Privacy

1. Controller

Nadim Schamsedin, trading as Intellysell, is responsible for the processing described here. Our postal address is in the legal notice. Contact us at nadim@schamsedin.de for privacy matters.

2. Website delivery

This website is delivered through Cloudflare Pages. The host is Cloudflare, Inc., 101 Townsend St, San Francisco, CA 94107, USA. A request can be recorded in server logs, in particular the IP address, the time, the address requested and technical connection data. This is used to deliver the website and to keep it secure. The legal basis is Article 6(1)(f) GDPR. Our legitimate interest is the secure and reliable operation of this site.

Where Cloudflare processes this data as a processor, it does so under the Cloudflare Customer Data Processing Addendum. Transfers to the United States can rely on the EU-U.S. Data Privacy Framework and on standard contractual clauses. Cloudflare describes both in its privacy policy. Cloudflare, Inc.’s participation in the EU-U.S. Data Privacy Framework is listed as active in the U.S. Department of Commerce register.

The __cf_bm cookie can be set if bot protection is active. Where it is set, the storage is strictly necessary under section 25(2) TDDDG.

3. Enquiries and email

We process your name, email address, selected service, optional message and necessary technical connection data to handle your enquiry. The message is optional; the other form fields are required to process a form submission. Providing information is voluntary, but without required fields we cannot process the form. Please do not send health data, passwords or other particularly sensitive information.

Answers initially remain within the open browser form. On submission they are sent to a PHP endpoint hosted on ALL-INKL webspace and then by email to nadim@schamsedin.de. The endpoint does not create a separate message database. Messages and replies are processed in the email mailbox.

Processing to prepare or perform a contract is based on Article 6(1)(b) GDPR. Other correspondence is based on Article 6(1)(f) and our legitimate interest in answering enquiries. Acknowledging this notice is not consent to marketing. We do not add enquiries to newsletters or advertising lists without a separate legal basis.

4. ALL-INKL

Our form endpoint and email mailbox use ALL-INKL.COM – Neue Medien Münnich, proprietor René Münnich, Hauptstraße 68, 02742 Friedersdorf, Germany. Endpoint requests involve connection data; email hosting involves message content and metadata needed for delivery and mailbox operation. See ALL-INKL privacy information.

5. Abuse prevention

We use input validation, a honeypot field, short-lived signed request tokens and rate limits. IP addresses are converted to HMAC values using a server-side secret for these limits. Counter files contain no names, email addresses or message text. These identifiers are pseudonymous, not anonymous.

Counter windows are ten minutes or one hour, depending on the protection layer. Single-use markers are considered for up to two hours. Expired entries are removed on the next write request. Provider access logs are separate. Processing is based on Article 6(1)(f) GDPR and our legitimate interest in protecting the contact channel and infrastructure.

6. No external CAPTCHA integration

The contact form does not load Cloudflare Turnstile or another external CAPTCHA service. Abuse prevention uses the endpoint measures described in section 5.

7. Cookies, local resources and external links

Our website code sets no analytics or advertising cookies and does not store form answers in localStorage or sessionStorage. Fonts, graphics and the project screenshot are served as website files. The reference project is a locally hosted screenshot, not an embedded external website. Following an external link connects you to that provider. The recipient of the delivery is Cloudflare, Inc., as described in section 2.

8. Retention

We retain correspondence only while needed to handle the enquiry, conduct a subsequent business relationship, or establish, exercise or defend legal claims. We delete it when those purposes and any applicable retention grounds no longer apply. Where statutory retention duties apply, affected records are kept for the relevant statutory period and restricted to that purpose. Abuse-prevention counters are cleaned according to the windows described above. Retention of technical data by hosting and platform providers also depends on the applicable service settings and terms.

9. Recipients and international processing

We and the providers necessary for website delivery, security and email processing receive data as required for their tasks. We do not plan to disclose enquiries for advertising. Use of providers outside the EEA requires compliance with Articles 44 onward GDPR. The recipient of the delivery is Cloudflare, Inc. (section 2).

10. Your rights

Subject to legal conditions, you have rights of access, rectification, erasure, restriction and data portability under Articles 15–20 GDPR. You may withdraw consent at any time for future processing under Article 7(3).

Right to object: Where processing is based on Article 6(1)(f), you may object on grounds relating to your particular situation under Article 21. Contact nadim@schamsedin.de.

You may complain to a supervisory authority under Article 77, particularly in your country of residence, place of work or the location of a suspected infringement. In Hesse, contact Der Hessische Beauftragte für Datenschutz und Informationsfreiheit, Postfach 3163, 65021 Wiesbaden, Germany.

11. Security and decisions

The website and form endpoint use HTTPS. Email does not provide the same protection as end-to-end encrypted communication. Please let us know if another communication channel is needed. We do not make decisions about your project enquiry based solely on automated processing that produce legal or similarly significant effects under Article 22 GDPR.