Privacy policy

This is an English translation of the German Datenschutzerklärung. The German version is the primary text.

It explains which personal data is processed when you visit this website, write to me or book a call, on which legal basis, and what your rights are.

1. Controller

Controller within the meaning of the General Data Protection Regulation (GDPR):

Nadiia Tatarinova
c/o Impressumservice Dein-Impressum
Stettiner Str. 41
35410 Hungen, Germany
Email: [email protected]

I have not appointed a data protection officer, as there is no legal obligation to do so.

2. Hosting with Cloudflare and server log files

This website is hosted by Cloudflare, Inc., 101 Townsend St, San Francisco, CA 94107, USA (Cloudflare Pages) and delivered through the Cloudflare network. Each time a page is requested, Cloudflare processes the information your browser transmits:

• IP address
• date and time of access
• page requested and amount of data transferred
• previously visited page (referrer)
• browser and operating system (user agent)

This data is technically required to deliver the website, keep it stable and protect it from attacks and misuse. The legal basis is Art. 6(1)(f) GDPR. My legitimate interest is the secure and error-free operation of the website. I keep no server log files of my own; Cloudflare stores the access data only as long as operation and security require. A data processing agreement under Art. 28 GDPR is in place with Cloudflare. Cloudflare may transfer data to the USA; Cloudflare, Inc. is certified under the EU-U.S. Data Privacy Framework and also relies on the European Commission’s standard contractual clauses. More: Cloudflare privacy policy.

3. Fonts

This website uses the typefaces Instrument Serif and Jost. The font files are hosted on this website’s own server and delivered together with the pages. No connection to Google or any other font provider is made to load them, and no data is transmitted to third parties for this purpose.

4. Booking via Calendly

The contact section at the end of every page embeds a Calendly booking page as an iframe. The provider is Calendly LLC, 115 E Main St, Ste A1B, Buford, GA 30518, USA.

The calendar loads only when you reach that part of the page. From then on, your browser connects to Calendly’s servers and transmits, among other things, your IP address and technical details. Calendly may use cookies or similar technologies. If you book an appointment, Calendly and I process the data you enter, such as your name, email address, chosen time and message.

The legal basis for the booking is Art. 6(1)(b) GDPR (pre-contractual measures). For embedding the calendar it is Art. 6(1)(f) GDPR. My legitimate interest is simple scheduling. Data may be transferred to the USA. Calendly LLC is certified under the EU-U.S. Data Privacy Framework and also relies on the European Commission’s standard contractual clauses (Art. 46(2)(c) GDPR). I delete appointment details once they are no longer needed to prepare or carry out a collaboration and no statutory retention obligations apply. More: Calendly privacy notice.

5. Contact by email and phone

When you email or call me, I process your contact details, that is your email address or phone number, and the content of your message. My mailbox is hosted by Google (Gmail), Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland; Google may also process email on servers in the USA (Google LLC is certified under the EU-U.S. Data Privacy Framework).

I use this data only to answer your request and to prepare a possible collaboration. The legal basis is Art. 6(1)(b) GDPR where your request aims at a contract, otherwise Art. 6(1)(f) GDPR. My legitimate interest is answering enquiries. I delete the data once the request is settled and no statutory retention obligations apply.

6. Contact form and spam protection (Cloudflare Turnstile)

The contact form at the end of every page lets you send me a message. You enter your name, your email address, if you like your brand or company, and your message. The form is received by a function on the Cloudflare network (see section 2) and delivered to my mailbox as an email; it is sent through Cloudflare from an address on this domain, with your email address as the reply-to address. Nothing is stored apart from that email; there is no database of enquiries.

The legal basis is Art. 6(1)(b) GDPR where your request aims at a contract, otherwise Art. 6(1)(f) GDPR (answering enquiries). I delete the message once the request is settled and no statutory retention obligations apply.

Cloudflare Turnstile. To protect the form from automated spam I use Cloudflare Turnstile, a service of Cloudflare, Inc. (address and transfer to the USA as in section 2). Turnstile checks in the background, without puzzles, whether the input comes from a person. For this, your IP address, technical details of your browser and device and interaction data are transmitted to Cloudflare and evaluated; Turnstile may store technically necessary information in your browser for this purpose. The Turnstile script is loaded only once the form becomes visible or you click into one of its fields. The legal basis is Art. 6(1)(f) GDPR; my legitimate interest is protecting the form from misuse. Where information is stored in your browser, it is strictly necessary for the sending you requested (§ 25(2) no. 2 TDDDG). More: Cloudflare privacy policy.

