Privacy Policy

Note: This is a courtesy translation. The legally binding version is the German original at /datenschutz . In case of any conflict between the two versions, the German text prevails.

Controller

The controller responsible for the processing of personal data on this website is:

Dr. Oliver Borchers
Winterswijker Straße 8
46354 Südlohn Oeding
Germany
Email: start@drborchers.com

A data protection officer is not required by law (§ 38 BDSG / German Federal Data Protection Act).

Privacy at a glance

This privacy policy describes which personal data are processed when you visit this website, for what purposes, on which legal basis, and to whom they are passed on (if at all). Data are processed in line with the principle of data minimisation. This website does not use marketing cookies or third-party tracking; a cookie banner is therefore not required.

Applicable legal bases

Where we obtain consent for the processing of personal data, Art. 6(1)(a) GDPR serves as the legal basis. For processing required to perform a contract or to take pre-contractual steps (e.g. enquiries via the contact form that concern our services), Art. 6(1)(b) GDPR is the legal basis. For processing necessary to safeguard our legitimate interests (e.g. secure delivery of the website, reach measurement, abuse prevention), Art. 6(1)(f) GDPR is the legal basis.

Security measures

All transmissions are fully encrypted via TLS (HTTPS). We use appropriate technical and organisational measures to protect your data against unauthorised access, loss or tampering. We process only the data necessary for the respective purpose.

Hosting and server log files

This website is delivered via Cloudflare Workers. The provider is Cloudflare, Inc., 101 Townsend Street, San Francisco, CA 94107, USA. Whenever you access the website, Cloudflare processes technically necessary connection data in so-called server log files, which your browser automatically transmits:

  • IP address
  • Date and time of the request
  • URL requested and HTTP status code
  • Amount of data transferred
  • Browser type, browser version, operating system
  • Referrer URL (previously visited page)

This processing serves the secure and performant delivery of the website as well as the defence against attacks. The legal basis is Art. 6(1)(f) GDPR; our legitimate interest lies in ensuring technical operation, protecting against attacks, and maintaining IT security. We have a data processing agreement (DPA) with Cloudflare in place ( Cloudflare Customer DPA ). Cloudflare is certified under the EU-U.S. Data Privacy Framework ; the EU Commission's Standard Contractual Clauses (SCCs) apply additionally as a fallback safeguard.

Fonts and local storage

Web fonts (Satoshi, Geist, Geist Mono) are served exclusively from our own server. There is no connection to Google Fonts or any other external font provider. No personal data are therefore transmitted to third parties when fonts are loaded.

This website stores only one small, technically necessary item in your browser's local storage: the key-value pair theme with the value light or dark. This preserves your preferred display variant (light or dark layout) across page loads. No personal evaluation takes place. Under § 25(2) no. 2 TDDDG (German implementation of the ePrivacy Directive), this storage is strictly necessary to provide the service you have explicitly requested; consent is therefore not required.

Web analytics with Plausible

We use Plausible Analytics for reach measurement. The provider is Plausible Insights OÜ, Västriku tn 2, 50403 Tartu, Estonia.

Plausible does not set cookies and stores no information in the user's browser. There is no cross-device recognition. IP addresses are processed solely on the server side for country-level geolocation, hashed with a daily-rotating salt and not stored. Only aggregated data are recorded:

  • Date and time of the page view
  • URL requested
  • Referrer (previously visited page)
  • Country (derived from the IP address; the IP itself is not stored)
  • Anonymised device class (browser, operating system, screen size)

Processing takes place exclusively on servers within the European Union (Hetzner, Falkenstein/Germany; UpCloud, Helsinki/Finland; Bunny, Ljubljana/Slovenia). No transfer to a third country occurs. Since neither cookies are set nor any other information is stored in or read from the end device, § 25 TDDDG does not apply; consent is not required. The legal basis is Art. 6(1)(f) GDPR; our legitimate interest lies in measuring reach to improve our offering. We have a DPA with Plausible ( plausible.io/dpa ). Further information: plausible.io/data-policy .

