PRIVACY POLICY
Data Controller
The controller responsible for data processing on this website within the meaning of the General Data Protection Regulation (GDPR) is:
>
Lazy snail GmbH
Ackerstraße 19
10115 Berlin
Germany
Ackerstraße 19
10115 Berlin
Germany
>
Managing Director:
Jannik Baggesen Weylandt
Jannik Baggesen Weylandt
>
Commercial Register: HRB 285204 B, Amtsgericht Charlottenburg (Berlin)
>
Lazy snail GmbH is not required to appoint a Data Protection Officer under applicable law.
General Information on Data Processing
This privacy policy applies to the website www.lazysnail.design. We only process personal data of our users to the extent necessary to provide a functional website and our content and services. Personal data is generally only processed with the user’s consent, unless processing is permitted by law.
Legal Bases for Data Processing
Where we obtain consent for processing personal data, the legal basis is Art. 6(1)(a) GDPR.
Where processing is necessary to comply with a legal obligation, the legal basis is Art. 6(1)(c) GDPR.
Where processing is necessary for a legitimate interest of our company or a third party, and the interests, fundamental rights and freedoms of the data subject do not override that interest, the legal basis is Art. 6(1)(f) GDPR.
Where processing is necessary to comply with a legal obligation, the legal basis is Art. 6(1)(c) GDPR.
Where processing is necessary for a legitimate interest of our company or a third party, and the interests, fundamental rights and freedoms of the data subject do not override that interest, the legal basis is Art. 6(1)(f) GDPR.
Hosting and Content Delivery
About Webflow
>
Our website is hosted on the Webflow platform. The provider is Webflow, Inc., 398 11th Street, 2nd Floor, San Francisco, CA 94103, USA.
>
When you visit our website, your personal data is processed on Webflow’s servers. This may include your IP address, browser type, operating system, pages visited, and the date and time of access.
>
Legal basis: Art. 6(1)(f) GDPR. Our legitimate interest is the reliable and secure provision of our website.
>
Third-country transfer: Webflow processes data in the USA. The transfer is based on the EU-US Data Privacy Framework (DPF), where Webflow is certified, and/or Standard Contractual Clauses (Art. 46(2)(c) GDPR).
More information: https://webflow.com/legal/privacy
Content Delivery Network (CDN)
Webflow uses a Content Delivery Network (Amazon CloudFront) to deliver website assets (images, stylesheets, scripts). Your IP address is transmitted to CDN servers in this process.
Legal basis: Art. 6(1)(f) GDPR.
Legal basis: Art. 6(1)(f) GDPR.
Browser Storage
What Are Cookies?
Cookies are small text files stored on your device by your browser when you visit a website. They are used to enable certain features or to store information about your usage behaviour.
Consent Management (§ 25 TTDSG, Art. 6(1)(a) GDPR)
Our website does not use a cookie consent banner. No analytics or advertising cookies are set. The only consent mechanism in place is the Vimeo video consent gate (see "Embedded Content" below).
The only data stored in your browser is:
>
lsd_vimeo_ok (localStorage) — set when you click "Enable Video · via Vimeo". Records that you have consented to loading Vimeo videos. Not a cookie. Can be cleared by clearing your browser's site data for lazysnail.design.
Technically Necessary Data
Without your consent, no analytics or advertising cookies are set. The storage of your consent decision in localStorage is permitted under § 25(2)(2) TTDSG as it is technically necessary.
Analytics
Plausible Analytics
We use Plausible Analytics to understand how visitors use our website. The provider is Plausible Insights OÜ, Västriku tn 2, 50403 Tartu, Estonia.Plausible is a cookieless, privacy-friendly analytics tool. It does not use cookies, does not collect personal data, and does not track visitors across websites or devices. No consent is required under §25 TTDSG or Art. 6(1)(a) GDPR for this reason.
Data processed: page views, referral source, country (country-level only, derived from IP address — IP address itself is not stored), browser type and operating system (aggregated), device type. No individual-level data is retained.
Legal basis: Art. 6(1)(f) GDPR.
Our legitimate interest is understanding aggregate website usage to improve our services.
Third-country transfer: none.
All data is processed and stored on servers in the EU (Hetzner, Germany).
More information: https://plausible.io/data-policy
Legal basis: Art. 6(1)(f) GDPR.
Our legitimate interest is understanding aggregate website usage to improve our services.
Third-country transfer: none.
All data is processed and stored on servers in the EU (Hetzner, Germany).
More information: https://plausible.io/data-policy
Embedded Content
About Vimeo
Our website embeds videos from Vimeo. The provider is Vimeo, Inc., 555 West 18th Street, New York, New York 10011, USA.
When you visit a page containing an embedded Vimeo video, a connection is established to Vimeo’s servers. Your IP address is transmitted to Vimeo in this process.
When you visit a page containing an embedded Vimeo video, a connection is established to Vimeo’s servers. Your IP address is transmitted to Vimeo in this process.
