Privacy policy

This is a translation for convenience. The German version is legally binding.

1. Controller

The controller responsible for data processing on this website within the meaning of the General Data Protection Regulation (GDPR) is:

Thilo Rek
Lohbichl 5, 83700 Rottach-Egern, Germany
Email: kontakt@thilorek.de

No data protection officer has been appointed, as there is no legal obligation to do so.

2. Overview

This website uses no cookies, no analytics or tracking tools and no advertising networks. Fonts are loaded locally from this server; no connection is made to Google Fonts or similar services. Personal data is only processed to the extent necessary to deliver the website and to handle your enquiries.

3. Hosting and delivery of the website

This website is delivered via Cloudflare (Cloudflare Pages, content delivery network and the R2 storage service for images and videos). The provider is Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107, USA.

When you visit the website, technically necessary data that your browser transmits automatically is processed, in particular:

• IP address
• date and time of access
• page or file requested
• amount of data transferred and status code
• browser type and operating system
• referrer URL (previously visited page)

This processing serves to deliver the website securely, reliably and quickly and to fend off attacks (e.g. DDoS). The legal basis is Art. 6(1)(f) GDPR; our legitimate interest lies in the secure and reliable operation of the website. A data processing agreement (Data Processing Addendum) is in place with Cloudflare.

A transfer to the USA cannot be ruled out. Cloudflare is certified under the EU-U.S. Data Privacy Framework; the transfer is based on the European Commission’s adequacy decision (Art. 45 GDPR), supplemented by EU standard contractual clauses. More information: https://www.cloudflare.com/privacypolicy/

Server log data is stored by Cloudflare only briefly and then deleted or anonymised.

4. Contact form and contact by email

If you contact us via the contact form or by email, we process the data you provide, in the form in particular:

• name
• email address
• company/organisation, if provided
• subject of your enquiry
• timeframe and budget, if provided
• your message

The data is used exclusively to handle your enquiry and any follow-up questions and is not passed on without your consent.

The legal basis is Art. 6(1)(b) GDPR where your enquiry relates to the performance of a contract or is necessary for pre-contractual measures. In all other cases, the processing is based on our legitimate interest in effectively handling enquiries addressed to us (Art. 6(1)(f) GDPR).

Technical processing:

• Form data is processed by a function at Cloudflare (see section 3) and delivered to us as an email via the email delivery service Resend (Resend, Inc., USA). Resend is certified under the EU-U.S. Data Privacy Framework; a data processing agreement is in place with Resend. More information: https://resend.com/legal/privacy-policy
• Emails to kontakt@thilorek.de are forwarded to our mailbox via Cloudflare Email Routing. The mailbox is provided by Google Ireland Ltd. (Gmail).

Storage period: your enquiry is deleted once it has been fully dealt with, unless statutory retention obligations apply. If the enquiry leads to an assignment, the retention periods under commercial and tax law apply (generally 6 or 8 years).

5. Images and videos

All images and videos on this website are loaded from our own storage (Cloudflare, see section 3). No videos from YouTube, Instagram or other platforms are embedded.

6. Links to social networks and YouTube

This website contains simple links to our profiles on Instagram, TikTok and YouTube and to individual videos on YouTube. These are ordinary links, not embedded plug-ins: merely visiting this website does not transfer any data to these platforms. Only when you click a link are you taken to the respective provider’s site, where its privacy policy applies:

• Instagram: Meta Platforms Ireland Ltd. – https://privacycenter.instagram.com/policy
• TikTok: TikTok Technology Ltd. (Ireland) – https://www.tiktok.com/legal/privacy-policy-eea
• YouTube: Google Ireland Ltd. – https://policies.google.com/privacy

7. Reach figures on this website

The follower and reach figures shown on this website come from our own Instagram account and are updated automatically at regular intervals. No data of visitors to this website is processed in the process.

8. Storage in the browser

This website does not store any information on your device and does not read any such information that is not strictly necessary to display the page you requested (§ 25(2) no. 2 TDDDG).

9. Your rights

You have the right at any time to:

• access the data we hold about you (Art. 15 GDPR)
• rectification of inaccurate data (Art. 16 GDPR)
• erasure (Art. 17 GDPR)
• restriction of processing (Art. 18 GDPR)
• data portability (Art. 20 GDPR)
• withdraw any consent given, with effect for the future (Art. 7(3) GDPR)

Right to object (Art. 21 GDPR): where we process data on the basis of Art. 6(1)(f) GDPR, you may object to the processing at any time on grounds relating to your particular situation.

An informal message to kontakt@thilorek.de is sufficient.

Right to lodge a complaint: you have the right to lodge a complaint with a data protection supervisory authority. The authority responsible for us is the Bavarian State Office for Data Protection Supervision (BayLDA), Promenade 18, 91522 Ansbach, Germany, https://www.lda.bayern.de

10. Data security

This website is delivered exclusively via encrypted HTTPS (TLS), indicated by the padlock symbol in your browser’s address bar.

11. Updates

Last updated: October 2026. We update this privacy policy whenever the website or the legal situation changes.