Privacy Policy

Controller

Harllens George de la Cruz · The Boring Cat
Eiffestraße 600, 20537 Hamburg, Germany

hgeorge@powerplatform.expert

Hosting and security

Cloudflare provides hosting, content delivery, Turnstile verification and private R2 document storage. Connection data, including IP address, browser information and request time, is processed to deliver the site and prevent abuse. This serves the legitimate interest in a secure, available website under Article 6(1)(f) GDPR. Fonts are served from this website, not from Google Fonts.

Contact and profile requests

The contact form processes your name, email address and message. The profile form processes your name, email address, company and selected document language. These details are used to answer your inquiry, send a receipt or deliver the selected public professional profiles by email. I receive a copy or notification to handle the request. The basis is Article 6(1)(b) GDPR for contractual inquiries, or Article 6(1)(f) for other correspondence. A request does not subscribe you to marketing or create an NDA. Do not submit confidential customer data.

Verification and request limits

Turnstile sends technical verification data to Cloudflare. The server checks the token, hostname and form action. After verification, both forms share abuse-prevention counters based on keyed hashes of IP address and email, request timestamps and request counts. These identifiers are pseudonymous, not anonymous. Counter records expire after 24 hours; a verified attempt can count even if email delivery subsequently fails. The cooldown is 2 minutes, 15 minutes after the fifth request, and 2 hours after the tenth in that window. The basis is Article 6(1)(f) GDPR.

Email and appointments

Cloudflare Email Sending sends automated receipts, profile attachments and request notifications. Google Workspace is used for the business mailbox and correspondence. These providers process addressing and message data needed for delivery. Resend and previous mailbox providers may retain records from earlier use under their applicable retention policies. Cal.eu is loaded when you open the booking dialog and processes the appointment details you enter. Booking-related processing is based on Article 6(1)(b) GDPR; operational delivery and security also rely on Article 6(1)(f).

Delivery queue

To recover from temporary delivery failures, Cloudflare Durable Objects briefly store the recipient, subject, message body and requested PDF attachments. Queued content is removed after provider acceptance or exhausted retries, and no later than 24 hours after submission. A keyed message identifier, delivery state and provider message ID can remain for up to 24 hours to limit duplicate sends. Provider acceptance does not guarantee inbox delivery.

Browser storage

Necessary local storage remembers your cookie choice. With your consent, functional local storage remembers language and theme under Article 6(1)(a) GDPR. You can change this using Cookie preferences in the footer. Selecting an analytics or marketing preference does not by itself enable a corresponding tool. The cookie policy describes the storage keys.

Recipients and international processing

The named providers receive data as needed for the stated functions. Processing outside the EEA, including in the United States, is possible. Where required, transfers must rely on an applicable adequacy decision or appropriate safeguards such as standard contractual clauses. You can request information about the safeguards applicable to your inquiry by email. Information is not sold.

Retention

Inquiry and correspondence data is retained while needed to respond, carry out agreed work, resolve related issues or meet legal retention obligations. Statutory records are retained under Article 6(1)(c) GDPR and restricted to those purposes. Other data is deleted when its purpose and applicable retention requirement end. The 24-hour counter lifetime does not mean that email correspondence or provider security logs are also deleted after 24 hours.

Your rights

Subject to GDPR conditions, you can request access, correction, erasure, restriction and portability, and object to processing based on legitimate interests. You can withdraw consent at any time without affecting earlier lawful processing. Use the contact below. You may complain to a supervisory authority, including the Hamburg Commissioner for Data Protection and Freedom of Information. These forms do not make automated decisions producing legal or similarly significant effects.

Last updated

2026-09-22