Privacy policy
1. Controller
Sandhan Westphal
Raimundstr. 10 B, 04177 Leipzig
Tel.: +49 171 5882385
Email: info@sandhan-design.de
2. Hosting & Server log files (Hetzner)
This website is operated on a server of Hetzner Online GmbH (Industriestr. 25, 91710 Gunzenhausen, Germany). The website is hosted on servers in Germany.
When you access the site, your browser automatically transmits technical data to the server, which is stored in server log files: browser type and version, operating system used, referrer URL, hostname of the accessing computer, time of the server request, IP address. This data is not merged with other data sources and is processed exclusively to ensure the secure and stable operation of the website. Legal basis: Art. 6 para. 1 lit. f GDPR. Further information: Hetzner Privacy Policy.
3. SSL/TLS encryption
This website uses SSL or TLS encryption for security reasons. You can recognise an encrypted connection by the fact that the address line of the browser changes from “http://” to “https://” and by the lock symbol in the browser line. When SSL or TLS encryption is activated, the data you transmit to us cannot be read by third parties.
4. Web analysis (Matomo) — no cookies
No cookies are set. For the statistical evaluation of website usage, we use the open-source software Matomo, which we operate ourselves on a server in Germany (Hetzner). Matomo works without cookies; your IP address is anonymised before each storage (shortened by 2 bytes), so that identification of individual persons is not possible. The “Do Not Track” setting of your browser is respected. No data is passed on to third parties and no data is transferred to third countries. Legal basis: Art. 6 para. 1 lit. f GDPR (legitimate interest in data-saving reach measurement).
You can object to the collection at any time (opt-out):
5. Appointment booking (Cal.com)
We use Cal.com, an open-source appointment software that we operate ourselves on a server in Germany (Hetzner, subdomain termin.sandhan-design.com), for booking a free initial consultation. When booking, we process the data you provide (name, email address, possibly telephone number and the selected appointment) exclusively for arranging and conducting the conversation. No transfer to third countries takes place. Legal basis: Art. 6 para. 1 lit. b GDPR. Booking is voluntary — alternatively, you can reach us by email or telephone.
6. Contact forms, email and telephone
If you use the contact form or request a website review, or contact me by email or telephone, the details you provide (name, email address, optional phone number, message and, for a review, website URL) will be used exclusively to process your enquiry and are sent to my business mailbox using the Brevo SMTP relay (Sendinblue GmbH, Germany) as a technical service provider. Do not submit health information or patient data through these forms. Legal bases: Art. 6(1)(b) GDPR for enquiries about a potential contract, Art. 6(1)(f) GDPR for other enquiries and, where consent is requested, Art. 6(1)(a) GDPR. You may withdraw your consent at any time by contacting me; this does not affect prior lawful processing. The data will be deleted as soon as your enquiry has been conclusively answered, provided that there are no statutory retention obligations to the contrary.
7. Objection to advertising emails
The use of contact data published within the scope of the legal notice obligation for the transmission of unsolicited advertising and information material is hereby objected to. The right to take legal action in the event of the unsolicited sending of advertising information, for example via spam emails, is expressly reserved.
8. Your rights
You have the following rights vis-à-vis the controller with regard to your personal data:
Access, erasure and rectification (Art. 15–17 GDPR): You have the right at any time to obtain free information about your stored personal data, their origin, recipients and the purpose of the data processing as well as a right to rectification or erasure of this data.
Restriction of processing (Art. 18 GDPR): You have the right to request the restriction of the processing of your personal data if you contest the accuracy of the data, the processing is unlawful, the data is required for the assertion of legal claims or you have objected pursuant to Art. 21 para. 1 GDPR.
Data portability (Art. 20 GDPR): You have the right to receive data that we process on the basis of your consent or in fulfilment of a contract in a common, machine-readable format.
Right to lodge a complaint: In the event of violations of the GDPR, you have the right to lodge a complaint with the competent supervisory authority — for Saxony: Saxon Data Protection Officer.
Right to object (Art. 21 GDPR)
If the data processing is based on Art. 6 para. 1 lit. f GDPR, you have the right to object to the processing of your personal data at any time for reasons arising from your particular situation. After objection, your affected personal data will no longer be processed unless we can demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms, or the processing serves the assertion, exercise or defence of legal claims (objection pursuant to Art. 21 para. 1 GDPR).
9. Status
22 October 2026