7. Newsletter and downloads (CleverReach)

Newsletter. At the end of every page you can subscribe to my newsletter with your email address: a few times a year, notes on creators, events and content in DACH.

Downloads. Some pages offer a guide or checklist as a download. To receive it, you enter your first name, your email address and, if you like, your brand, and you confirm that you want to receive the download and occasional notes on creators, events and content in DACH.

Provider and process. Both forms are processed by CleverReach, a service of CleverReach GmbH & Co. KG, Schafjückenweg 2, 26180 Rastede, Germany. The data is stored on servers in the EU; a data processing agreement under Art. 28 GDPR is in place with CleverReach. After you sign up, CleverReach sends you an email with a confirmation link (double opt-in). Only once you click that link is the subscription active and the download available. To be able to prove your consent, CleverReach stores the times of sign-up and confirmation and the IP address used. For downloads it also records which guide you requested.

Evaluation. The emails contain a tracking pixel and individualised links. This lets CleverReach evaluate whether and when an email was opened and which links were clicked. I use this only to see which topics are of interest; no advertising profiles are created.

Legal basis and withdrawal. The legal basis for sending and evaluation is your consent, Art. 6(1)(a) GDPR. You can withdraw it at any time with effect for the future, with the unsubscribe link in every email or by writing to me. Your data is then deleted from the recipient list; the email address stays on a block list so that it is not contacted again. More: CleverReach privacy notice.

8. Analytics, cookies and language setting

Google Analytics. This website uses Google Analytics 4, a web analytics service of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, only if you agree in the cookie notice. Without your consent no Google script is loaded and no cookie is set; you are asked once (Consent Mode v2, every storage type is denied by default). With your consent, Google Analytics uses cookies and similar technologies to record which pages you visit, which steps you take (for example a click on “book a call”, a booked call, a sent message or a newsletter sign-up) and technical details such as device, browser, approximate location and the page you came from. Google Analytics 4 does not store IP addresses. I send no user IDs and no personal data in events or URLs; Google Signals and advertising features are switched off. I use the reports to understand which pages lead to a call and to improve the website.

The legal basis is your consent, Art. 6(1)(a) GDPR and § 25(1) TDDDG. You can withdraw it at any time with effect for the future: change cookie settings. Google may transfer data to the USA; Google LLC is certified under the EU-U.S. Data Privacy Framework and Google also uses the European Commission’s standard contractual clauses. Analytics data is kept for 2 months. More: Google privacy policy and how Google uses data from partner sites. Your choice is stored in your browser’s local storage (nt_consent).

Language setting. If you choose a language with the switcher, the website remembers that choice in your browser’s local storage (localStorage) and in a small first-party cookie (nt_lang_en or nt_lang_de, stored for one year). The cookie is sent with later requests to this website only, so the server can open the start page in your language. It contains nothing but the language code and is not used for any other purpose. This is strictly necessary for the function you requested (§ 25(2) no. 2 TDDDG). You can delete both in your browser at any time.

9. Links to social networks

The links to LinkedIn and Instagram are plain links. No plugins are embedded and no data is transmitted before you click a link. After that, the privacy policy of the respective network applies.

10. Your rights

You have the right to:

• access to your stored data (Art. 15 GDPR)
• rectification of inaccurate data (Art. 16 GDPR)
• erasure (Art. 17 GDPR)
• restriction of processing (Art. 18 GDPR)
• data portability (Art. 20 GDPR)
• withdraw consent you have given, with effect for the future (Art. 7(3) GDPR)

Right to object. Where I process data on the basis of Art. 6(1)(f) GDPR, you can object at any time on grounds relating to your particular situation (Art. 21 GDPR).

You can also lodge a complaint with a data protection supervisory authority (Art. 77 GDPR). The authority responsible for me is the Berlin Commissioner for Data Protection and Freedom of Information (Berliner Beauftragte für Datenschutz und Informationsfreiheit), Alt-Moabit 59–61, 10555 Berlin.

No automated decision-making, including profiling, takes place.

11. Privacy contact

For any question about data protection or to exercise your rights, write to me at [email protected].

12. Changes

I update this privacy policy when the website or the services it uses change. The version published here applies.