Privacy policy

Who is responsible

Vibrance Agency, owner Kilian Dickmann
Webersplatz 7, 90403 Nürnberg, Germany
contact@vibrance-agency.com

We have not appointed a data protection officer because we are not legally required to (Art. 37 GDPR, § 38 BDSG). If you have questions about data protection, write to the email address above.

The short version

• We use no cookies, no analytics tools and no advertising.
• The font is hosted on our own server. There is no connection to Google or any other font provider.
• The Cal.com calendar only loads once you switch it on yourself.
• We only use your enquiry to answer it. We do not sell data or pass it on for advertising.

Hosting and delivery

This website is hosted by Cloudflare, Inc. (USA) and delivered through its global network. On every request, Cloudflare automatically processes the data your browser sends along – IP address, date and time, the address requested, referrer URL, browser and operating system. This is technically necessary to deliver the page to you and serves security, for example fending off attacks.

For the contact form endpoint, Cloudflare keeps logs of requests on our behalf (time, address, technical details of the request and error messages) so we can track down faults. These logs do not contain the content of your message. They are deleted automatically after a few days.

The legal basis is Art. 6(1)(f) GDPR. Our legitimate interest is a secure, fast and reliable website. We do not analyse this data for any other purpose and do not combine it with other data.

We have a data processing agreement with Cloudflare under Art. 28 GDPR. Data may be transferred to the USA in the process. Cloudflare is certified under the EU-US Data Privacy Framework; the transfer is based on this adequacy decision (Art. 45 GDPR) and additionally on the EU Standard Contractual Clauses (Art. 46 GDPR). More in Cloudflare’s privacy policy.

Cookies and browser storage

We do not set cookies. If Cloudflare detects suspicious traffic, it may set a technically necessary security cookie to protect against attacks; the legal basis is then § 25(2) no. 2 TDDDG in conjunction with Art. 6(1)(f) GDPR.

Only if you switch on the calendar (see “Booking through Cal.com”) does your browser remember that choice in session storage (sessionStorage), so you do not have to make it again on every page. The entry never leaves your device and is gone as soon as you close the tab. The legal basis is § 25(2) no. 2 TDDDG, because storing it is strictly necessary for the service you asked for.

Fonts

The font of this website (Instrument Sans) is hosted on our own server and loaded from there. No connection is made to Google Fonts or any other font provider.

Audience measurement

We currently do not measure audience reach and use no analytics tools. If that changes, we will only use a solution without cookies and without user profiles, and we will update this policy beforehand.

Contact form

When you write to us through the form, we process the details you give: name, email address and message, and optionally company, phone number and current website, plus your choices for project type, budget and timeframe. On top of that come the language of the page, the address of the page you came from (without parameters) and the time you sent it.

We only use these details to answer your enquiry and prepare a quote. The legal basis is Art. 6(1)(b) GDPR (steps prior to entering into a contract), and for general questions Art. 6(1)(f) GDPR (our interest in answering enquiries). Where you gave your consent in the form, Art. 6(1)(a) GDPR is an additional legal basis; you can withdraw your consent at any time with effect for the future (Art. 7(3) GDPR).

To protect against spam, we check that a field invisible to people stays empty and that at least three seconds have passed since the page loaded. We also count the enquiries per IP address over the last ten minutes; more than three are not possible. For this, the IP address is held only briefly in working memory, never stored permanently and discarded once the ten minutes are up. The legal basis is Art. 6(1)(f) GDPR; our legitimate interest is a form free of abuse. We do not use a captcha.

Your enquiry reaches us by email, and you receive a confirmation at your address (see “Sending email through Resend”). We delete your enquiry once it has been dealt with and no project comes of it, or earlier if you ask us to. If it turns into a project, we keep the correspondence for as long as commercial and tax law requires (up to ten years, § 257 HGB, § 147 AO).

You are not obliged to give us any data. Without your name, email address and message, however, we cannot answer your enquiry.

Contact by email

If you write to us directly at contact@vibrance-agency.com, we process your email address and the content of your message in order to reply. Legal basis and deletion as for the contact form.