>
Consent gateVimeo videos on our website are not loaded automatically. A placeholder with an "Enable Video · via Vimeo" button is shown instead. Vimeo only loads after you click this button. Your consent is stored in your browser's localStorage (key: lsd_vimeo_ok) so you are not asked again on subsequent visits.
>
Legal basisArt. 6(1)(a) GDPR (your consent). You can withdraw consent at any time by clearing your browser's site data for lazysnail.design.
>
Third-country transfer Vimeo processes data in the USA. The transfer is based on Standard Contractual Clauses.
More information: https://vimeo.com/privacy
Server Log Files
The hosting provider (Webflow) automatically collects and stores information in server log files that your browser transmits automatically. These include:
>
Browser type and version
>
Operating system
>
Referrer URL
>
IP address of the accessing device
>
Time of the server request
This data cannot be attributed to specific individuals. This data is not combined with other data sources.Legal basis: Art. 6(1)(f) GDPR (legitimate interest in ensuring error-free operation of the website).
Contact Form
We operate a contact form on our website (/contact-us). The following data may be submitted: full name, email address, company/brand (optional), country (optional), enquiry category, message, and optionally your consent to marketing communications. This data is processed solely to respond to your enquiry and will not be shared with third parties. Data is stored and processed by Webflow, Inc. as part of our website infrastructure (see "Hosting and Content Delivery" above).
Legal basis: Art. 6(1)(a) GDPR (your consent, given via the privacy checkbox) and/or Art. 6(1)(b) GDPR (pre-contractual measures).
You may request deletion of your form submission data at any time by emailing privacy@lazysnail.design.
Legal basis: Art. 6(1)(a) GDPR (your consent, given via the privacy checkbox) and/or Art. 6(1)(b) GDPR (pre-contractual measures).
You may request deletion of your form submission data at any time by emailing privacy@lazysnail.design.
Unsolicited Applications
Via our application form (/unsolicited-application) we process the data you submit (name, email, phone, position, message, portfolio, LinkedIn) to review and respond to your enquiry.
Legal basis: Art. 6(1)(f) GDPR — Legitimate Interest. You may object at any time: privacy@lazysnail.design
If you ticked the optional "keep on file" checkbox, the basis for that extended retention is Art. 6(1)(a) GDPR (consent), which you may withdraw at any time by emailing us.
Your submission is processed via Make.com, stored in ClickUp, and protected by Cloudflare Turnstile — see Third-Party Processors below.
Retention: 3 months from receipt; 12 months if "keep on file" consent was given. Deletion requests: privacy@lazysnail.design.
Legal basis: Art. 6(1)(f) GDPR — Legitimate Interest. You may object at any time: privacy@lazysnail.design
If you ticked the optional "keep on file" checkbox, the basis for that extended retention is Art. 6(1)(a) GDPR (consent), which you may withdraw at any time by emailing us.
Your submission is processed via Make.com, stored in ClickUp, and protected by Cloudflare Turnstile — see Third-Party Processors below.
Retention: 3 months from receipt; 12 months if "keep on file" consent was given. Deletion requests: privacy@lazysnail.design.
Contact by Email
If you contact us by email, the data you provide (email address, name if applicable, and content of the message) will be stored by us for the purpose of processing your enquiry.
Legal basis: Art. 6(1)(f) GDPR (legitimate interest in responding to enquiries) or Art. 6(1)(b) GDPR (pre-contractual measures).
Legal basis: Art. 6(1)(f) GDPR (legitimate interest in responding to enquiries) or Art. 6(1)(b) GDPR (pre-contractual measures).
