Privacy policy
Last updated: October 2026This is a courtesy translation. Only the German version is legally binding. Read the German version.
Our general terms and conditions (AGB) are available in German only. Terms and conditions (in German).
Here you can find out which data are processed when you visit our website and when you send a booking request. We do not use cookies or advertising tracking.
Controller
The controller responsible for data processing on this website is Al Kili, Achraf & El Kalaaoui, Bilal (GbR), trading as ABE Webstudio, Zeilweg 44, 60439 Frankfurt am Main, email: info@abe-webstudio.de, phone: +49 173 6314292.
Accessing the website
Each time the website is accessed, our server processes technical connection data. For the purposes of providing the website, analysing errors and defending against attacks, the following data may be processed in server logs:
- IP address
- date and time of access
- address accessed and amount of data transferred
- browser type and operating system
- previously visited page (referrer)
This processing is technically necessary to deliver the website and to secure its operation. The legal basis is Art. 6(1)(f) GDPR; our legitimate interest lies in stable and secure operation. We delete log data after 14 days at the latest. In the event of a specific security incident, longer retention may be necessary for investigation and the pursuit of legal claims. The data are not used to create advertising profiles.
Audience measurement with Umami (cookieless)
To understand which pages are read and how visitors find us, we use the open-source software Umami. It runs exclusively on our server at Hetzner in Germany; no data are transmitted to the software’s developers or to any other third parties.
The following are recorded: the page accessed, the referring page (referrer), browser, operating system, device class (smartphone, tablet or desktop; the exact screen size and the browser language are removed before sending), country and region, as well as clicks on certain buttons (for example WhatsApp, call, initial consultation) and the submission of a booking request as an event without content. Your IP address is not stored; a hash value is generated from the IP address, the browser identifier and a random value that changes daily. It groups visits made on the same day and cannot be traced back to you as a person. Recognition across days or websites is not possible. If you reach our website via a link with campaign information (for example from a Google ad or our Google Business Profile), we also record this information from the address (utm_source, utm_medium, utm_campaign, utm_content, utm_term), such as “google” and the campaign ID. Other address parameters, such as click IDs from advertising networks, are removed before sending.
In addition, when you leave a page, your browser transmits technical loading-time measurements to our Umami instance (how quickly the main content appeared, how quickly the page responded to input and whether content shifted), together with the page accessed and the device class (mobile or computer). These values contain no information about you as a person; we use them only to keep the website fast and stable. The same principles apply as for the rest of the audience measurement, in particular respect for “Do Not Track”.
Umami does not set cookies and does not store anything on your device. The measurement script only checks whether you have disabled measurement in your browser (entry umami.disabled in local storage) and respects your browser’s “Do Not Track” setting: if it is active, nothing is recorded. Addresses of private editing links are removed before sending.
The legal basis is Art. 6(1)(f) GDPR; our legitimate interest lies in understanding the reach and use of the website without intruding on your privacy, and in improving our offering. The statistical data are kept in aggregated form indefinitely; backup copies of the statistics database are overwritten after 30 days. You can object to the measurement at any time by activating “Do Not Track” in your browser.
No third-party content
All components of the website, including the fonts used and the statistics script, are delivered from our own server. When the website is accessed, no connection is made to Google Fonts, content delivery networks, social networks or any other third parties. Your IP address is not transmitted to anyone outside our hosting.
Links to third parties are plain links: our profiles on LinkedIn, Instagram, TikTok and Discord, our Google Business Profile with the reviews published there (Google Maps), the WhatsApp button and the websites of our clients in our portfolio. A connection to the respective provider is only established when you click the link; no maps, videos or social media elements are embedded. The providers alone are responsible for the processing on the linked pages.
Free website check
If you use the website check, our server retrieves the address you entered and checks the home page and, if available, the contact or booking page of that website. To measure loading time and accessibility, our server transmits the address entered to Google PageSpeed Insights (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland). Your IP address and any other information about you are not transmitted to Google, because the request is made by our server.
The address entered and the result are not stored. To protect against misuse, we limit the number of checks: for this purpose we keep a hash value of your IP address in memory for no longer than one hour; it is then automatically discarded and is not written to any storage medium. The legal basis is Art. 6(1)(b) GDPR for the check you requested and Art. 6(1)(f) GDPR for protection against misuse; our legitimate interest lies in the secure operation of the service.
Booking requests
If you use the form on the booking page, we process the information entered there (name, email address, optionally phone number and your message) in order to respond to your request and arrange an appointment.
The legal basis is Art. 6(1)(b) GDPR insofar as the request serves to initiate a contract, and otherwise Art. 6(1)(f) GDPR on the basis of our legitimate interest in responding to enquiries. Storage period in the booking database: requests that we decline or that lapse without a decision (after 72 hours or when the appointment begins) are deleted no later than 30 days after they were created; confirmed appointments 90 days after the appointment. Deletion takes place automatically the next time the booking function is used. Daily backup copies of the booking database are overwritten after 60 days. Emails used to arrange appointments are kept as business correspondence within the statutory retention periods.
