Skip to main content

Privacy Policy

Last Updated: October 6, 2026

Thank you for your interest in our website. Protecting your personal data and privacy is very important to us. Below, we provide detailed information on how we handle your data in accordance with the General Data Protection Regulation (GDPR) and the Telecommunications-Telemedia Data Protection and Privacy Act (TDDDG).

1. Data Controller

The data controller responsible for the processing of personal data on this website within the meaning of Art. 4 No. 7 GDPR is:

LF Digital
Owner: Luca Hoffmann
Münsterstraße 4
48249 Dülmen
Germany

Email: info@naomijonhq.com
Telephone: +49 15565 829954

2. General Information and Mandatory Disclosures

Data Protection Principles
As the operator of this website, we take the security and confidentiality of your personal data seriously. We process your data exclusively in accordance with statutory data protection provisions and this Privacy Policy.

SSL/TLS Encryption
For security reasons and to protect the transmission of confidential content—such as inquiries submitted through our contact form or newsletter subscriptions—this site uses HTTPS/TLS encryption. You can recognize an encrypted connection by the https:// prefix in your browser’s address bar and the lock icon displayed next to the URL.

3. Data Collection and Technical Operation

a) Hosting via Vercel
We host this website using the cloud platform provided by Vercel Inc., 340 Pine Street, Suite 900, San Francisco, CA 94104, USA.

Whenever you access our website, Vercel automatically collects and processes technical log data necessary to deliver, secure, and stabilize the site. This technical telemetry may include:

  • IP address
  • Date and time of access
  • Browser type and version
  • Operating system used
  • Requested URL/resource
  • HTTP status code and referrer URL

Legal basis: The processing is carried out pursuant to Art. 6 (1) lit. f GDPR, based on our legitimate interest in providing a fast, stable, and secure website.

International transfers: We have concluded a Data Processing Addendum (DPA) with Vercel incorporating the EU Standard Contractual Clauses (SCCs). Vercel Inc. is certified under the EU-U.S. Data Privacy Framework (DPF), ensuring an adequate level of data protection under Art. 45 GDPR.

For further details, consult Vercel’s Privacy Policy: https://vercel.com/legal/privacy-policy

b) Contact Form and Email Delivery (Resend)
When you submit an inquiry through our contact form, we process the information you enter (name, email address, subject, and message content) to handle, answer, and document your request. Upon submission, an automated confirmation email is sent to your address to acknowledge receipt.

For the backend technical processing and delivery of emails, we use Resend, operated by Plus Five Five, Inc. (Resend), 2261 Market Street #5039, San Francisco, CA 94114, USA.

Legal basis:

  • The primary legal basis for managing inquiries is our legitimate interest in maintaining effective and responsive communication with users pursuant to Art. 6 (1) lit. f GDPR.
  • If your inquiry aims at concluding a contract or relates to the performance of existing contractual obligations, processing is additionally based on Art. 6 (1) lit. b GDPR.

Data retention: The data submitted in the contact form will remain stored with us until the purpose for data storage no longer applies (e.g., your inquiry has been conclusively resolved) or you request its erasure, unless mandatory statutory retention periods (such as commercial or tax retention obligations) require longer storage.

International transfers: We have concluded a Data Processing Addendum with Resend that includes the EU Standard Contractual Clauses. Plus Five Five, Inc. participates in the EU-U.S. Data Privacy Framework.

For more information, see Resend’s Privacy Policy: https://resend.com/legal/privacy

c) Bot and Spam Protection (Cloudflare Turnstile)
To protect our contact forms and web infrastructure against automated spam, brute-force attacks, and malicious bot activity, we use Cloudflare Turnstile, provided by Cloudflare, Inc., 101 Townsend St, San Francisco, CA 94107, USA.

Turnstile evaluates device and browser signals (such as HTTP request headers, IP address, TLS fingerprinting, and non-intrusive browser telemetry) to determine whether a submission originates from a legitimate human user or an automated script, without requiring visual puzzles or CAPTCHAs. Turnstile does not access or store the contents of your form inputs.

Legal basis: Processing is based on our legitimate interest pursuant to Art. 6 (1) lit. f GDPR in safeguarding our web infrastructure, maintaining system availability, and preventing spam.

International transfers: Data may be processed on Cloudflare servers in the United States. Cloudflare, Inc. is certified under the EU-U.S. Data Privacy Framework and adheres to the EU Standard Contractual Clauses.

For more information, consult Cloudflare’s Privacy Policy: https://www.cloudflare.com/privacypolicy/

d) Browser Local Storage (localStorage)
Our website uses your browser's local storage feature (localStorage) solely for technically necessary UI state persistence pursuant to Section 25 (2) No. 2 TDDDG and Art. 6 (1) lit. f GDPR.

Specifically, local storage stores a boolean flag to record when you dismiss specific modal overlays (such as the newsletter signup prompt or the "Buy Me a Coffee" banner), ensuring that you are not repeatedly interrupted by the same dialog during return visits.

No personal identifiers, IP addresses, or cross-site tracking markers are written to local storage.

Local storage data is stored locally on your device and is never transmitted to our servers or shared with third parties.

4. Analytics and Observability (PostHog EU Cloud)

To statistically evaluate site performance, understand user interactions, and detect client-side runtime errors, we use PostHog, provided by PostHog Inc., 2261 Market Street #4008, San Francisco, CA 94114, USA.

