Privacy policy

The short version: I collect as little as possible, everything runs on servers in Germany, this website sets no cookies, and I never sell your data. The details are below.

Last updated: 2026-09-29. This policy also exists in German, French and Luxembourgish. If the versions differ, the German version applies.

1. Overview

"Personal data" is any information that can identify you, such as your name, email address or IP address. This page explains which personal data I process when you visit this website or contact me, why, on what legal basis, and what rights you have.

• Automatically: when you open a page, the server records technical data such as your IP address and browser (section 3).
• From you: when you request the free website check or contact me, I process what you send me (sections 6 and 7).
• Your rights: you can ask what I store about you, have it corrected or deleted, and more (sections 12 and 13).

2. Who is responsible

The controller responsible for data processing on this website (Art. 4(7) GDPR) is:

Roland Theisen (Lëtz Develop)
Im Brunnenfeld 8A
66706 Perl, Germany
Email: hello@letzdevelop.lu
Phone: +49 174 42 81 529

Lëtz Develop is a one-person business. I'm not required to appoint a data protection officer; for any privacy question, contact me directly.

3. Hosting, email and server log files

This website and the form processing (n8n) run on servers of Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany ("Hetzner"), in data centres in Germany. Hetzner's privacy policy: hetzner.com/legal/privacy-policy.

My email mailbox, including emails you send me and the website check requests forwarded to it, is hosted by netcup GmbH, Daimlerstraße 25, 76185 Karlsruhe, Germany ("netcup"), on a server in Germany.

I have concluded a data processing agreement (Art. 28 GDPR) with both providers, which ensures that they process data only on my instructions and in compliance with the GDPR.

When you open a page, the server automatically records in log files:

• your IP address
• date and time of the request
• the page requested and the referrer URL (the page you came from)
• browser type and version, and operating system

This data is not combined with other data sources. I need it to deliver the website and to detect and fend off attacks. Legal basis: Art. 6(1)(f) GDPR (legitimate interest in a secure, working website). The log files are deleted after 14 days at the latest.

4. Encryption

This website uses TLS encryption (you'll see "https://" and a lock icon in the address bar). Data you send through the website, such as the website check form, can't be read by third parties on the way. Emails to me are encrypted in transit where your email provider supports it. Transmission over the internet can never be protected completely, so please don't send highly sensitive information by email.

5. Cookies and local storage

This website sets no cookies and uses no tracking or advertising tools.

If you pick a language in the language menu, your browser remembers that choice in its local storage (the entry lang), so you aren't sent to a different language next time. The entry stays on your device and is never sent to me. This is necessary to provide the language choice you asked for, so no consent is required (§ 25(2) no. 2 TDDDG). You can delete it at any time in your browser settings.

6. The free website check and follow-up emails

When you request the website check, I process your website address, your email address and, if you enter it, your first name, together with the time of the request, the page you sent it from and the language you used. I use the data only to check your website and send you the report, and to answer if you reply.

Confirmation (double opt-in): so that nobody can request a report in someone else's name, the website first stores your request in a small database on my server at Hetzner and sends you an email with a confirmation link. Only when you open the link and confirm does my automation server (n8n, self-hosted at Hetzner) forward the request to my mailbox. If you don't confirm, the request is deleted after 72 hours at the latest.

Legal basis: Art. 6(1)(b) GDPR (steps taken at your request before a possible contract). Providing the data is voluntary, but without an email address I can't send you the report. The database entry is deleted 72 hours after your request, unless you agreed to follow-up emails (see below). I delete the request in my mailbox 12 months after sending the report, unless we start working together (then section 8 applies).

Follow-up emails (optional): if you tick the box in the form, I'll send you a few emails with tips for your website and information about my services. Legal basis: your consent (Art. 6(1)(a) GDPR), which only takes effect once you've confirmed it with the link. You can withdraw it at any time, with effect for the future: every follow-up email contains an unsubscribe link, or just send me a short email.