Contact form

If you send us a message via the contact form, we process the data you provide (name, email address, message body) for the purpose of handling your enquiry and any follow-up questions. Cloudflare processes technically necessary connection data, particularly your IP address, to limit abusive requests at the network edge. See the section "Hosting and server log files" for further information.

The legal basis is Art. 6(1)(b) GDPR for enquiries that serve the initiation or performance of a contract, otherwise Art. 6(1)(f) GDPR (legitimate interest in efficiently answering enquiries).

Providing personal data via the contact form is neither a statutory nor a contractual requirement. You are under no obligation to provide data. Without your name and email address, however, we cannot process your enquiry. We do not process your data for any other purpose. The form contains a technical honeypot field for automated spam detection; this field is invisible to regular users and, if filled, is evaluated solely for the purpose of immediately discarding the submission and is not stored.

Email delivery via Resend

Delivery of the contact-form message to our inbox is handled by the transactional email service Resend. The provider is Plus Five Five, Inc., 2261 Market Street #5039, San Francisco, CA 94114, USA. Name, email address and message content are transmitted.

Email delivery is routed via AWS region eu-west-1 (Ireland). Account data, metadata and logs are stored in the United States. We have a DPA with Resend ( resend.com/legal/dpa ). The third-country transfer is safeguarded by Resend's certification under the EU-U.S. Data Privacy Framework and supplementary Standard Contractual Clauses (SCCs) of the EU Commission.

The legal basis is Art. 6(1)(b) or (f) GDPR (see above).

Direct email contact

Alternatively you can reach us directly by email. The data you submit in this case (sender address, message content, optionally further voluntary information) are processed by us exclusively for the purpose of handling your enquiry. The legal basis is Art. 6(1)(b) GDPR for contract-related enquiries, otherwise Art. 6(1)(f) GDPR (legitimate interest in handling and documenting business enquiries).

Retention and deletion

We process and store personal data only for as long as is required for the respective processing purpose or as long as statutory retention obligations require (in particular § 147 AO and § 257 HGB / German Tax Code and Commercial Code).

  • Server log files (Cloudflare): retained in operational logs for up to 7 days, then deleted. No long-term identifiable storage.
  • Contact enquiries: stored in the email inbox until the enquiry has been finally processed and for the duration of any subsequent business relationship; statutory retention periods remain unaffected.
  • Send logs (Resend): retained for the duration of the service relationship; deleted within 90 days of account termination.
  • Reach measurement (Plausible): aggregated, non-personal statistics; no identifiable storage.

Your rights

You have the following rights:

  • Access to the data we process about you (Art. 15 GDPR)
  • Rectification of inaccurate data (Art. 16 GDPR)
  • Erasure of your data (Art. 17 GDPR)
  • Restriction of processing (Art. 18 GDPR)
  • Data portability (Art. 20 GDPR)
  • Withdrawal of any consent given, with effect for the future (Art. 7(3) GDPR)

To exercise these rights, an informal email to start@drborchers.com is sufficient.

Right to object (Art. 21 GDPR)

Where we process your personal data on the basis of legitimate interests pursuant to Art. 6(1)(f) GDPR, you have the right to object to such processing at any time on grounds relating to your particular situation. We will then cease processing unless we can demonstrate compelling legitimate grounds that override your interests.

Automated decision-making

No automated decision-making, including profiling, within the meaning of Art. 22 GDPR takes place.

Right to lodge a complaint with a supervisory authority

Without prejudice to any other administrative or judicial remedy, you have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR). The competent authority is the State Commissioner for Data Protection and Freedom of Information of North Rhine-Westphalia (LDI NRW):

Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen
Kavalleriestraße 2-4
40213 Düsseldorf
Germany
Phone: +49 211 38424-0
Email: poststelle@ldi.nrw.de
Web: www.ldi.nrw.de

Effective date

We reserve the right to adjust this privacy policy if the legal situation, the services used, or our data processing change. The version published on this page from time to time is the applicable one.

Effective date: 14 May 2026