Third-Party Service Providers
When you submit the contact form or unsolicited application form on this website, your data passes through the following service providers, each acting as a data processor under Art. 28 GDPR:
Cloudflare Turnstile
We use Cloudflare Turnstile (Cloudflare, Inc., 101 Townsend St, San Francisco, CA 94107, USA) as a spam and bot-protection tool on our contact form. When you load the contact page, Turnstile processes your IP address and browser characteristics (such as timing patterns and interaction signals) to verify that you are a human user. No personal data is stored beyond the duration of the challenge. Cloudflare operates a global CDN with data centres in the EU. Legal basis: Art. 6(1)(f) GDPR — legitimate interests in protecting our systems from automated abuse. Cloudflare's privacy policy: cloudflare.com/privacypolicy/
Make.com
Contact form submissions are routed to our internal task management system via Make.com (Celonis SE / Make, Rybná 716/24, 110 00 Prague, Czech Republic), an automation platform. Make.com receives all fields you submit in the contact form (name, email address, company, country, enquiry type, and message) and passes them to ClickUp. We use Make.com's EU-region infrastructure (EU1 endpoint). Execution logs are retained for a maximum of 30 days. Legal basis: Art. 6(1)(f) GDPR — legitimate interests in efficiently managing incoming business enquiries. Make.com's privacy policy: make.com/en/privacy-notice
ClickUp
We store contact form enquiries as tasks in ClickUp (Mango Technologies, Inc. d/b/a ClickUp, 350 Crenshaw Blvd, Torrance, CA 90503, USA). The following fields are stored: name, email address, company, country, enquiry type, and message. ClickUp processes data in the United States under standard contractual clauses (Art. 46(2)(c) GDPR). Data is retained for as long as it is relevant to the business relationship, after which it is deleted. Legal basis: Art. 6(1)(f) GDPR — legitimate interests in managing client relationships. ClickUp's privacy policy: clickup.com/privacy
Cloudflare Turnstile
We use Cloudflare Turnstile (Cloudflare, Inc., 101 Townsend St, San Francisco, CA 94107, USA) as a spam and bot-protection tool on our contact form. When you load the contact page, Turnstile processes your IP address and browser characteristics (such as timing patterns and interaction signals) to verify that you are a human user. No personal data is stored beyond the duration of the challenge. Cloudflare operates a global CDN with data centres in the EU. Legal basis: Art. 6(1)(f) GDPR — legitimate interests in protecting our systems from automated abuse. Cloudflare's privacy policy: cloudflare.com/privacypolicy/
Make.com
Contact form submissions are routed to our internal task management system via Make.com (Celonis SE / Make, Rybná 716/24, 110 00 Prague, Czech Republic), an automation platform. Make.com receives all fields you submit in the contact form (name, email address, company, country, enquiry type, and message) and passes them to ClickUp. We use Make.com's EU-region infrastructure (EU1 endpoint). Execution logs are retained for a maximum of 30 days. Legal basis: Art. 6(1)(f) GDPR — legitimate interests in efficiently managing incoming business enquiries. Make.com's privacy policy: make.com/en/privacy-notice
ClickUp
We store contact form enquiries as tasks in ClickUp (Mango Technologies, Inc. d/b/a ClickUp, 350 Crenshaw Blvd, Torrance, CA 90503, USA). The following fields are stored: name, email address, company, country, enquiry type, and message. ClickUp processes data in the United States under standard contractual clauses (Art. 46(2)(c) GDPR). Data is retained for as long as it is relevant to the business relationship, after which it is deleted. Legal basis: Art. 6(1)(f) GDPR — legitimate interests in managing client relationships. ClickUp's privacy policy: clickup.com/privacy
Your Rights as a Data Subject
You have the following rights with regard to your personal data:
>
Right of access (Art. 15 GDPR): You have the right to request information about your personal data processed by us.
>
Right to rectification (Art. 16 GDPR): You have the right to request correction of inaccurate data.
>
Right to erasure (Art. 17 GDPR): You have the right to request deletion of your data, provided the legal requirements are met.
>
Right to restriction of processing (Art. 18 GDPR): You have the right to request restriction of processing.
>
Right to data portability (Art. 20 GDPR): You have the right to receive your data in a structured, commonly used and machine-readable format.
>
Right to object (Art. 21 GDPR): You have the right to object at any time to the processing of your data based on Art. 6(1)(f) GDPR.
>
Right to withdraw consent (Art. 7(3) GDPR): You have the right to withdraw your consent at any time. The lawfulness of processing carried out prior to withdrawal remains unaffected.
To withdraw your Vimeo video consent, clear your browser's site data for lazysnail.design (this will remove the lsd_vimeo_ok entry from localStorage).
Automated Decision-Making (Art. 22 GDPR)
We do not use automated decision-making, including profiling, within the meaning of Art. 22 GDPR. No decisions are made about you solely on the basis of automated processing that would produce legal effects or similarly significantly affect you.
Right to Lodge a Complaint with a Supervisory Authority
Without prejudice to any other administrative or judicial remedy, you have the right to lodge a complaint with a supervisory authority if you believe that the processing of your personal data infringes the GDPR.
The competent supervisory authority for us is:
The competent supervisory authority for us is:
Berliner Beauftragte für Datenschutz und Informationsfreiheit(Berlin Commissioner for Data Protection and Freedom of Information)
Alt-Moabit 59–61
10555 Berlin
https://www.datenschutz-berlin.de
Alt-Moabit 59–61
10555 Berlin
https://www.datenschutz-berlin.de
Data Retention
Unless a more specific storage period has been stated in this privacy policy, your personal data will remain with us until the purpose for data processing no longer applies. If you assert a legitimate request for deletion or withdraw consent, your data will be deleted unless we have other legally permissible reasons for storing your personal data.
SSL/TLS Encryption
This website uses SSL or TLS encryption for security reasons and to protect the transmission of confidential content. You can recognise an encrypted connection by the browser’s address bar changing from “http://” to “https://” and the lock icon in your browser bar.
Changes to this Privacy Policy
We reserve the right to amend this privacy policy to ensure it always complies with current legal requirements or to implement changes to our services. The updated privacy policy will apply to your next visit.
Last updated: September 2026
