1. Controller
The controller within the meaning of the GDPR is: Finesa Shala — Finewerk, 51149 Cologne, Germany · Phone: +49 163 1283449 · Email: info@finewerk.eu. No data protection officer has been appointed, as the conditions of Art. 37 GDPR / § 38 BDSG do not apply.
2. Your rights
You have the right to access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction (Art. 18), data portability (Art. 20) and objection (Art. 21). Where processing is based on consent, you may withdraw it at any time with effect for the future (Art. 7(3)). You also have the right to lodge a complaint with a supervisory authority; the competent authority for us is the State Commissioner for Data Protection and Freedom of Information of North Rhine-Westphalia (LDI NRW), Kavalleriestraße 2–4, 40213 Düsseldorf.
3. Server log files
When you access our website, our hosting provider automatically collects information your browser transmits (browser type/version, operating system, referrer URL, host name, time of request, IP address). This data is not merged with other sources. Legal basis: Art. 6(1)(f) GDPR (legitimate interest in secure, error-free presentation). Hosting provider: Namecheap, Inc., 4600 East Washington Street, Suite 305, Phoenix, AZ 85034, USA, with whom a data processing agreement under Art. 28 GDPR is in place. As the provider is based in the USA, data may be transferred to a third country; this is safeguarded by standard contractual clauses under Art. 46 GDPR.
4. Contact (form, email, phone, WhatsApp)
If you contact us via our contact/audit form, email, phone or WhatsApp, we process the data you provide (e.g. name, email, phone, company, website URL, message) to handle your enquiry. Legal basis: Art. 6(1)(b) GDPR (pre-contractual measures) or (f) (legitimate interest). Data is deleted once no longer required and no statutory retention periods apply. Note on WhatsApp: using WhatsApp (WhatsApp Ireland Ltd.) transfers data to Meta and possibly to third countries (USA); use email or phone if you wish to avoid this.
5. Cookies and consent
We use cookies and comparable technologies. Technically necessary cookies are set on the basis of § 25(2) TDDDG / Art. 6(1)(f) GDPR. All non-essential cookies (statistics, marketing) are set only after your explicit consent under § 25(1) TDDDG and Art. 6(1)(a) GDPR, managed via our consent tool Complianz. You can withdraw or change your choice at any time via the "Cookie settings" link in the footer.
6. Google Analytics 4 and Google Tag Manager
This website uses Google Analytics 4 (Google Ireland Ltd., Dublin) with cookies that analyse your use of the site (page views, dwell time, approximate location from a shortened IP). We use Google Tag Manager to manage tags; it stores no personal data itself. Legal basis is solely your consent (Art. 6(1)(a) GDPR, § 25(1) TDDDG). Data may be transferred to Google LLC in the USA; Google is certified under the EU-US Data Privacy Framework, supplemented by standard contractual clauses. You may withdraw consent at any time. More: https://policies.google.com/privacy
7. Meta Pixel
This website uses the Meta Pixel (Meta Platforms Ireland Ltd., Dublin) to measure conversions from Meta ads (Facebook/Instagram) and to build advertising audiences (retargeting). For part of this processing, we and Meta are joint controllers (Art. 26 GDPR). Legal basis: your consent (Art. 6(1)(a) GDPR, § 25(1) TDDDG). Transfer to the USA is possible; Meta is certified under the EU-US Data Privacy Framework. More: https://www.facebook.com/privacy/policy
8. Newsletter
If you subscribe, we use your email address (and optionally name) to send information and offers, via a double opt-in procedure (a confirmation email confirms your subscription). Legal basis: your consent (Art. 6(1)(a) GDPR). You can unsubscribe at any time via the link in every email. Dispatch is handled by Mailchimp (The Rocket Science Group LLC, 405 N. Angier Ave. NE, Atlanta, GA 30308, USA) under a data processing agreement (Art. 28 GDPR). The provider is based in the USA, so data is transferred to the USA, safeguarded by standard contractual clauses. Sign-up/confirmation time and IP address are logged as proof of consent.
9. Booking, maps and embedded content
Booking of consultations and embedded content may use external services (booking tool, Google Maps, YouTube/Vimeo). These load only after your consent and may transfer data (incl. IP address) to the respective providers, possibly to third countries. Legal basis: your consent (Art. 6(1)(a) GDPR, § 25(1) TDDDG).
10. Client portal
For ongoing projects we provide a password-protected client portal; the data processed there (login data, project files, communication) serves contract performance (Art. 6(1)(b) GDPR) and is deleted after the project subject to statutory retention periods.
11. Data security & updates
This website uses SSL/TLS encryption ("https://" in the address bar). This policy is dated 09.08.2026 and may be updated as our website or the law changes.
