Privacy

Privacy Policy

Last updated: 12 October 2026

1. Controller

The controller within the meaning of the General Data Protection Regulation (GDPR) is MacNorris GmbH, Winterhuder Weg 29, 22085 Hamburg, Germany, represented by its managing director Robert Cwicinski. Email: hi@macnorris.com, phone: +49 (0)40 74306588. Further details can be found in the imprint.

2. General information on data processing

We only process personal data to the extent necessary for our website and our services. The legal bases are your consent (Art. 6(1)(a) GDPR), performance of a contract or pre-contractual measures (point (b)) and legitimate interests (point (f)). We state the respective legal basis for each processing activity.

3. Hosting with Vercel

Our website is hosted by Vercel Inc., 340 S Lemon Ave #4133, Walnut, CA 91789, USA. Our serverless functions run in Frankfurt am Main, Germany (fra1). Static content is delivered through a global content delivery network, so technical access data may also pass through locations outside the EU. Transfers to the USA rely on the EU Commission's standard contractual clauses and/or Vercel's certification under the EU-US Data Privacy Framework. The legal basis is our legitimate interest in providing the website securely and quickly (Art. 6(1)(f) GDPR).

When you visit the website, the host automatically collects server log files: IP address, date and time of the request, page requested, amount of data transferred, browser and operating system type, and the referrer URL. We do not combine this data with other data sources and generally delete it after 30 days at the latest.

We deliver the video on our contact page ourselves through our host. No data is transmitted to third-party video platforms for this purpose.

4. Content management with Sanity

We manage our content with Sanity (Sanity AS, Norway). Images and media are loaded through the Sanity CDN, which technically transmits your IP address to Sanity. The legal basis is our legitimate interest in operating the website efficiently (Art. 6(1)(f) GDPR).

We set technically necessary storage without consent (Section 25(2) no. 2 TDDDG). This includes storing your cookie choice, which we manage with the consent tool c15t. We only set all other cookies and tracking technologies with your explicit consent (Section 25(1) TDDDG, Art. 6(1)(a) GDPR). You can withdraw your consent at any time in the cookie settings.

With your consent, we use Google Analytics 4 (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, and Google LLC, USA). The service is integrated directly into our website, we do not use a tag manager. Processed data includes shortened IP addresses, device and browser information, pages visited, time on page, clicks, scroll behaviour and referrers. The purpose is audience measurement and improving our website.

We use Google Consent Mode v2. Your choice in the cookie banner is passed to Google as a consent signal. Without your consent, Google Analytics does not set cookies and your usage behaviour is not analysed.

The legal basis is your consent (Art. 6(1)(a) GDPR, Section 25(1) TDDDG). Transfers to the USA rely on the EU-US Data Privacy Framework and/or standard contractual clauses. Data is stored for 14 months. You can withdraw your consent at any time in the cookie settings or use the browser add-on at tools.google.com/dlpage/gaoptout.

7. Contact, contact form and email

When you contact us, we process your details and the content of your message to answer your enquiry (Art. 6(1)(b) or (f) GDPR). We developed our contact form ourselves. Your input is processed on our own website infrastructure and forwarded to us internally by email. We do not use an external form service.

Our email, calendar and file management runs on Google Workspace (Google Ireland Limited). For automated emails, such as confirmations and notifications, we use Resend (Resend, Inc., USA). Both providers process data on our behalf. Transfers to the USA rely on standard contractual clauses and/or the EU-US Data Privacy Framework.

8. Appointment booking and contact management with HubSpot

For appointment booking and contact management, we use HubSpot (HubSpot Ireland Limited, Ireland). Data is hosted in the EU. We process your name, email address, requested appointment and the details you enter in the booking form, as well as the history of our communication. The legal basis is performance of pre-contractual measures and contracts (Art. 6(1)(b) GDPR) and our legitimate interest in efficient contact management (point (f)). HubSpot processes data on our behalf. Where access from the USA occurs, standard contractual clauses and/or the EU-US Data Privacy Framework apply.

9. Telephony and WhatsApp via Twilio

We use Twilio for telephony and WhatsApp. Telephony runs in the Ireland region (IE1), WhatsApp communication in the USA region (US1). We process phone number, connection data, time and, for WhatsApp, your message content and WhatsApp profile name. The purpose is to handle your enquiry (Art. 6(1)(b) or (f) GDPR). For WhatsApp, WhatsApp Ireland Limited (Meta) additionally processes data under its own privacy policy. Transfers to the USA rely on standard contractual clauses and/or the EU-US Data Privacy Framework.

Calls are not recorded unless you are asked for permission during the call flow and agree to the recording (Art. 6(1)(a) GDPR). You can withdraw this consent at any time with effect for the future.

We operate presences on YouTube (Google Ireland Limited) and Instagram (Meta Platforms Ireland Limited), including MacNorris TV and Sortiertes Chaos. When you visit these presences, the platforms process your data under their own privacy policies. For the statistics provided to us, we are partly jointly responsible with the platforms (Art. 26 GDPR). The legal basis is our legitimate interest in public relations (Art. 6(1)(f) GDPR). The imprint and this privacy policy also apply to these presences.

11. Recipients and processors

Vercel (hosting), Sanity (content management), Google (Workspace, Analytics), Resend (email delivery), HubSpot (appointment booking, contact management) and Twilio (telephony, WhatsApp), each to the extent described above. We also pass data to tax advisors and authorities where we are legally required to do so.

12. Storage period

We only store personal data for as long as necessary for the respective purpose. We delete enquiries once they are resolved and no retention obligation applies. We retain business letters for 6 years and accounting records for 8 years (Section 257 HGB, Section 147 AO).

13. Your rights

You have the right to access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and to object to processing based on legitimate interests (Art. 21). You can withdraw consent at any time (Art. 7(3) GDPR). Simply write to hi@macnorris.com.

14. Right to lodge a complaint with a supervisory authority

You can lodge a complaint with a data protection supervisory authority, in particular at your place of residence, your place of work or the place of the alleged infringement. The authority responsible for us is the Hamburg Commissioner for Data Protection and Freedom of Information.

15. Changes to this privacy policy

We update this policy when the legal situation or our offering changes. The current version applies.