To be able to prove your consent, I store your email address, when you requested and confirmed it, the IP address used for confirming, and the exact wording you agreed to (Art. 6(1)(c) in conjunction with Art. 7(1) GDPR). Your website address and name are deleted when you unsubscribe; this proof is kept for 3 years afterwards, the statutory limitation period, and then deleted (Art. 6(1)(f) GDPR, legitimate interest in being able to defend against claims).

To keep out spam, the form also contains a hidden field and measures how quickly it was filled in; your IP address is kept in memory for up to 10 minutes to limit repeated requests. Nothing of this is stored permanently. Legal basis: Art. 6(1)(f) GDPR (legitimate interest in protection against abuse).

7. Contact by email, phone or WhatsApp

If you contact me by email or phone, I process your details (such as name, contact details and your message) to answer you. Legal basis: Art. 6(1)(b) GDPR if your enquiry relates to a contract or its preparation, otherwise Art. 6(1)(f) GDPR (legitimate interest in answering enquiries). I delete the data once your enquiry has been dealt with, unless statutory retention periods apply (section 8).

If you choose to contact me via WhatsApp, the service is provided by WhatsApp Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland. WhatsApp processes your messages and metadata under its own privacy policy, and data may be transferred to Meta Platforms, Inc. in the USA. Meta is certified under the EU-US Data Privacy Framework (DPF). The website only links to WhatsApp; no data is sent to WhatsApp until you click the link. If you'd rather avoid WhatsApp, call or email me instead. WhatsApp's privacy policy: whatsapp.com/legal/privacy-policy-eea.

8. Clients and contracts

When we work together, I process the data needed for the contract: name, business name, address, contact details, the content of our agreement, invoices and payment information (bank transfer). Legal basis: Art. 6(1)(b) GDPR (contract), and Art. 6(1)(c) GDPR for statutory retention obligations. Under German commercial and tax law, I keep invoices and accounting records for 10 years and business correspondence for 6 years (§ 147 AO, § 257 HGB). After that, the data is deleted.

9. Fonts

The fonts on this website (Plus Jakarta Sans, JetBrains Mono and Playfair Display) are stored on my own server. Your browser doesn't connect to Google Fonts or any other third-party server to load them.

10. Who receives your data

I don't sell your data or pass it on for advertising. Data is only shared with:

• Hetzner and netcup, as my hosting and email providers, under data processing agreements (section 3);
• my tax advisor and the tax office, for client and invoice data, where the law requires it;
• authorities, if I'm legally obliged to.

Apart from WhatsApp, if you choose to use it (section 7), no data is transferred to countries outside the EU. I don't use automated decision-making or profiling (Art. 22 GDPR).

11. How long I keep data

Where this policy doesn't name a specific period, I keep personal data only as long as I need it for the purpose it was collected for. If you ask me to delete your data, I'll do so unless the law requires me to keep it (for example the tax retention periods in section 8); in that case I delete it as soon as that obligation ends.

12. Your rights

You have the right to:

• know what data I store about you, where it comes from and who receives it (Art. 15 GDPR);
• have incorrect data corrected (Art. 16 GDPR);
• have your data deleted (Art. 17 GDPR);
• have processing restricted, for example while we clarify whether data is correct (Art. 18 GDPR);
• receive data you gave me, based on consent or a contract, in a common machine-readable format, or have it sent to someone else (Art. 20 GDPR);
• withdraw any consent at any time, with effect for the future (Art. 7(3) GDPR);
• complain to a data protection supervisory authority (Art. 77 GDPR), in particular in the EU country where you live or work. In Luxembourg, that's the CNPD; the authority responsible for me is: Unabhängiges Datenschutzzentrum Saarland, Fritz-Dobisch-Straße 12, 66111 Saarbrücken.

A short email to hello@letzdevelop.lu is enough. It's free of charge.

13. Your right to object (Art. 21 GDPR)