We exclusively utilize PostHog’s European Cloud infrastructure (https://eu.i.posthog.com). All analytics data is ingested, processed, and stored on servers located within the European Union (Frankfurt, Germany).

PostHog collects aggregated usage and interaction metrics, including:

  • Page views, navigation paths, and button clicks
  • Referral sources and conversion events (such as contact form submissions or newsletter signups)
  • Device metadata (screen resolution, browser engine, operating system)
  • Application diagnostic logs and runtime error traces to facilitate debugging

Legal basis: Processing analytics data and setting any associated client-side cookies or storage keys takes place strictly on the basis of your explicit consent pursuant to Art. 6 (1) lit. a GDPR and Section 25 (1) TDDDG.

Consent management: You can grant, refuse, or adjust your consent choices at any time by clicking the "Cookie Settings" link in the footer of our website. Refusing or withdrawing consent will not restrict your access to core website features.

International transfers: We have concluded a Data Processing Addendum with PostHog Inc. In cases where administrative access from outside the EEA occurs, transfers are protected under the EU-U.S. Data Privacy Framework and the EU Standard Contractual Clauses.

For more information, visit PostHog’s Privacy Policy: https://posthog.com/privacy

5. Newsletter Service (Klaviyo)

Subscription and Double Opt-In
If you subscribe to our newsletter, we process the information you provide (your email address and, optionally, your first name) to send you regular updates and address you personally.

We administer and distribute our newsletter using Klaviyo, provided by Klaviyo, Inc., 125 Summer St, Floor 6, Boston, MA 02111, USA.

Registration operates via a verified double opt-in process:

  • After submitting the subscription form, you receive a verification email containing a confirmation link.
  • Your subscription only becomes active once you click this link.

To fulfill statutory proof of consent obligations under Art. 7 (1) GDPR, we log the timestamp of registration, the confirmation timestamp, and the IP address used during the opt-in process.

Newsletter Performance Tracking
Our newsletter emails may contain technical web beacons (1x1 tracking pixels) and tracked links to measure campaign delivery, open rates, and user interactions.

  • Tracking scope: We record whether and when an email was opened and which links were clicked. This aggregated evaluation helps us tailor our content to subscriber interests.
  • Consent & Opt-Out: Newsletter tracking is activated only with your consent as part of your newsletter opt-in pursuant to Art. 6 (1) lit. a GDPR. If you do not wish for your engagement to be analyzed, you can withdraw your newsletter consent at any time.

Legal basis: The sending of the newsletter, the recording of subscriber consent, and performance tracking are based exclusively on your consent pursuant to Art. 6 (1) lit. a GDPR.

Withdrawal / Unsubscribe: You can revoke your consent at any time with effect for the future by clicking the "Unsubscribe" link included in every newsletter footer, or by sending a short request to info@naomijonhq.com. The revocation of consent does not affect the legality of processing carried out prior to the revocation.

International transfers: Klaviyo processes data in the United States. We have executed a Data Processing Addendum incorporating the EU Standard Contractual Clauses, and Klaviyo, Inc. is certified under the EU-U.S. Data Privacy Framework.

For more information, see Klaviyo’s Privacy Policy: https://www.klaviyo.com/privacy

6. Your Rights as a Data Subject

Under the GDPR, you have the following rights regarding personal data concerning you:

  • Right of Access (Art. 15 GDPR): You can request confirmation as to whether we process personal data concerning you and receive clear information regarding the processing purposes, categories of data, and recipients.
  • Right to Rectification (Art. 16 GDPR): You have the right to request the immediate correction of inaccurate personal data or the completion of incomplete data.
  • Right to Erasure (Art. 17 GDPR): You may request the deletion of your personal data stored by us, provided no statutory retention obligations or legal defense requirements preclude deletion.
  • Right to Restriction of Processing (Art. 18 GDPR): You have the right to demand the restriction of processing of your data under the conditions set out in Art. 18 GDPR.
  • Right to Data Portability (Art. 20 GDPR): You have the right to receive personal data you provided to us in a structured, common, and machine-readable format or to request its transfer to another controller.
  • Right to Withdraw Consent (Art. 7 (3) GDPR): Where data processing is based on your consent, you may withdraw that consent at any time with effect for the future without affecting the lawfulness of processing carried out prior to withdrawal.
  • Right to Lodge a Complaint (Art. 77 GDPR): If you consider that the processing of your personal data infringes data protection law, you have the right to lodge a formal complaint with a competent data protection supervisory authority.

The supervisory authority competent for our registered office is:
Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen (LDI NRW)
Kavalleriestraße 2–4
40213 Düsseldorf
Germany
Website: https://www.ldi.nrw.de

To exercise any of these rights, you may contact us at any time using the contact details provided in Section 1.

7. Right to Object (Art. 21 GDPR)

Information on your right to object under Art. 21 GDPR

If we process your personal data on the basis of legitimate interests pursuant to Art. 6 (1) sentence 1 lit. f GDPR, you have the right under Art. 21 GDPR to object at any time to the processing of your personal data on grounds relating to your particular situation.

If you object, we will no longer process your personal data unless we can demonstrate compelling legitimate grounds for the processing that override your interests, rights, and freedoms, or the processing serves the establishment, exercise, or defense of legal claims.

Where personal data is processed for direct marketing purposes, you have the right to object at any time without giving reasons. Upon objection, the personal data will no longer be processed for such purposes.

To exercise your right to object, an informal email is sufficient: info@naomijonhq.com