Draft — not ready for publication
GUNMETAL / Legal information
Privacy policy
How I process personal data when you visit this website or get in touch.
Last updated: 10 October 2026
On this page
Controller
Emanuel Boran · GUNMETAL
Sole trader
Am Eckrain 15/1 · 78554 Aldingen · Germany
For privacy questions and requests to exercise your rights, contact kontakt@gunmetal-media.de or +49 1556 1950565.
At a glance
This website presents my web design services and projects. There is no customer account, checkout or newsletter signup. I do not use analytics or advertising trackers here. Images, fonts and videos are served from this website.
When you send an enquiry, I use your details to reply and, where relevant, prepare a collaboration. Contacting me is voluntary. You can browse the website without completing the form.
Hosting and website security
The website is intended to be hosted by Cloudflare, Inc., 101 Townsend Street, San Francisco, CA 94107, USA. Providing and protecting the website involves technical connection data, including IP address, requested URL, time, browser/device information and status or error data.
The legal basis is Article 6(1)(f) GDPR. My legitimate interest is to provide a reliable, secure and functional website. Cloudflare also handles form information submitted to the website server for technical processing.
Cloudflare’s data processing addendum forms part of its self-serve agreement. Processing outside the European Economic Area, including the USA, is possible. The DPA provides transfer safeguards including Standard Contractual Clauses and, where applicable, the EU-US Data Privacy Framework.
DRAFT: Before publication, confirm the precise Cloudflare product, enabled security/analytics features and retention periods for the logs actually generated, and complete this section.
Contact form
Your name, email address, choice of service or reason for contacting me, and message are required. Phone number, industry, budget and how you found me are optional. Required fields are marked. The form cannot be submitted without the required details; other contact channels remain available.
The form also processes the selected language, a random identifier to avoid duplicate submissions, and a hidden spam-detection field. The identifier is not used to track your browsing. Drafts remain in the form while the page is in use; this website does not persistently save them in browser storage.
Article 6(1)(b) GDPR applies where the enquiry concerns entering into or performing a contract with you. For other enquiries, including when you act as a contact person for another person or business, Article 6(1)(f) GDPR applies. My legitimate interest is to handle incoming business communications. Protecting the form against abuse also relies on Article 6(1)(f) GDPR.
Your details go to the website server, which passes the message to Resend for delivery to my inbox. Your email address is used as the reply address. This website does not maintain a separate enquiry database.
Email delivery through Resend
I use Resend to deliver form enquiries. It receives the message, reply address and delivery information. Resend states that it stores messages and logs in the USA; selecting Ireland as the sending region does not change that.
Resend provides a data processing addendum and identifies Standard Contractual Clauses and DPF participation as transfer safeguards. Its stated retention for email and log data on Free, Pro and Scale is 30 days, independently of deletion in my inbox.
DRAFT: Confirm the actual plan and open/click tracking settings before publication.
Email and telephone
My mailbox kontakt@gunmetal-media.de is provided by IONOS SE, Elgendorfer Straße 57, 56410 Montabaur, Germany. IONOS processes messages, addressing and transmission information to provide email communications. Enquiries remain in this mailbox; I do not automatically forward them to another inbox or CRM.
When you contact me directly by email or telephone, I use the information you provide to handle your enquiry. The legal bases described for the contact form apply. The processing arrangement with the email provider must be covered by the applicable contract.
How long I retain enquiries
I delete completed email enquiries that do not lead to a collaboration ten working days after the discussion ends, unless statutory retention duties or specific grounds for establishing, exercising or defending legal claims require otherwise.
If we work together, I keep the necessary documents according to their purpose and applicable statutory periods. Business correspondence may require six years of retention; invoices and accounting records may require eight. The relevant legislation determines when these periods begin. Not every informal enquiry falls within these requirements.
Messages in my inbox and copies retained by delivery/infrastructure providers are separate. Deleting my copy does not simultaneously delete their logs or backups. Resend’s stated period is described above. Any other backups actually used and their deletion arrangements need to be verified before publication.
WhatsApp Business
You can contact me voluntarily through WhatsApp Business. This website has an external link, not an embedded chat. Email, telephone and the form are also available. Following the link takes you outside this website.
To handle your enquiry, I process your phone number, profile name where available, and the content you send. The legal bases explained above for enquiries apply. I retain chats only as necessary for the enquiry, legal obligations or relevant legal claims.
The provider is WhatsApp Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland. WhatsApp also processes device, connection and usage information. Transfers outside the EEA, including to the USA, are possible. Its privacy policy describes its purposes, recipients and transfer safeguards.
DRAFT: The currently confirmed device configuration allows access to the address book. The contacts being synchronised and the legal basis for doing so still need to be established. This draft does not confirm that sharing third-party contacts is lawful.
Cookies, browser storage and external content
The application does not set analytics or marketing cookies. Its animations and forms do not store their own information in localStorage or sessionStorage. The language is determined by the URL. Screen size, scroll position and reduced-motion preferences are among the information used locally for rendering; I do not use this to build visitor profiles.
Additional services requiring consent must only load after the relevant consent. Whether the production Cloudflare configuration uses technical security cookies will be checked before publication; the necessary details will be added here.
Google review excerpts and project previews use local text and images. Google, WhatsApp and client websites are ordinary external links. Their content and services are not embedded merely by displaying those links.
Your rights
Subject to the statutory conditions, you can request access, rectification, erasure, restriction of processing and data portability. Where processing relies on consent, you can withdraw it for the future. This does not affect the lawfulness of processing before withdrawal.
Right to object: Where Article 6(1)(f) GDPR applies, you may object on grounds relating to your particular situation. For direct marketing, you may object without giving those grounds. To exercise your rights, contact kontakt@gunmetal-media.de.
You may complain to a data protection supervisory authority, particularly where you habitually live, work, or believe an infringement occurred. The authority for my place of business is the State Commissioner for Data Protection and Freedom of Information of Baden-Württemberg.
Automated decisions and changes
For this website, I do not make solely automated decisions that have legal or similarly significant effects, nor conduct profiling for that purpose.
I update this information when my processing or the services used change. The date of this version appears above.