Levi Neumann Startup-Psychologe
Legal

Privacy Policy

1. Privacy at a Glance

This website works without cookies, without analytics tools and without advertising networks. That is why there is no consent banner either. As long as you are just reading, the web server processes only what is technically necessary to deliver the pages.

Personal data only comes into play once you act yourself: when you submit a form, book an appointment or send an email. Sections 5 to 7 describe what happens then.

2. Controller

The controller for data processing on this website is:

Levi Neumann
Junkerstraße 65
52064 Aachen, Germany
Phone: +49 (0) 170 3446638
Email: anfrage@levineumann.de

The controller is the person who decides on the purposes and means of processing personal data. No data protection officer has been appointed, as the conditions of § 38 BDSG are not met.

3. Your Rights

You have the right at any time to:

  • Access to the data stored about you, its origin and its recipients (Art. 15 GDPR)
  • Rectification of inaccurate data (Art. 16 GDPR)
  • Erasure (Art. 17 GDPR)
  • Restriction of processing (Art. 18 GDPR)
  • Data portability in a commonly used format (Art. 20 GDPR)
  • Withdrawal of consent with effect for the future (Art. 7 (3) GDPR)

Right to object (Art. 21 GDPR): Where data is processed on the basis of legitimate interests under Art. 6 (1) (f) GDPR, you may object on grounds relating to your particular situation. Processing will then stop unless compelling legitimate grounds override your interests.

An informal email to anfrage@levineumann.de is enough for all of this.

Right to lodge a complaint (Art. 77 GDPR): You may also complain to a supervisory authority. The competent authority here is the State Commissioner for Data Protection and Freedom of Information North Rhine-Westphalia, Kavalleriestraße 2–4, 40213 Düsseldorf, Germany.

4. Hosting and Server Log Files

Hosting: This website is hosted by Hostinger International Ltd., 61 Lordou Vironos Street, 6023 Larnaca, Cyprus. All data arising on this website is initially stored on Hostinger's servers. The legal basis is the legitimate interest in a secure and reliable provision of the website (Art. 6 (1) (f) GDPR). A data processing agreement under Art. 28 GDPR is in place with Hostinger.

Server log files: The web server automatically stores information that your browser transmits with every request:

  • browser type and version
  • operating system used
  • referrer URL, i.e. the previously visited page
  • IP address of the accessing device
  • time of the server request
  • file requested and amount of data transferred

This data is not merged with other sources and is not evaluated to identify individuals. The legal basis is Art. 6 (1) (f) GDPR, the legitimate interest in secure and error-free operation.

Reviewing the server log files: I go through these logs from time to time to see which pages are being opened and whether anything is technically broken. Only aggregate figures come out of this, such as the number of requests per page. No usage profiles are built, no identifier is set, and individual visits are not tracked. The legal basis is again Art. 6 (1) (f) GDPR, the legitimate interest in knowing whether my own website does its job. The logs never leave the server at Hostinger.

Encryption: The website is served exclusively over a TLS-encrypted connection, recognisable by https:// in the address bar. Form contents are therefore protected in transit.

5. Contact Forms and Email

What is collected: When you submit one of the forms on this website, the details you entered are processed. Depending on the form these are: name, email address, company, role, team size, the selected topic, how you heard about me ("source"), and your message. The only mandatory field is the email address, because without it there can be no reply. Everything else may be left blank.

Purpose and legal basis: The details are used solely to answer your enquiry and to prepare a possible project. The legal basis is the legitimate interest in handling incoming enquiries (Art. 6 (1) (f) GDPR); where the enquiry is aimed at a contract, Art. 6 (1) (b) GDPR applies in addition.

Where it goes: Each enquiry is stored in three places. First, in a log file on the web server at Hostinger. It is not publicly accessible and serves only as a backup. Entries in it are deleted automatically once they are six months old. Second, in a Google Sheet, see section 6. Third, a notification reaches me by email. As a rule Google sends it, as part of the same processing step. Only if that fails does the web server at Hostinger send it instead.

Mailbox: My mailbox runs on Google Workspace (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland), so the content of your enquiry is stored there as well. A data processing agreement is in place for Google Workspace; on the transfer to the USA see section 6.

Retention: If an enquiry does not lead to a collaboration, the data is deleted no later than six months after the last contact. If a collaboration does come about, statutory retention periods apply, in particular the six and ten year periods under German commercial and tax law. You can request earlier erasure at any time.

6. Google Sheets (Google Workspace)

So that no enquiry gets lost, the web server also transfers the form data over an encrypted interface into a spreadsheet inside my Google Workspace account. The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. The spreadsheet is not public and accessible only to me.

Google processes this data strictly on my instructions as a processor. The basis is the data processing agreement under Art. 28 GDPR which Google incorporates into the Workspace terms as the Cloud Data Processing Addendum.

Transfer to the USA: Processing by Google LLC in the United States cannot be ruled out. Google LLC is certified under the EU-US Data Privacy Framework, for which the European Commission adopted an adequacy decision on 10 July 2023 (Art. 45 GDPR). In addition, the European Commission's Standard Contractual Clauses apply under Art. 46 (2) (c) GDPR. Despite these safeguards, a residual risk remains that US authorities may access the data without legal protection fully equivalent to European standards.

If you would rather avoid this, simply send me an email or call instead of using the form. The contact details are in section 2 and in the legal notice. The retention periods in section 5 apply here as well.

7. Appointment Booking

For first conversations I link to a Google booking page (Google Calendar appointment scheduling, Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland). Nothing of it is embedded in this website: the button is an ordinary link. Only when you click it do you leave this website and a connection to Google is established.

On the booking page you enter your name, email address and possibly further details about the appointment. Google processes this data on my behalf; the appointment ends up in my calendar. The legal basis is Art. 6 (1) (b) GDPR, as the booking is a pre-contractual step taken at your request.

Google's own privacy policy additionally applies to the booking page: policies.google.com/privacy. On the basis for transfers to the USA see section 6.

8. Fonts, Icons and Cookies

Fonts and icons: The fonts used (Inter and Outfit) and the Font Awesome icon font are hosted on this website's own server. Loading a page therefore establishes no connection to Google Fonts or any other network, and no IP address is transmitted to third parties.

Cookies: This website sets no cookies and stores nothing in your browser's local storage. No analytics service is used, and there is no cross-device tracking and no profiling. Any figures I look at come from the server logs described in section 4. That is why there is no cookie banner.

Last updated: 08/2026. The German version of this policy is the legally binding one.