Privacy notice

1. Controller

Christoph Mayer, trading as FrameShift Global Consulting, Heimbacher Gasse 17, App. 1, 74523 Schwäbisch Hall, Germany. Email: hello@f-shift.com.

No data protection officer has been appointed. The statutory thresholds in section 38 BDSG are not met.

2. Visiting the site

The site is hosted on Cloudflare Workers. Each request produces technical log data: the IP address in shortened form, the time, the page requested, the referrer, and the browser and operating system reported by your device. This data is needed to deliver the page and to defend against attacks. It is not used to identify you and is not combined with anything else.

Legal basis: Article 6(1)(f) GDPR. The legitimate interest is operating the site securely and reliably.

Retention: log data is kept for a short period and then deleted or aggregated.

3. Country detection

The edge server adds the two-letter country code of your request to the page so that the consent banner can present the correct default for your jurisdiction. No additional request is made, nothing is stored, and the country code is not retained after the page is rendered.

Legal basis: Article 6(1)(c) GDPR, since presenting the correct consent default is how we meet our own obligations.

4. Consent record

When you make a choice in the consent banner, that choice is stored in your own browser under the key "sw_consent_v1", using localStorage. It holds the decision, the time, the version of the tracking inventory it applies to, and the region default that was shown. It never leaves your device and it is not a cookie.

You can withdraw or change the decision at any time using the link in the footer, or by clearing site data in your browser.

Legal basis: Article 6(1)(c) GDPR. We are required to be able to demonstrate consent, and storing the record locally is the least intrusive way to do it.

5. Contact form and requests for the example

The form asks for your name and email address, which are required, and optionally your company, telephone number and message. If you arrived through a campaign link, the campaign parameters in the URL are sent with the form. Your country code is recorded with the submission.

We use this to answer you, and where you asked for it, to send you a link to the full worked example. That link is valid for fourteen days.

Legal basis: Article 6(1)(b) GDPR for steps taken at your request before entering a contract, and Article 6(1)(a) GDPR for the consent you give with the tick box.

Recipients: the submission is stored in a Cloudflare D1 database located in Western Europe, sent to us by email through Resend, and transferred to our GoHighLevel CRM.

Retention: enquiries are kept for as long as needed to deal with them and afterwards in line with statutory retention periods, which for commercial correspondence in Germany are generally six or ten years. You may ask for erasure at any time and we will erase whatever the law does not require us to keep.

6. Newsletter

The newsletter is a separate, optional choice. It is never a condition of receiving the example, the box is never pre-ticked, and declining it changes nothing else.

We record whether you granted or declined it and when, because we have to be able to demonstrate consent. Every email carries an unsubscribe link, and withdrawing consent is as easy as giving it.

Legal basis: Article 6(1)(a) GDPR.

7. Spam protection

The form is protected by Cloudflare Turnstile, which checks that a submission comes from a person rather than a script. Turnstile does not use cookies and does not track you across sites. It receives your IP address and limited technical signals from your browser in order to run that check.

We also apply a rate limit, which briefly holds your IP address and the email address you submitted so that the same sender cannot flood the form. These entries expire automatically after one hour.

Legal basis: Article 6(1)(f) GDPR. The legitimate interest is keeping the form usable and free of abuse.

8. Processors and transfers outside the EU

We use the following processors, each under a data processing agreement:

Cloudflare, for hosting, the lead database, the rate limit and Turnstile. The lead database is pinned to Western Europe.

Resend, to deliver the notification and the link to the example.

GoHighLevel, as the customer relationship system.

Resend and GoHighLevel are based in the United States, and Cloudflare is a United States company operating European infrastructure. Where personal data reaches the United States, the transfer is covered by the European Commission Standard Contractual Clauses under Article 46(2)(c) GDPR, together with supplementary measures. United States authorities may in principle be able to access data held by United States providers, and it is not possible to rule that out entirely. If that risk is unacceptable to you, write to us by post instead of using the form.

9. What we do not do

No analytics software runs on this site. No advertising pixels are loaded. Fonts are served from our own domain rather than from a font provider. The explainer videos play from our own server rather than from a video platform, so no platform learns that you watched one. There is no profiling and no automated decision-making within the meaning of Article 22 GDPR.

If that changes, this notice changes with it, and the consent banner will ask you again rather than assume your earlier answer still applies.

10. Your rights

You have the right to access your data (Article 15), to rectification (Article 16), to erasure (Article 17), to restriction of processing (Article 18), to data portability (Article 20), and to object to processing based on legitimate interests (Article 21). Where processing rests on consent, you may withdraw it at any time with effect for the future.

Write to hello@f-shift.com and we will answer within one month.

You also have the right to lodge a complaint with a supervisory authority. The competent authority for us is the State Commissioner for Data Protection and Freedom of Information of Baden-Württemberg, Lautenschlagerstraße 20, 70173 Stuttgart.

11. Changes

This notice is dated 26 July 2026. We update it when the processing changes, and the version of the tracking inventory recorded with your consent decision is what tells the banner whether to ask you again.