Privacy notice
Last updated: September 2026
The German text is the legally binding version. This translation is provided for information only.
Data controller
Responsible for the processing of data on this website:
Bilgen Pehlivan
Bugenhagenstraße 37
51061 Köln
Phone: 0174 3292003
Email: [email protected]
No data protection officer has been appointed, as the legal requirements for one are not met.
Principles and legal bases
I process personal data only as far as it is necessary to operate this website and to answer your enquiries. Depending on the case, the legal bases are your consent (Art. 6 (1) (a) GDPR, together with § 25 (1) TDDDG), the initiation or performance of a contract (Art. 6 (1) (b) GDPR), and my legitimate interest in a secure and functioning service (Art. 6 (1) (f) GDPR).
Visiting the website, hosting and server logs
When this website is accessed, your browser transmits technically necessary data to the server: IP address, date and time of access, the address requested, the transfer status, the volume of data transferred, the previously visited page, and browser and operating system details. These data are required to deliver the page and serve the security and stability of the service.
The server is operated by netcup GmbH, Daimlerstraße 25, 76185 Karlsruhe, Germany. The server location is in Germany. A data processing agreement under Art. 28 GDPR is in place with netcup.
The legal basis is Art. 6 (1) (f) GDPR. Log files are deleted or anonymised after 30 days at the latest.
Content delivery network and security (Cloudflare)
This website is delivered through Cloudflare Germany GmbH, Rosental 7, 80331 Munich, a subsidiary of Cloudflare, Inc., based in the USA. Cloudflare speeds up delivery, filters automated attacks and provides the encryption of the connection. Connection data including your IP address are processed in the course of this.
The legal basis is my legitimate interest in a secure and readily available service (Art. 6 (1) (f) GDPR). A data processing agreement is in place with Cloudflare. For transfers to the USA, Cloudflare relies on the European Commission's standard contractual clauses and is certified under the EU-US Data Privacy Framework.
Consent and cookies
No consent is required to operate this website. Only the reach measurement is loaded after you have agreed in the consent window; until then nothing of it is loaded and nothing is stored.
This is controlled through the server-side tag manager Cloudflare Zaraz. Your decision is stored in a cookie named cf_consent so that I do not have to ask you again on every visit. This cookie is strictly necessary for the service you explicitly requested within the meaning of § 25 (2) no. 2 TDDDG and is deleted after twelve months.
You can change or withdraw your decision at any time through the Cookie settings link at the bottom of every page. A withdrawal takes effect for the future and does not affect the lawfulness of processing carried out up to that point.
Reach measurement with Google Analytics 4
With your consent I use Google Analytics 4, a service provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. It records which pages are opened, how long they are viewed and which source visitors came from.
Google Analytics is loaded exclusively through Cloudflare Zaraz. The setting Hide Originating IP Address is enabled: your IP address is not transmitted to Google. A pseudonymous identifier is stored for recognition; your name or email address are not processed. The data are deleted after 14 months at the latest.
The legal basis is your consent under Art. 6 (1) (a) GDPR together with § 25 (1) TDDDG. A transfer to the USA is possible; Google LLC is certified under the EU-US Data Privacy Framework. You can switch the measurement off at any time through the cookie settings at the bottom of the page.
Contact form, email and telephone
If you write to me through the form, I process the details you provide: name, email address, optionally your organisation, the type of your enquiry and the text of your message. The same applies accordingly if you send me an email or call.
The legal basis is Art. 6 (1) (b) GDPR where your enquiry is aimed at a contract, otherwise my legitimate interest in answering enquiries under Art. 6 (1) (f) GDPR. I use your details solely to handle the enquiry and do not pass them on. I delete them as soon as they are no longer required and no statutory retention obligation applies; where there is a commercial context, the retention periods of six to ten years under § 257 HGB and § 147 AO apply.
The form message is sent and received through the mailbox [email protected]. This mailbox runs on Google Workspace, a service provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Your details are processed in the course of this and stored in the mailbox for the duration of the correspondence. A data processing agreement under Art. 28 GDPR is in place with Google. A transfer to the USA is possible; Google LLC is certified under the EU-US Data Privacy Framework.
Your enquiry is additionally stored in the website's database, so that it is not lost should the email delivery fail technically, and so that Bilgen Pehlivan can find it again in the website's admin area. The database is operated by netcup GmbH in Germany. The same details listed above are stored; your IP address is not among them. The enquiry is deleted there once it has been dealt with.
The form is protected against automated requests by Cloudflare Turnstile. Your IP address and technical details about your browser and device are transmitted to Cloudflare and evaluated there to determine whether the request comes from a human. Turnstile sets no advertising identifiers and does not evaluate your behaviour across websites.
The legal basis is my legitimate interest in protecting the form from misuse (Art. 6 (1) (f) GDPR). The check is strictly necessary for the service you requested within the meaning of § 25 (2) no. 2 TDDDG and therefore requires no separate consent. In addition I use a hidden form field and a server-side limit on requests per hour; for this your IP address is held briefly in memory and is not stored permanently.
Fonts
The fonts used, Source Sans 3 and Source Serif 4, are downloaded when the site is built and served from this website's own server. No connection to Google servers is made when the page loads and no data are transmitted to Google.
Browser storage
The text size you choose is stored locally in your browser so that the setting is kept for your next visit. This information does not leave your device and is not transmitted to me.
Linked services
This website embeds no social network content. The references to Instagram, Facebook, TikTok and YouTube are plain links. Data are transmitted to the respective provider only once you click; from that point the provider is responsible.
Your rights
You have the right of access to the data stored about you (Art. 15 GDPR), to rectification (Art. 16 GDPR), to erasure (Art. 17 GDPR), to restriction of processing (Art. 18 GDPR), to data portability (Art. 20 GDPR) and to object to processing based on legitimate interest (Art. 21 GDPR). You can withdraw consent at any time with effect for the future.
Please contact the details above; no particular form is required.
Right to lodge a complaint
You have the right to lodge a complaint with a data protection supervisory authority about the processing of your data (Art. 77 GDPR). The competent authority is the State Commissioner for Data Protection and Freedom of Information of North Rhine-Westphalia, Kavalleriestraße 2-4, 40213 Düsseldorf, Germany.