Privacy Policy
1. Controller
David Laplant
Hauptstrasse 33
54636 Ehlenz
Germany
E-mail:
Phone:
2. Overview
This website is essentially a static website. It does not use any analytics or tracking tools, contact form or newsletter. The public pages themselves do not set any cookies. Fonts are not loaded from external providers; the system fonts available on your device are used. All images, stills, preview clips and own videos are delivered from the server of this website.
A connection to a third-party provider is only established if you play a film embedded via YouTube by clicking on it (section 5). Booking an appointment via Calendly is a simple link; only when you follow it does your browser connect to Calendly (section 7). Only the password-protected area for agencies and business clients sets a technically necessary cookie (section 6).
If, in the project overview, you open the project page from within an opened project, your browser stores the address of that page locally for the duration of the session (session storage), so that “All work” takes you back to your previous position in the overview. This entry is not transmitted to the server and is deleted when you go back, at the latest when you close the browser tab. The legal basis is Section 25(2) no. 2 TDDDG (strictly necessary for the navigation you requested).
3. Hosting and server log files
This website is hosted by:
STRATO GmbH
Otto-Ostrowski-Straße 7, 10249 Berlin
When you access the website, the host automatically processes data transmitted by your browser (server log files): IP address, date and time of access, page or file accessed, referrer URL, browser type and version, operating system, HTTP status code and amount of data transferred. This data is technically necessary to deliver the website and to ensure its security and stability. The legal basis is Art. 6(1)(f) GDPR (legitimate interest in secure and functional operation). The host stores the full IP addresses for a maximum of seven days in order to detect and defend against attacks; after that they are anonymised. A data processing agreement pursuant to Art. 28 GDPR has been concluded with the host.
4. Contact by e-mail
If you send me an e-mail, I process your e-mail address, your name and the content of your message in order to answer your enquiry. The legal basis is Art. 6(1)(b) GDPR if your enquiry is aimed at a contract or its initiation, otherwise Art. 6(1)(f) GDPR (legitimate interest in answering enquiries). The data is deleted as soon as it is no longer required, unless statutory retention obligations apply. My mailbox is provided by Apple (Apple Distribution International Ltd., Hollyhill Industrial Estate, Cork, Ireland) (iCloud Mail).
5. YouTube videos (played only after a click)
Some films are embedded via YouTube. The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. When you open a page or a project, only a still image from my own server is shown at first; no content is loaded from YouTube.
Only when you click on “Play film (loads YouTube)” is the YouTube player loaded in privacy-enhanced mode (youtube-nocookie.com) and the film started. A connection to Google servers is then established; in particular your IP address, information about your browser and device, the page visited and the video are transmitted. YouTube may also store or read information on your device (e.g. in local storage). A transfer to Google LLC in the USA is possible; Google LLC is certified under the EU-US Data Privacy Framework, for which an adequacy decision of the European Commission exists (Art. 45 GDPR).
The legal basis is your consent given by the click (Art. 6(1)(a) GDPR, Section 25(1) TDDDG). The consent applies only to the respective film and is not stored; you will be asked again the next time you open the page. You can withdraw it for the future by closing or reloading the page; YouTube data already stored on your device can be deleted in your browser settings. Projects whose film is delivered by this website itself do not load any content from YouTube. Projects with a YouTube film show a corresponding notice below the still image with a link to this section.
Further information: Google Privacy Policy.
6. Non-public area (rates and availability)
There is a password-protected area for agencies and business clients that is not linked in the navigation.
Cookie and login protection. When you access this area, the server sets a technically necessary session cookie (“dl_rates”). It contains only a random session identifier, is sent only for this area and is usually deleted when you close the browser or log out. On the server, a security token (protection against forged requests), the login status and the time of the last activity are assigned to the session; the login ends after 8 hours without activity. To protect against the password being guessed, failed logins are counted per IP address; after 5 failed attempts, logging in is blocked for 15 minutes. For this purpose I do not store the IP address itself, but a hash value of it pseudonymised with a secret key (HMAC-SHA256), together with the time of the failed attempt. Entries older than 15 minutes are deleted automatically each time this area is accessed.
