Data Privacy

Last updated: October 2026

1. Controller

Franziska Böttcher
c/o Postflex #8550
Emsdettener Str. 10
48268 Greven
Germany

Phone: +49 151 70817152
Email: hello@franziskaboettcher.studio

2. General information

I take the protection of your personal data seriously. This privacy policy explains which personal data I process when you visit my website, for what purpose, on what legal basis and for how long. Personal data is any information that can identify you personally, such as your name, email address or IP address.

You are not obliged to provide me with personal data. Without certain information, however, I cannot process an enquiry or a booking. No automated decision-making, including profiling, takes place.

3. Hosting and server log files

This website is hosted by Squarespace. The provider is Squarespace Ireland Limited, Dublin, Ireland. When you visit my website, Squarespace automatically processes data transmitted by your browser. This includes your IP address, the date and time of access, the page visited, the previously visited page (referrer), browser type and operating system.

Squarespace processes this data on my behalf. A data processing agreement pursuant to Art. 28 GDPR is in place with Squarespace. Data may be transferred to Squarespace, Inc. in the USA. According to Squarespace, such transfers are based on appropriate safeguards under Art. 44 et seq. GDPR, for example the EU-US Data Privacy Framework or the EU Standard Contractual Clauses. Squarespace also processes some of this data as an independent controller in order to protect and improve its own platform and services.

This data is technically necessary to display the website and to ensure its stability and security. The legal basis is Art. 6(1)(f) GDPR. My legitimate interest lies in a secure and functional website.

The fonts used on this website are loaded from Squarespace servers. No connection to Google Fonts or Adobe Fonts is established.

4. Cookies and consent

My website uses cookies and similar technologies. These are small files or pieces of text that are stored on your device when you visit a website. For details on the individual cookies Squarespace uses, see Squarespace's overview.

Necessary cookies are required to operate the website and are always used. They enable Squarespace to provide this website securely and store, for example, your cookie choice or language setting. The legal basis is Section 25(2) No. 2 TDDDG in conjunction with Art. 6(1)(f) GDPR.

Analytics and performance cookies are only used with your consent (see section 5). The legal basis is Section 25(1) TDDDG in conjunction with Art. 6(1)(a) GDPR.

On your first visit, you can use the cookie banner to accept all cookies, reject all optional cookies or make individual choices. You can withdraw your consent at any time with effect for the future by changing your choice via the "Cookie Settings" button at the bottom left of the website.

5. Web analytics with Squarespace Analytics

If you consent in the cookie banner, I use Squarespace Analytics to understand how my website is used. The provider is Squarespace (see section 3). The following data is processed:

Information about your browser, network and device
Websites you accessed before visiting my website
Your IP address
This may also include details about how you use my website:
Clicks
Internal links
Pages visited
Scrolling
Searches
Timestamps

The legal basis is your consent under Art. 6(1)(a) GDPR and Section 25(1) TDDDG. No web analytics take place without your consent. You can withdraw your consent at any time via the cookie settings.

6. Website translation with Weglot

I use the service Weglot to translate my website. The provider is Weglot SAS, Paris, France. When you access a translated version of the website, a connection to Weglot's servers is established and your IP address is transmitted.

The legal basis is Art. 6(1)(f) GDPR. My legitimate interest lies in offering my website in several languages. Weglot processes this data on my behalf. A data processing agreement pursuant to Art. 28 GDPR is in place with Weglot.

7. Contact form

If you send me an enquiry via the contact form, I process the information you provide in order to respond and to assess whether and how I can support your project. Mandatory fields are your first and last name, company, role, email address, project description, timeline and budget range. Optionally, you can also provide your phone number and tell me how you heard about me.

The form is provided via Squarespace (see section 3). Your enquiry is then forwarded to my email inbox (see section 8).

The legal basis is Art. 6(1)(b) GDPR if your enquiry relates to a potential project. In all other cases, the legal basis is Art. 6(1)(f) GDPR. My legitimate interest lies in responding to your enquiry.

I delete your data once your enquiry has been fully dealt with, unless statutory retention obligations apply. If your enquiry leads to a contract, commercial and tax retention periods of up to ten years apply.

8. Contact by email

If you send me an email, I process your email address and the information in your message in order to reply. My email inbox is provided by STRATO GmbH, Berlin, Germany. STRATO processes this data on my behalf. A data processing agreement pursuant to Art. 28 GDPR is in place with STRATO.

The legal basis and storage period are the same as in section 7.

9. Appointment booking with Calendly

On my website, you can book appointments with me via an embedded booking tool, for example on my contact page. The provider is Calendly LLC, USA. When you open a page with the booking calendar, the calendar is loaded and your IP address is transmitted to Calendly. Calendly sets technically necessary cookies in the process. Optional cookies, for example for analytics or marketing purposes, are only set by Calendly if you consent in Calendly's own cookie notice.

When you book an appointment, Calendly processes the information you enter in the booking form, in particular your name, email address and the selected time slot. Depending on the type of appointment, further mandatory fields are added, for example details about your company and your project or, when you book a paid service, your billing address and VAT ID. If you add further participants, Calendly also processes their email addresses. Please inform these persons accordingly.

