Privacy policy

1. Who is responsible

Niclas Graf, Dialogplatz 5, 8400 Winterthur, Switzerland
Email: niclas.l.graf@gmail.com

I am responsible for the personal data processed on this website. This policy follows the Swiss Federal Act on Data Protection (FADP) and, where it applies, the EU General Data Protection Regulation (GDPR).

2. Visiting this website (hosting)

This website is hosted on Cloudflare Pages by Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107, USA. Every time you load a page, Cloudflare processes technical data to deliver the page and protect the site from attacks: your IP address, date and time, the page requested, the referring page, and your browser and operating system. Cloudflare does this on my behalf under a data processing agreement, using its global network, and keeps these logs under its own rules. I don’t store your IP address myself and don’t use it to identify you.

Legal basis (GDPR): my legitimate interest in a secure, working website (Art. 6(1)(f)).

3. Visitor statistics (Cloudflare Web Analytics)

I may switch on Cloudflare Web Analytics to see which pages are read and how fast they load. Only while it is switched on, your browser loads a small script from Cloudflare (static.cloudflareinsights.com) and sends a short report to Cloudflare for each page view.

The service doesn’t use cookies or any other storage on your device, and it doesn’t build profiles. Cloudflare records the page address (without query parameters), the referring website, country, device type, browser, operating system, the type of navigation and page-load times. According to Cloudflare, it doesn’t use your IP address or browser details to recognise or follow you. I only see totals. Detailed data is kept for 7 days and then reduced to a sample; the statistics are available to me for 6 months.

You can refuse by blocking the script, for example with a content blocker; many block it by default. The website works the same with or without it.

Legal basis (GDPR): my legitimate interest in understanding and improving this website (Art. 6(1)(f)).

4. Contact form

When you send the contact form, I receive what you enter: your name, your email address and the details about your project (such as the type of project, package, budget range, timing, your message and, if you add it, your website address), plus the language you’d like a reply in. The form can also send a few details that help me answer, such as which page or package you came from and, if you used the CSV checker, its summary counts (for example the number of rows and issues). It never sends a file or its contents. I use all of this only to answer you and, if we work together, to prepare and carry out the project.

The form is delivered by Web3Forms, a service of Web3Creative, Kerala, India. Web3Forms runs on Amazon Web Services (USA), Cloudflare (worldwide network) and Hetzner (Germany and Finland) and emails your message to my inbox (see section 5). To filter spam, Web3Forms sends your IP address and email address to CleanTalk Inc. and to Akismet (Automattic Inc.), both in the USA. According to its privacy policy, Web3Forms can keep submissions on its servers for up to three years. Web3Forms deletes its server logs, which can contain IP addresses, regularly.

Spam is also filtered with a hidden form field. There is no captcha and no cookie. If the form is sent within a few seconds of starting it, the subject line gets a short “[fast]” note, because that usually means a bot. Nothing else about how you use the form is recorded.

If the form can’t be sent (for example without JavaScript, or when Web3Forms can’t be reached), the page offers to open your own email program with your answers filled in. If you send that email, it goes through your email provider and mine (section 5), not through Web3Forms.

You don’t have to use the form. Without a name, email address and message I can’t answer you. You can also email me directly at niclas.l.graf@gmail.com instead. Then Web3Forms isn’t involved, only my email provider (section 5).

Legal basis (GDPR): steps before a possible contract, taken at your request (Art. 6(1)(b)), and my legitimate interest in answering inquiries (Art. 6(1)(f)).

5. Email

I use Gmail. For users in Switzerland and the EU, Gmail is provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Google may also process data in the USA and other countries (see section 10). Emails you send me, and messages from the contact form, are stored in my account.

How long I keep messages:

• Inquiries that don’t lead to a project: up to 12 months, then I delete them.
• Project emails: as long as the project and any follow-up need them.
• Offers, contracts and invoices: 10 years, because Swiss law requires business records to be kept that long.

6. Settings saved in your browser

This website sets no cookies. It saves up to three small entries in your browser, and only for the purposes below:

• Light or dark design. If you use the theme switch, your choice is saved in your browser’s local storage (entry “ng-theme”), so the page shows the design you chose on your next visit. Nothing is saved until you use the switch. To remove the entry, clear this site’s data in your browser; the website then shows the light design.
• Homepage intro. If your device doesn’t ask for reduced motion, the homepage plays a short intro animation once. To avoid repeating it, the entry “ng-intro” is saved in your browser’s session storage. Your browser deletes it when you close the tab.
• Contact form draft. While you fill in the contact form, your answers are saved in your browser’s session storage (entry “ng-inquiry”), so they survive a page reload. The entry is deleted once the form is sent, and your browser deletes it when you close the tab.

These entries stay on your device. Your browser doesn’t send them to me or anyone else; the form draft only reaches me if you send the form. The language is part of the web address (/ for English, /de/ for German). Nothing is saved for it.

7. CSV checker

The free CSV checker reads your file inside your browser. The file isn’t uploaded, sent or stored, by me or anyone else. On top of that, the checker page’s security settings block it from opening network connections. When you close the tab, the file is gone from the page.

If you then ask me for a quote, only the summary counts (for example the number of rows and issues) can be passed on to the contact form, never the file or its contents.

8. Cafe demo

The cafe website demo is fictional. Its reservation form doesn’t send or store anything.

9. Fonts, images and links

All fonts and images are served from this website. Your browser makes no requests to Google Fonts or other font or image services. Photos in the cafe demo come from Unsplash and are stored on this website, not loaded from Unsplash. The website’s security settings only allow scripts, fonts and images from this website itself, apart from the statistics script in section 3 if it is switched on. If you follow a link to another website, that website’s privacy policy applies.

10. Recipients outside Switzerland

• Cloudflare, Inc., USA, and the other countries where Cloudflare runs data centres (worldwide): Cloudflare is certified under the Swiss-U.S. and EU-U.S. Data Privacy Framework, and Switzerland and the EU consider certified US companies to provide adequate protection. For countries without adequate protection, Cloudflare’s data processing agreement contains the EU standard contractual clauses with the changes needed for Switzerland.
• Google Ireland Limited, Ireland, with Google LLC, USA, and other countries where Google processes data: Ireland has adequate protection; Google LLC is certified under the Data Privacy Framework; for other countries Google uses the EU standard contractual clauses.
• Web3Creative, India, with its service providers in the USA (Amazon Web Services, CleanTalk, Automattic/Akismet), the EU (Hetzner) and worldwide (Cloudflare): India has no adequacy decision. Web3Forms’ data processing agreement contains the EU standard contractual clauses. The transfer is also directly connected with answering your request (Art. 17 para. 1 lit. b FADP; Art. 49(1)(b) GDPR).

You can ask me for a copy of these safeguards at niclas.l.graf@gmail.com.

11. Your rights

You can ask me what personal data I hold about you and ask me to correct or delete it, to restrict its use, or to give it to you in a common format. You can object to processing based on legitimate interest. Write to niclas.l.graf@gmail.com; I reply within 30 days.

You can also complain to the Swiss Federal Data Protection and Information Commissioner (FDPIC, Feldeggweg 1, 3003 Bern, www.edoeb.admin.ch) or, if you live in the EU or EEA, to the data protection authority in your country.

12. No automated decisions

I don’t make automated decisions about you and don’t create profiles.

13. Changes

I update this policy when the website or the services I use change. The date at the top shows the current version.