Privacy Statement#
Status: 27 October 2026. This statement describes how this website and my contact with you handle data. It is to be reviewed by a legal adviser (running: V17); several passages carry the marker VERIFY — these are open points, not asserted facts.
1. Controller#
DIP Dev Owner: Dmytro Prylutskyi "Entwicklung Digitaler Innovativer Produkte von Dmytro Prylutskyi" Dorfstraße 6, 85447 Grucking, Germany Phone: +49 156 79817895 E-mail: info@dipdev.de
I have not appointed a data protection officer — the role is not mandatory for my business.
2. Hosting of this website#
The website runs on a server of Contabo GmbH (locations Aschheim and Nuremberg, Germany). Contabo is a data processor for the operation of the server. VERIFY V10: whether the data processing agreement (DPA) with Contabo is already in place is currently being reviewed — an open point, not an asserted fact.
No access log is written. The website stores no IP addresses, no timestamps, no requested paths, no user agents and no referrers. What a page view leaves in memory in order to deliver the response is not persisted. VERIFY V3: whether the absence of an access log itself needs its own wording is to be clarified with the legal adviser.
Should a log ever be enabled, that happens only as an owner decision with a documented purpose, legal basis, rotation and deletion period (at most 7 days) — never as an analytics instrument.
3. Contact by e-mail, phone or WhatsApp#
There is no contact form on this website. You reach me by e-mail (info@dipdev.de), by phone (+49 156 79817895) or via WhatsApp (wa.me/+4915679817895).
- Data: what you send yourself — sender address, phone number, message content, attachments.
- Purpose: answering your enquiry, discussing and possibly carrying out a project.
- Legal basis: Art. 6(1)(b) GDPR (pre-contractual measures at your request); where no contract follows, Art. 6(1)(f) GDPR (my legitimate interest in handling your enquiry).
- Retention: enquiry data is deleted 12 months after the last contact, unless a running project requires longer retention (then under commercial and tax obligations).
- Recipients: for e-mail, the mail provider of my domain; for WhatsApp, WhatsApp Ireland Limited / Meta Platforms Ireland Limited as recipients in their own right — VERIFY V11 (legal basis of that channel and US aspect). If you prefer not to use that channel, the same enquiries reach me by e-mail or phone.
4. Consent management and analytics tools#
This website uses analytics tools — only after your consent (given via the banner). There is no claim here such as "this website uses no cookies" or "no tracking", because that would be false. Stated precisely:
4.1 The consent banner#
On your first visit the website shows a banner with three controls of equal
weight: "Accept all", "Reject all" and "Settings" (with separate switches for
statistics and marketing, both off by default). Your decision is stored
locally in your browser (key dipdev.consent in localStorage) — with a
timestamp and the policy version. No copy of that decision reaches a DIP Dev
server; there is no backend that could receive it.
You can change or withdraw your decision at any time via the footer link
"Cookie settings" (Art. 7(3) GDPR). Saving a narrower choice also deletes
the tools' earlier first-party storage (e.g. _ga, _fbp, Clarity storage)
as far as the page can reach it.
4.2 Google Tag Manager (container)#
The Google Tag Manager is the container in which the analytics tags are defined; it collects no data itself. Its loader script runs before your decision — that is the precondition for transmitting the default consent (denied) to the Google tag calls at all. Recipient: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland; onward Google LLC, USA.
4.3 Google Analytics 4 (statistics)#
After you consent to statistics, Google Analytics 4 measures page views,
events, sources, devices and approximate location. Cookies (e.g. _ga) are
set only after consent. Before your decision, Google tags may send
cookieless pings (Consent Mode "advanced"): requests without
analytics/advertising cookies and without a user-level identifier, carrying
the consent state in the gcs parameter. VERIFY V12: the lawfulness of
these pre-consent requests is the open legal point — they are described here
neither as "anonymous" nor as "no data transfer". Recipient: Google
Ireland Limited → Google LLC, USA. Third country: USA; the transfer rests
on the adequacy decision of the EU-US Data Privacy Framework where the entity
is certified, otherwise standard contractual clauses — VERIFY V13/V17.
Retention: VERIFY V14 — the period is read from the GA4 account
setting and named here only after that check.
4.4 Microsoft Clarity (statistics)#
After you consent to statistics, Microsoft Clarity records individual sessions (movement, clicks, scrolling) and builds heatmaps. VERIFY V15: recordings carry a separate hard review (they capture on-screen behaviour, masking of text on legal pages and in the contact area, sampling, retention period) — until then the retention period stays unnamed here. Recipient: Microsoft Ireland Operations Limited, Dublin; onward Microsoft Corporation, USA. Third country: USA, DPF or standard contractual clauses — VERIFY V13/V17.
4.5 Meta Pixel (marketing)#
After you consent to marketing, the Meta Pixel sets an identifier (_fbp)
and reports page views to Meta to attribute visits to Facebook/Instagram
campaigns. No advertising is run — the pixel measures attribution, it
does not advertise. Recipient: Meta Platforms Ireland Limited, Dublin;
onward Meta Platforms, Inc., USA. Third country: USA, DPF or standard
contractual clauses — VERIFY V13/V17.
4.6 LinkedIn Insight Tag (marketing)#
After you consent to marketing, the LinkedIn Insight Tag sets LinkedIn identifiers and reports page views to attribute visits to LinkedIn activity. Recipient: LinkedIn Ireland Unlimited Company, Dublin; onward LinkedIn Corporation, USA. Third country: USA, DPF or standard contractual clauses — VERIFY V13/V17.
4.7 Categories at a glance#
| Category | Tools | Default |
|---|---|---|
| Essential | consent management itself | always active, no switch |
| Statistics | Google Analytics 4, Microsoft Clarity | denied |
| Marketing | Meta Pixel, LinkedIn Insight Tag | denied |
5. Third countries#
The four analytics tools run through Irish companies with US parent corporations. For every transfer to the USA: the basis is the adequacy decision of the EU-US Data Privacy Framework if the respective entity is certified there; otherwise standard contractual clauses. VERIFY V13/V17: each company's certification is being checked and this section will be updated with the result — a blanket claim that "no transfers take place" does not hold here.
No other third countries: hosting (Contabo) is in Germany, e-mail runs over the EU-based provider of my own domain. VERIFY V10/V11 for the open contractual points.
6. Your rights#
You have the right of access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and objection (Art. 21). Consent given can be withdrawn at any time — most easily via the footer link "Cookie settings" (Art. 7(3) GDPR).
Direct requests to info@dipdev.de; I reply within one month.
Right to complain: you may lodge a complaint with the supervisory authority — for Bavaria the Bavarian State Office for Data Protection Supervision (BayLDA), Promenade 27, 91522 Ansbach, Germany.
7. Data security#
The website is reachable over TLS. Backups run automatically; the restore is verified regularly. Access to client data in projects happens through individual accounts with least privilege.
8. Changes to this statement#
When the tool inventory or the legal situation changes, this statement is updated here and the "status" date above is adjusted. The consent record in the banner carries its own policy version — a change to the tag list makes the banner ask again.