguards (SCCs / Data Privacy Framework, where applicable). Where required, processing or corresponding contract frameworks under Art. 28 GDPR exist.

Please do not transmit special categories of personal data or secrets that are not necessary for the collaboration. If you expressly want certain content kept out of AI tools, please tell us early; we will take that into account within what is technically and organisationally possible.

3.4. Project communication (Basecamp)

For project management and communication with clients and within the team we use Basecamp. Provider: 37signals LLC, 137 N. Oak Park Avenue, Suite 208, Oak Park, IL 60301, USA (product: https://basecamp.com/).

There, in particular names, email addresses, messages, comments, file attachments, tasks and further project-relevant details may be processed, including those you share with us in the course of the collaboration. Legal basis: Art. 6(1) lit. b GDPR (contract / pre-contractual measures) or Art. 6(1) lit. f GDPR (efficient project and client communication) where no contract exists.

With 37signals there exists, where applicable, a processing relationship under Art. 28 GDPR (DPA with Standard Contractual Clauses). A transfer to the USA may take place. Storage: for the duration of the project or business relationship and thereafter in accordance with contractual or statutory retention periods; then erasure or anonymisation insofar as there is no duty of further storage. Further information: https://37signals.com/policies/privacy

3.5. Further processors

Beyond that, depending on the order and internal need, we engage further service providers as processors under Art. 28 GDPR (e.g. for design, development, time tracking or internal organisation). We do not list every single tool here. An up-to-date overview of the recipients relevant to you is available on request at dse@fjnland.de. Where required, corresponding contracts exist with these providers; for third-country transfers we rely on appropriate safeguards under Art. 44 et seq. GDPR.

These are your rights

Finally, we want to inform you about your rights and how we deal with changes in data protection requirements.

4.1. Right of access under Art. 15 GDPR

You can request information as to whether personal data about you are being processed. If so, you can request further information about the manner of processing. A detailed list can be found in Art. 15(1) lit. a to h GDPR.

4.2. Right to rectification under Art. 16 GDPR

This right covers the rectification of inaccurate data and the completion of incomplete personal data.

4.3. Right to erasure under Art. 17 GDPR

This so-called "right to be forgotten" gives you the right, under certain conditions, to demand that the controller erase the personal data. That is generally the case where the purpose of the data processing has ceased, consent has been withdrawn, or the original processing took place without a legal basis. A detailed list of grounds can be found in Art. 17(1) lit. a to f GDPR.

4.4. Right to restriction of processing under Art. 18 GDPR

This right is tied to the conditions in Art. 18(1) lit. a to d.

4.5. Right to data portability under Art. 20 GDPR

This governs the basic right to receive one's own data in a commonly used format and to transmit them to another controller. It applies, however, only to data from processing based on consent or contract under Art. 20(1) lit. a and b and only insofar as this is technically feasible.

4.6. Right to object under Art. 21 GDPR

You may in principle object to the processing of your personal data. That applies in particular where your interest in objecting overrides the controller's legitimate interest in the processing, and where processing relates to direct marketing and/or profiling.

4.7. Right to "individual decision-making" under Art. 22 GDPR

You have in principle the right not to be subject to a decision based solely on automated processing (including profiling) that produces legal effects concerning you or similarly significantly affects you. This right too has limitations and additions in Art. 22(2) and (4) GDPR.

4.8. Right to lodge a complaint under Art. 77 GDPR

You also have the right to lodge a complaint with a data protection supervisory authority if you consider that processing of personal data concerning you infringes the GDPR. For us, the Bavarian Data Protection Commissioner (BayLDA) is particularly competent: https://www.datenschutz-bayern.de/. The right to lodge a complaint also exists with any other supervisory authority in the EU.

4.9. Further rights

We again draw your attention here to your right to withdraw consent given under Art. 7(3) GDPR. The lawfulness of processing carried out until then is not affected. In addition, rights under the BDSG may exist that largely correspond in substance to the rights described above.

The current version of this Privacy Policy is September 2026. From time to time it is necessary to adapt the content to respond to factual and legal changes. We therefore reserve the right to amend this Privacy Policy and publish the amended version in the same place. We recommend that you read the Privacy Policy regularly.