Privacy Policy

1. Controller (Verantwortlicher)

The controller responsible for data processing on this website (mussiehaile.com) within the meaning of Art. 4(7) GDPR is Mussie Haile. Full contact details are available in the Impressum.

2. Hosting and Server Log Files

This website is served as static files by Cloudflare, Inc., 101 Townsend St, San Francisco, CA 94107, USA (“Cloudflare”), using Cloudflare Pages. Cloudflare also runs the function that forwards the project questionnaire.

When you access this website, Cloudflare's infrastructure automatically records the following data in server log files:

• IP address of the requesting device
• Date and time of the request
• URL of the page accessed
• Referring URL (previously visited page, if any)
• Browser type, version, and operating system
• HTTP status code and volume of data transferred

Purpose: Ensuring the secure and error-free provision of this website.
Legal basis: Art. 6(1)(f) GDPR: legitimate interest in the stable and secure operation of the website.
Retention: Cloudflare keeps these logs for a short time for security purposes.

International data transfer: Cloudflare is headquartered in the United States. Personal data may be transferred to and processed in the USA. This transfer is based on the EU-U.S. Data Privacy Framework (Art. 45 GDPR) and Standard Contractual Clauses pursuant to Art. 46(2)(c) GDPR. Cloudflare's Data Processing Addendum applies. Further information: Cloudflare Privacy Policy.

3. Consent Management: Usercentrics

This website uses Usercentrics, a Consent Management Platform (CMP) provided by Usercentrics GmbH, Sendlinger Str. 7, 80331 Munich, Germany (“Usercentrics”). The banner is supplied in the eRecht24 edition; when it is displayed, its logo is loaded from uc.e-recht24.de, which necessarily transmits your IP address to that server.

Usercentrics enables this website to obtain, document, and manage your consent for any non-essential cookies and tracking technologies in compliance with the TDDDG and GDPR. To fulfil this function, Usercentrics processes the following data:

• Your consent decisions (accepted / rejected services)
• Date and time of consent
• A pseudonymous consent ID stored in your browser
• Browser type and user agent (for legal documentation purposes)

Purpose: Documenting and managing consent as required by law.
Legal basis: Art. 6(1)(c) GDPR (compliance with a legal obligation to record consent) and Art. 6(1)(f) (legitimate interest in demonstrable consent management).
Retention: Consent records are kept for three years from the date of consent or until revocation, whichever is earlier.

Revoking or changing your consent: You can withdraw or adjust your consent at any time by clicking the privacy settings icon displayed at the bottom of the screen, or by clicking here to open privacy settings. Withdrawal does not affect the lawfulness of processing carried out before withdrawal.

Further information: Usercentrics Privacy Policy.

4. Cookies and Local Storage

Draft: this section is pending legal review.

This website sets no cookies. Usercentrics instead uses your browser's local storage, a small storage area on your device, to store and retrieve your consent preferences:

These entries are strictly necessary for this website to comply with its legal obligation to document consent. They do not track you for advertising or profiling purposes. No prior consent is required for storing them under § 25(2) no. 2 TDDDG (strictly necessary). Unlike cookies, they have no set expiry date; you can delete them through your browser's site data settings.

If you grant additional consent via the banner, the permitted services may store further data on your device, including cookies. You can adjust or revoke your consent at any time via the privacy settings widget.

5. Contact via Email

You can contact us at contact@mussiehaile.com. When you do so, the personal data you provide, at minimum your email address and the content of your message, will be stored solely for the purpose of processing your inquiry and any follow-up correspondence. My mailbox is hosted by Google Workspace (see section 6).

Purpose: Responding to your inquiry.
Legal basis: Art. 6(1)(f) GDPR (legitimate interest in answering contact requests), or Art. 6(1)(b) where the inquiry relates to pre-contractual measures.
Retention: Your email correspondence is retained until the purpose has been fulfilled. A statutory retention period of up to six years may apply to business correspondence (§ 257 HGB).

We will never share your email address with third parties for marketing purposes.