Our mailbox is hosted by Google Workspace (Google Cloud EMEA Limited, Dublin, Ireland). We have a data processing agreement with this provider under Art. 28 GDPR. Data may be transferred to the USA in the process. Google is certified under the EU-US Data Privacy Framework (Art. 45 GDPR); the EU Standard Contractual Clauses (Art. 46 GDPR) apply in addition.

Sending email through Resend

We send the emails from the contact form – the confirmation to you and the notification to us – through Resend (Resend, Inc., USA). For this, Resend processes your name, your email address and the content of your enquiry. The legal basis is Art. 6(1)(b) or (f) GDPR.

We have a data processing agreement with Resend under Art. 28 GDPR. Transfers to the USA are covered by the EU Standard Contractual Clauses (Art. 46 GDPR) and, where the provider is certified, the EU-US Data Privacy Framework (Art. 45 GDPR). More in Resend’s privacy policy.

Booking through Cal.com

On the contact page you can book an intro call. The calendar comes from Cal.com (Cal.com, Inc., USA) and only loads once you click “Load the calendar”. Until then, no connection to Cal.com is made.

By clicking, you consent to your browser loading the calendar from Cal.com’s servers. Cal.com then receives your IP address and technical details about your device and browser and may set its own technically necessary cookies. The legal basis is your consent (Art. 6(1)(a) GDPR, § 25(1) TDDDG). You can withdraw it at any time by closing the tab; after that, the calendar only loads after a new click.

If you book a slot, Cal.com processes the details you enter there on our behalf (name, email address, chosen time and an optional message) and sends you the confirmation with the link to the call. The legal basis is Art. 6(1)(b) GDPR. We delete the booking data once it is no longer needed for the call and any work that follows.

We have a data processing agreement with Cal.com under Art. 28 GDPR. Transfers to the USA are covered by the EU Standard Contractual Clauses (Art. 46 GDPR) and, where the provider is certified, the EU-US Data Privacy Framework (Art. 45 GDPR). More in Cal.com’s privacy policy.

Video call

We hold the intro call by video through Google Meet (Google Cloud EMEA Limited, Dublin, Ireland). This involves processing picture and sound, your display name and technical connection data. The legal basis is Art. 6(1)(b) GDPR. We do not record calls. Google Meet is part of Google Workspace; the data processing agreement and transfers to the USA are covered as described for our mailbox.

Recipients at a glance

Your data only goes to service providers who process it on our behalf:

• Cloudflare – hosting, delivery and security
• Resend – sending the emails from the contact form
• Cal.com – booking, only with your consent
• Google Workspace (Google Cloud EMEA Limited, Dublin, Ireland) – our mailbox
• Google Meet (Google Cloud EMEA Limited, Dublin, Ireland) – the video call

Data security

The connection to this website is encrypted with TLS, which you can tell by “https://” and the padlock in the address bar. We take technical and organisational measures under Art. 32 GDPR to protect your data against loss and unauthorised access.

Automated decisions

We make no automated decisions and create no profiles (Art. 22 GDPR).

Your rights

You have the right at any time to:

• access the data we process about you (Art. 15 GDPR)
• have incorrect data corrected (Art. 16 GDPR)
• have your data deleted (Art. 17 GDPR)
• restrict processing (Art. 18 GDPR)
• data portability (Art. 20 GDPR)
• withdraw your consent with effect for the future (Art. 7(3) GDPR)

Right to object

Where we process data on the basis of Art. 6(1)(f) GDPR, you may object at any time on grounds relating to your particular situation (Art. 21 GDPR). We will then no longer process the data unless we can demonstrate compelling legitimate grounds that override your interests, or the processing serves the establishment, exercise or defence of legal claims.

Right to complain to a supervisory authority

If you believe we are not processing your data lawfully, you can complain to a data protection supervisory authority (Art. 77 GDPR), in particular in the member state where you live or work or where the alleged infringement took place. The authority responsible for us is the one in the German federal state where we have our registered office.

Changes to this policy

We update this policy when the website or the law changes. The version published here applies.

Last updated

October 2026