The legal basis for the cookie is Section 25(2) no. 2 TDDDG (strictly necessary for the protected area you requested), and for the processing Art. 6(1)(f) GDPR (legitimate interest in secure access).
Availability calendar. The calendar shows only busy days, no appointments, titles or names. It is generated by my server from my own calendar (Google Calendar), which the server retrieves via a private calendar address at most once per hour. This calendar may contain appointments with titles; the server only determines on which days appointments take place. Titles and other appointment details are neither displayed nor stored by this website; only the busy days are cached on the server. Your browser does not load anything from Google for this, and no data about you is transmitted to Google for this purpose.
7. Booking appointments via Calendly
On some pages (e.g. in the area for agencies and on the page for companies) you can book a call via Calendly. The provider is Calendly LLC, 115 E Main St, Ste A1B, Buford, GA 30518, USA. The booking button is a simple link to my booking page at Calendly, which opens in a new tab; this website itself does not load any content or scripts from Calendly. Only when you follow the link do you leave this website and your browser connects to Calendly. Calendly then receives in particular your IP address and information about your browser and device; the address of the page you are coming from is not sent. On the booking page, Calendly’s privacy notices also apply, including Calendly’s cookie consent request.
If you book an appointment, Calendly processes your name, your e-mail address, the selected appointment and any information you provide voluntarily on my behalf, in order to organise the appointment and send you confirmations. The legal basis is Art. 6(1)(b) GDPR (steps prior to entering into a contract at your request). A data processing agreement pursuant to Art. 28 GDPR has been concluded with Calendly.
Your data is processed in the USA. Calendly LLC is certified under the EU-US Data Privacy Framework (adequacy decision of the European Commission, Art. 45 GDPR); standard contractual clauses have additionally been agreed. I delete booking data as soon as it is no longer required for the enquiry, unless statutory retention obligations apply.
If you do not want a connection to Calendly, simply send me an e-mail. Further information: Calendly privacy notice.
8. Links to Instagram and YouTube
The links to my profiles on Instagram and YouTube are simple links. No plugins or content of these services are loaded, and the links themselves do not transmit any data to these providers (for playing embedded YouTube films see section 5). Only when you follow a link do the privacy policies of the respective provider apply (Instagram: Meta Platforms Ireland Limited; YouTube: Google Ireland Limited).
9. Your rights
In accordance with Art. 15 to 21 GDPR, you have the right of access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and to object (Art. 21, see below). You can withdraw any consent you have given at any time with effect for the future (Art. 7(3) GDPR). To do so, simply contact me by e-mail.
Right to object under Art. 21 GDPR: Insofar as I process data on the basis of Art. 6(1)(f) GDPR (legitimate interest), you may object at any time on grounds relating to your particular situation. I will then no longer process the data unless I can demonstrate compelling legitimate grounds that override your interests, or the processing serves the establishment, exercise or defence of legal claims.
You also have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR). The competent authority is: Der Landesbeauftragte für den Datenschutz und die Informationsfreiheit Rheinland-Pfalz (State Commissioner for Data Protection and Freedom of Information of Rhineland-Palatinate), Hintere Bleiche 34, 55116 Mainz, Germany, e-mail: poststelle@datenschutz.rlp.de, www.datenschutz.rlp.de.
You are not obliged to provide me with personal data; however, this website cannot be displayed without the technically necessary connection data. There is no automated decision-making, including profiling.
10. Liability and copyright
The content of this website has been created with care; however, no guarantee is given for its accuracy, completeness or timeliness. The operators of external websites that are linked are solely responsible for their content; if infringements become known, the links in question will be removed immediately. All films, images and texts on this website are protected by copyright (© David Laplant, unless stated otherwise); any use beyond the limits of copyright law requires prior consent.