Only your name, email address and message are mandatory. Without them, we cannot process the request. For a booking request, you also need to select a preferred appointment. All other information is voluntary.
When you book, we store your contact details, your request and the requested time in order to process the request. To display available times, our server checks our Google Calendar for busy times; other visitors do not see any appointment details. Only after we have accepted the request do we create an entry in Google Calendar with your name, the topic and the appointment; your email address, phone number and message text are not entered in the calendar. We remove the entry as soon as it is no longer needed for managing appointments. We send requests and confirmations via our STRATO mailbox.
To manage appointments, we use Google Calendar from Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. The connection to Google is made by our server, not as a calendar embedded in your browser. We use Google Workspace; a data processing agreement is in place with Google (Google Workspace Data Processing Addendum). The processing serves to arrange appointments under Art. 6(1)(b) GDPR or, in the case of other enquiries, our legitimate interest in orderly appointment management under Art. 6(1)(f) GDPR. Google also processes data on servers distributed internationally, including in the USA. Google LLC is certified under the EU-US Data Privacy Framework; the transfer is based on the adequacy decision of the European Commission (Art. 45 GDPR) and additionally on the standard contractual clauses of the European Commission. Further information is available at https://policies.google.com/privacy?hl=en and https://policies.google.com/privacy/frameworks?hl=en. Alternatively, you can contact us by phone or email.
Emails are sent and received via STRATO GmbH, Otto-Ostrowski-Straße 7, 10249 Berlin, Germany. In the process, STRATO processes sender and recipient addresses, message content and technical sending data. The processing serves to handle your request on the legal bases stated above.
Contact by email, phone, WhatsApp and video
If you contact us by email or phone, we process your information solely to deal with your enquiry. The legal basis is Art. 6(1)(b) or (f) GDPR. Please note that unencrypted email does not offer complete protection against access by third parties.
WhatsApp: Using the WhatsApp button, you can send a message to our business phone number. WhatsApp then opens in your app or browser; only at this step are data transferred to WhatsApp Ireland Limited, 4 Grand Canal Square, Dublin 2, Ireland. WhatsApp processes, in particular, phone numbers and metadata under its own terms and may transfer data to Meta Platforms, Inc. in the USA; Meta is certified under the EU-US Data Privacy Framework. Message content is end-to-end encrypted. We use WhatsApp solely to respond to your enquiry (Art. 6(1)(b) or (f) GDPR), do not synchronise any contact lists with WhatsApp and delete chat histories as soon as the matter has been dealt with and no retention obligations apply. If you do not wish to use WhatsApp, you can reach us by email or phone.
We hold video calls via the service agreed with you; we will give you the provider and the access details with the meeting invitation. A conversation by phone or at our studio is possible at any time.
Hosting on our Hetzner server
We operate this website on a server managed by us at Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany. The server is located in Germany. Hetzner provides the technical infrastructure; a data processing agreement pursuant to Art. 28 GDPR is in place with Hetzner.
Hosting involves the processing, in particular, of technical access data and of the information submitted via the enquiry form and stored in the booking database. The legal basis is Art. 6(1)(f) GDPR for secure operation and, for contract-related enquiries, Art. 6(1)(b) GDPR.
Your rights
You have the following rights towards us at any time:
- access to the data stored about you (Art. 15 GDPR)
- rectification of inaccurate data (Art. 16 GDPR)
- erasure (Art. 17 GDPR)
- restriction of processing (Art. 18 GDPR)
- data portability (Art. 20 GDPR)
- objection to processing based on a legitimate interest (Art. 21 GDPR)
To exercise these rights, simply contact info@abe-webstudio.de; no particular form is required. Irrespective of this, you can lodge a complaint with a supervisory authority. The authority responsible for us is the Hessian Commissioner for Data Protection and Freedom of Information (Der Hessische Beauftragte für Datenschutz und Informationsfreiheit), Gustav-Stresemann-Ring 1, 65189 Wiesbaden (PO Box 3163, 65021 Wiesbaden), phone +49 611 1408-0, email poststelle@datenschutz.hessen.de.
We do not make any decisions based solely on automated processing, and we do not carry out profiling (Art. 22 GDPR).
Right to object under Art. 21 GDPR
You have the right to object at any time, on grounds relating to your particular situation, to the processing of personal data concerning you that is based on Art. 6(1)(f) GDPR (legitimate interest). If you object, we will no longer process your data unless we can demonstrate compelling legitimate grounds for the processing that override your interests, rights and freedoms, or the processing serves the establishment, exercise or defence of legal claims. You can send your objection informally to info@abe-webstudio.de.