Privacy policy

22. Hosting and server logs

This website runs on servers in Germany that we rent from Hetzner Online GmbH (Gunzenhausen, Germany), in Hetzner's data centre in Falkenstein. Hetzner processes data only on our instructions, under a data processing agreement (Art. 28 GDPR).

Every visit passes through Cloudflare (Cloudflare, Inc., USA), which delivers the site and protects it against attacks. For this, Cloudflare processes your IP address and the technical request data listed below, on our instructions under a data processing agreement. Transfers to the USA are based on the EU-U.S. Data Privacy Framework (Art. 45 GDPR) and EU standard contractual clauses (Art. 46 GDPR). Cloudflare's privacy policy: https://www.cloudflare.com/privacypolicy/ (opens in a new tab)

When you open a page, the server automatically records technical data: your IP address, date and time of the request, the page requested, the referring page, browser type and operating system. These server logs are needed to deliver the site reliably, to fend off attacks and to investigate faults. Legal basis: Art. 6 (1) (f) GDPR, our legitimate interest in a secure, working website.

Server logs are kept for 30 days and then deleted. They are not merged with other data. All traffic is encrypted with TLS (HTTPS).

33. No cookies, no consent banner

This website sets no cookies and uses no tracking tools, no social media plugins and no fonts loaded from third parties.

Your language is chosen from the language header your browser sends (Accept-Language) when you open the site, and from the URL afterwards. No cookie stores it.

Because nothing non-essential is stored on your device, no consent banner is needed (§ 25 TDDDG).

44. Cookieless analytics (optional)

If we measure traffic, we use a cookieless tool (Plausible or Umami) that counts page views in aggregate: which pages are opened, from which country and on which type of device. It uses no cookies, does not follow you across websites and builds no personal profile. IP addresses are not stored.

Legal basis: Art. 6 (1) (f) GDPR, our interest in knowing how the site is used.

Current status: analytics is not enabled.

55. Contact form

When you use the contact form, we process the data you enter: your name, email address, business name and current website (both optional), what you need, your message and the language you used on the site. Fields marked as required are needed to answer you; the others are optional.

Purpose: answering your request and preparing an offer. Legal basis: Art. 6 (1) (b) GDPR (steps before a contract, taken at your request) and Art. 6 (1) (f) GDPR (answering enquiries).

Your message is sent through our email delivery provider Resend (Plus Five Five, Inc., USA). Email to @fanorta.com addresses is received by Cloudflare Email Routing (Cloudflare, Inc., USA, see the hosting section) and forwarded to our own mailbox on our servers in Germany. Resend and Cloudflare act only on our instructions under data processing agreements. Transfers to the USA are based on the EU-U.S. Data Privacy Framework (Art. 45 GDPR) and EU standard contractual clauses (Art. 46 GDPR; copy on request).

We keep your request until it is settled, and at most 12 months after the last contact. If a contract follows, the data is kept under that contract and the retention periods of tax law.

To keep bots out, the form uses a hidden field that humans never see, a minimum fill time and a limit on requests per IP address. For these checks your IP address is used briefly; the rate limit stores it only as a short, salted hash, never in clear text. Legal basis: Art. 6 (1) (f) GDPR.

66. Subscriptions and payment (Stripe)

If you order a website plan, you are redirected to Stripe Checkout, a payment page hosted by Stripe Payments Europe, Ltd., 1 Grand Canal Street Lower, Grand Canal Dock, Dublin, D02 H210, Ireland (Stripe). You enter your business name, billing address, VAT ID, email address and payment details on Stripe's pages. This website never sees your card or bank details.

Stripe processes this data to carry out the payment and may pass it to its US affiliate Stripe, LLC. These transfers are based on the EU-U.S. Data Privacy Framework (Art. 45 GDPR) and EU standard contractual clauses (Art. 46 GDPR). For fraud prevention and its own legal duties, Stripe is an independent controller. Stripe's checkout and customer portal pages use their own cookies; Stripe's privacy policy applies there: https://stripe.com/privacy (opens in a new tab).

From Stripe we receive your name, email address, business name, billing address, VAT ID, the chosen plan and the payment status. We use them to set up your website, to run the subscription and to issue invoices. Legal basis: Art. 6 (1) (b) GDPR (performance of the contract) and Art. 6 (1) (c) GDPR (bookkeeping duties).

Invoices and accounting records are shared with our accountant, who is bound to confidentiality, and kept for as long as accounting and tax law requires, then deleted.

You can manage or cancel your subscription in the Stripe customer portal, linked in the footer.

77. Service emails

After an order or a contact request we send you the emails that belong to the service: order confirmation, next steps and the booking link for the kickoff call, invoices and payment notices, and answers to your request. They are sent through Resend (see the contact form section). Legal basis: Art. 6 (1) (b) GDPR. We send no newsletter and no advertising emails without your explicit consent.

88. Booking a call

The booking button opens Cal.com, a scheduling service of Cal.com, Inc. (USA), in a new tab. There you enter your name, email address and, if you like, a note, and choose a time. Cal.com processes this data on our behalf and enters the appointment in our Google calendar; the call itself takes place in Google Meet (Google Ireland Limited, Ireland). We receive your name, email address, note and the chosen time slot in order to hold the call. Legal basis: Art. 6 (1) (b) GDPR (steps before a contract, taken at your request). Transfers to the USA are based on the EU-U.S. Data Privacy Framework (Art. 45 GDPR) and EU standard contractual clauses (Art. 46 GDPR). Privacy policies: https://cal.com/privacy (opens in a new tab) and https://policies.google.com/privacy (opens in a new tab)

99. External links

This site links to external sites such as LinkedIn and ChefSphere. They are plain links: nothing loads from those platforms until you click. After that, the privacy policy of the respective platform applies.

1010. Website Check tool (planned)

Planned, not yet active. We plan a free Website Check: you enter your website address, the server checks it (among others with the Google PageSpeed Insights API, which fetches your page on Google's servers) and shows you the result. Only the URL you enter is processed.

If you ask for the full report by email, we will ask for your explicit consent, confirm your address by double opt-in and record the consent (time, source, wording version and a hashed IP address). You can withdraw it at any time. This section will be completed when the tool goes live, and this policy will be updated.

1111. Your rights

Under the GDPR you have the following rights regarding your personal data:

• Access (Art. 15 GDPR)
• Rectification (Art. 16)
• Erasure (Art. 17)
• Restriction of processing (Art. 18)
• Data portability (Art. 20)
• Objection to processing based on legitimate interests (Art. 21)
• Withdrawal of consent you have given, with effect for the future (Art. 7 (3))
• Complaint to a data protection supervisory authority, in particular in the EU country where you live or work or where the alleged infringement took place (Art. 77).

1212. Right to object (Art. 21 GDPR)

Where we process your data on the basis of our legitimate interests (Art. 6 (1) (f) GDPR), you can object at any time on grounds relating to your particular situation. We then stop the processing, unless we can demonstrate compelling legitimate grounds that override your interests, rights and freedoms, or the processing serves to establish, exercise or defend legal claims.

1313. No automated decisions

We do not use automated decision-making or profiling within the meaning of Art. 22 GDPR.

1414. Contact for privacy requests

To exercise your rights or ask a question about data protection, write to contact@fanorta.com or to the postal address in the first section.

1515. Changes

We update this policy when the website or the law changes. The date at the top shows the current version. Older versions are available on request.