6. Project Request Form

On /start you can send a website project request. It asks for your name, email address, company name, optionally your current website and a message, and your answers about design, scope, goals, and timeline. Nothing is sent until you press “Send my request”.

Purpose: Preparing and answering your request, including a possible offer.
Legal basis: Art. 6(1)(b) GDPR (pre-contractual measures at your request).
Recipients: The request is sent as an email via Brevo (Sendinblue SAS, Paris, France), an EU-based email delivery service, to my business mailbox hosted by Google Workspace (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland). Both act as processors under data processing agreements (Art. 28 GDPR). Where Google processes data in the USA, transfers are covered by the EU-U.S. Data Privacy Framework (Art. 45 GDPR) and Standard Contractual Clauses.
Retention: Deleted when the request is closed without a contract, at the latest after 12 months; if a contract follows, statutory retention periods apply (§ 257 HGB, § 147 AO).

If sending fails, the form offers to open your own email program with your answers pre-filled; section 5 then applies.

7. Web Fonts and Images

This website uses the typefaces Schibsted Grotesk, Geist and Geist Mono. All font files are self-hosted on this server (via Next.js's built-in font optimisation, next/font). All images and videos, including project screenshots, design examples, and the offer videos, are also served from this server. No requests are made to Google Fonts, Fontshare, or any other external font or image provider when you visit this site, and no IP address or browser data is transmitted to third parties as a result.

8. External Links and Appointment Booking

This website links to external services, including Calendly (Calendly LLC, USA) for booking calls, and LinkedIn. These services are not embedded: no data is sent to them while you browse this site. Only when you click such a link do you leave this website, and the provider's own privacy policy applies from then on.

If you book a call via Calendly, the details you enter (name, email address, and any notes) are processed by Calendly and made available to me to prepare and hold the meeting.
Legal basis: Art. 6(1)(b) GDPR (pre-contractual measures at your request).
International data transfer: Calendly is certified under the EU-U.S. Data Privacy Framework (Art. 45 GDPR). Further information: Calendly Privacy Notice.

Digital products (for example on pages under /offers) are sold by Gumroad (Gumroad, Inc., USA) as the seller (merchant of record). When you click a buy button, you go to Gumroad, which processes your purchase, payment, VAT, and invoice under its own privacy policy. No data is sent to Gumroad before you click.

Service buttons on this website open your own email program with a pre-filled message. Nothing is sent until you press send yourself; section 5 then applies.

9. Your Rights Under GDPR

As a data subject you have the following rights, which you may exercise at any time using the contact details in the Impressum:

• Right of access (Art. 15 GDPR): You may request confirmation of whether personal data concerning you is being processed, and if so, access to that data.
• Right to rectification (Art. 16 GDPR): You may request correction of inaccurate personal data concerning you.
• Right to erasure (Art. 17 GDPR): You may request deletion of your personal data where one of the grounds in Art. 17(1) GDPR applies.
• Right to restriction of processing (Art. 18 GDPR): You may request that processing be restricted in the circumstances set out in Art. 18(1) GDPR.
• Right to data portability (Art. 20 GDPR): Where processing is based on consent or contract and carried out by automated means, you may receive your data in a structured, machine-readable format.
• Right to object (Art. 21 GDPR): Where processing is based on legitimate interests (Art. 6(1)(f)), you may object on grounds relating to your particular situation. We will cease processing unless we can demonstrate compelling legitimate grounds.
• Right to withdraw consent (Art. 7(3) GDPR): Where processing is based on consent, you may withdraw that consent at any time. Withdrawal does not affect the lawfulness of processing carried out before withdrawal.

10. Right to Lodge a Complaint

Without prejudice to any other remedy, you have the right to lodge a complaint with a data protection supervisory authority, in particular in the EU Member State of your habitual residence, place of work, or the place of the alleged infringement (Art. 77 GDPR). The supervisory authority responsible for this website is the Berliner Beauftragte für Datenschutz und Informationsfreiheit.