Booked appointments are automatically transferred to my calendar at Google (provider: Google Ireland Limited, Dublin, Ireland). Google processes this data in accordance with its own privacy policy.

The legal basis for booking an appointment is Art. 6(1)(b) GDPR, as it serves to prepare or perform a contract. The legal basis for loading the calendar is Art. 6(1)(f) GDPR. My legitimate interest lies in making it easy to schedule an appointment. The legal basis for optional Calendly cookies is your consent under Art. 6(1)(a) GDPR and Section 25(1) TDDDG.

Calendly processes this data on my behalf. A data processing agreement pursuant to Art. 28 GDPR is in place with Calendly. Calendly and Google may transfer data to the USA. According to the providers, such transfers are based on appropriate safeguards under Art. 44 et seq. GDPR, for example the EU-US Data Privacy Framework or the EU Standard Contractual Clauses.

I delete booking data once it is no longer needed for the appointment, unless the appointment leads to a contract.

10. Video calls with Google Meet and recordings with tl;dv

Booked appointments usually take place as video calls via Google Meet. The provider is Google Ireland Limited, Dublin, Ireland. When you take part, Google processes in particular your IP address, device and connection data, your name or the display name you enter, and audio and video during the call. Google processes this data in accordance with its own privacy policy. Google may transfer data to the USA. According to Google, such transfers are based on appropriate safeguards under Art. 44 et seq. GDPR. The legal basis is Art. 6(1)(b) GDPR. If you prefer to use a different video tool, you are welcome to send me your own link.

For some calls, for example The Brand & Packaging Review, I use the meeting assistant tl;dv. The provider is tldx Solutions GmbH, Aachen, Germany. I only record a call if all participants consent. If the call takes place via my link, tl;dv asks all invited participants for their consent before the call. Otherwise, I ask at the beginning of the call. Without everyone's consent, I do not record and take notes by hand. tl;dv creates a recording, a transcript and an AI-generated summary of the call, which I use as a basis for my own notes. The AI processing takes place in the EU. The legal basis for the recording is your consent under Art. 6(1)(a) GDPR, which you can withdraw at any time with effect for the future.

Because tl;dv is connected to my Google calendar, it also processes the details of my appointments, including the names and email addresses of invited participants. The legal basis is Art. 6(1)(f) GDPR. My legitimate interest lies in requesting consent to recordings in an organised way.

tl;dv processes this data on my behalf. A data processing agreement pursuant to Art. 28 GDPR is in place with tl;dv. I delete recordings and transcripts as soon as they are no longer needed for the project.

11. Links to external websites

My website contains links to external websites, for example to my profiles on LinkedIn, Instagram and Behance. These are plain links. No data is transmitted to these providers when you visit my website. Only when you click a link are you taken to the respective provider's website, where their privacy policy applies.

12. SSL/TLS encryption

For security reasons, this website uses SSL/TLS encryption. You can recognise an encrypted connection by "https://" in your browser's address bar and the padlock symbol.

Please note that data transmission over the internet, for example when communicating by email, may be subject to security vulnerabilities. Complete protection against access by third parties is not possible.

13. Objection to advertising

I hereby expressly object to the use of the contact details published in my imprint for sending unsolicited advertising and information material. This does not apply if I have given my prior written consent or if a business relationship already exists.

14. Your rights

You have the following rights regarding your personal data:

Access to the data I process about you (Art. 15 GDPR)
Rectification of inaccurate data (Art. 16 GDPR)
Erasure of your data (Art. 17 GDPR)
Restriction of processing (Art. 18 GDPR)
Data portability (Art. 20 GDPR)
Withdrawal of consent with effect for the future (Art. 7(3) GDPR)
Right to object (Art. 21 GDPR): Where I process your data on the basis of Art. 6(1)(f) GDPR, you may object to the processing at any time on grounds relating to your particular situation.

For any of these requests, simply email hello@franziskaboettcher.studio.

15. Right to lodge a complaint

You have the right to lodge a complaint with a data protection supervisory authority if you believe that the processing of your data violates the GDPR. The authority responsible for me is:

Bavarian State Office for Data Protection Supervision (BayLDA)
Promenade 18
91522 Ansbach, Germany
www.lda.bayern.de

16. Changes to this privacy policy

I update this privacy policy when my website, the services I use or the legal situation change. The current version on this page applies.

17. Waitlist for The DIY Brand Compass

You can sign up for the waitlist for The DIY Brand Compass on my website. The only mandatory field is your email address. I use it solely to let you know when The DIY Brand Compass becomes available.

After you sign up, you will receive an email asking you to confirm your sign-up (double opt-in). You will only be added to the waitlist once you have clicked the confirmation link. This ensures that nobody can sign up using someone else's email address. The date of your sign-up is stored in order to document your consent.

The waitlist and the related emails are managed via Squarespace Email Campaigns (see section 3). When I send you an email, Squarespace records whether it was opened and which links were clicked.

The legal basis is your consent under Art. 6(1)(a) GDPR. You can withdraw your consent at any time with effect for the future, either via the unsubscribe link in every email or by emailing me. The lawfulness of the processing carried out before your withdrawal remains unaffected.

I delete your email address once I have informed you about the launch of The DIY Brand Compass, or earlier if you unsubscribe.