Privacy

1. Controller

2. Hosting and technical delivery

This website is provided through Lovable. Technical access data may be processed to deliver the website and maintain its stability and security, and to prevent misuse. This may include the IP address, time of access, requested resource, browser or user agent, and error or log data.

Processing is based on Article 6(1)(f) GDPR. Data is retained only for as long as technically or security-related requirements make this necessary, or as required by law.

3. Contact by email

If you contact Jan Höck by email at office@janhoeck.com, the data you provide is processed to handle your enquiry. The email domain and email forwarding are operated through easyname.

Depending on the subject, the legal basis is Article 6(1)(b) GDPR for pre-contractual or contractual communication, or Article 6(1)(f) GDPR for other business communication. Data is retained until the enquiry has been resolved and thereafter only where applicable statutory retention periods or limitation periods require it.

4. Contact form and technical service providers

When you use the contact form, valid enquiries are stored server-side in a database provided by Supabase. The details may include your name, email address, company, topic, message, language, page path and submission timestamp. After successful storage, Resend sends an email notification. Supabase and Resend are technical service providers for handling your enquiry and delivering the notification.

The notification is sent from Website <forms@send.janhoeck.com>, with your email address as the Reply-To address. General enquiries notify office@janhoeck.com; ReportAct/NIS2 enquiries notify jan@reportact.com. Form contents are not sent to Google Analytics.

Depending on the content, the legal basis is Article 6(1)(b) GDPR for pre-contractual or contractual communication, or Article 6(1)(f) GDPR for other business enquiries. Data is retained only as long as necessary to handle the enquiry, plus any applicable statutory retention or limitation periods.

5. Google Analytics 4

This website uses Google Analytics 4 only after your explicit consent. The provider for users in the European Economic Area is Google Ireland Limited. The implementation processes page views, page path, language, CTA and click events, and UTM source, medium and campaign. Email addresses, form entries and free text are not sent to Google Analytics.

The legal basis is Article 6(1)(a) GDPR. You may withdraw your consent at any time through “Cookie settings” in the footer. According to Google, IP addresses from users in the EU are discarded before they are logged or stored.

6. Lovable Analytics

This website uses Lovable Analytics for aggregated audience measurement. Usage data such as visits and page views, approximate region, device type and traffic source may be processed. Lovable provides these reports in the protected project area. No visitor profiles are displayed on this website.

7. External links and ReportAct

This website contains links to reportact.com. When you follow one of these links, you leave this website and your browser connects directly to ReportAct. From that point, ReportAct’s privacy information applies. External links use a secure external-link configuration.

8. Cookies, local storage and consent

Necessary local browser storage is used to remember your choice regarding optional analytics services. Non-essential analytics services, in particular Google Analytics 4, are enabled only after your explicit consent. Once optional analytics services are active, you can change your choice at any time through “Cookie settings” in the footer or withdraw your consent with future effect.

9. Your rights

Subject to the applicable legal requirements, you have rights of access, rectification, erasure, restriction of processing and data portability where applicable. You may also object to processing and withdraw consent at any time with future effect. You have the right to lodge a complaint with a data protection supervisory authority.

10. Supervisory authority

11. No automated decision-making

This website does not use automated decision-making or profiling that produces legal or similarly significant effects.

12. Version

September 2026