Privacy Policy
Last updated: 30 September 2026
This English version is provided for convenience. In case of discrepancies, the German-language version is authoritative.
1. Controller
The controller responsible for processing personal data on this website is:
Dr. Julien Bobineau
Bobineau Communications
Im Malerwinkel 1
97232 Giebelstadt
Germany
Phone: +49 152 59 71 49 39
Email: julien@bobineau.com
2. General information
Personal data is processed only where necessary to provide this website, handle enquiries, take pre-contractual steps, perform contracts or meet legal obligations. The principal legal bases are Articles 6(1)(b), (c) and (f) GDPR. Where consent is required in an individual case, processing is based on Article 6(1)(a) GDPR.
No automated decision-making, including profiling within the meaning of Article 22 GDPR, takes place.
3. Hosting by netcup and server logs
This website is hosted by netcup GmbH, Emmy-Noether-Straße 10, 76131 Karlsruhe, Germany. netcup processes personal data as a processor under a data-processing agreement pursuant to Article 28 GDPR.
When you access the website, technically necessary access data may be processed in server logs, including IP address, date and time, requested page or file, request method and status code, referrer, browser/user agent and data volume transferred.
Processing is based on Article 6(1)(f) GDPR. The legitimate interest is the secure, stable and technically reliable operation of the website and protection against misuse and attacks.
According to netcup, access logs for the web-hosting products used can be retained for a maximum of 14 days; log rotation can be configured within the hosting environment. Further information: netcup Log Policy.
4. Contact form
If you use a contact form, I process the information you enter. Your email address and message are required; first name, last name and telephone number are optional. Without the required information, the enquiry cannot be handled through the form.
The purpose is to handle your enquiry and, where applicable, prepare a business relationship. Processing is based on Article 6(1)(b) GDPR for pre-contractual measures or an existing contract. Other enquiries are processed under Article 6(1)(f) GDPR based on my legitimate interest in handling incoming enquiries.
No data-protection consent is required merely to submit the form. A notice referring to this Privacy Policy is displayed before submission.
5. Email delivery and Google Workspace
Information submitted through the forms is transmitted by the web server to my business mailbox via an encrypted SMTP connection. I use Google Workspace for business email and mailbox management. For customers with a German billing address, the Google contracting entity is Google Cloud EMEA Limited, 70 Sir John Rogerson’s Quay, Dublin 2, Ireland.
Data processed may include name, email address, telephone number, message, subject, technical delivery data and, for the ad review, the uploaded file. Google processes customer data in connection with Google Workspace under the applicable Google Workspace data-processing terms and Cloud Data Processing Addendum (CDPA).
Processing by Google group companies or subprocessors outside the European Economic Area cannot be ruled out. According to Google, transfers to the United States may rely on the EU-US Data Privacy Framework; where required, EU Standard Contractual Clauses are used for transfers to other third countries. Further information: Google Cloud and the GDPR and Google Workspace privacy compliance.
6. Ad review and file upload
On /en/free-ad-review, you can upload an advertisement as a PDF, JPG or PNG file for review. Your email address and uploaded file are required; your telephone number is optional.
Processing is based on Article 6(1)(b) GDPR because the review is carried out at your request as a pre-contractual measure.
The uploaded file is processed briefly on the netcup web server and is then transmitted as an email attachment via Google Workspace. The PHP upload file is not permanently stored in the website directory. The email and attachment are deleted after the review is completed and no later than three months after your enquiry, unless a subsequent engagement or another legal basis requires longer retention.
I carry out the review jointly with Theresa Fischer, Heubergstraße 33, 82496 Oberau, Germany, hello@theresafischer.com. Under the arrangement in place, we are joint controllers for this processing within the meaning of Article 26 GDPR. You may exercise your data-subject rights against either party. I will provide the essential contents of the joint-controller arrangement on request.
Please do not upload files containing special categories of personal data within the meaning of Article 9 GDPR (for example health data, information revealing ethnic origin, religious or political beliefs or sexual orientation), and remove unnecessary third-party personal data before uploading. If such information is essential to your enquiry, do not use the upload function and contact me by email first.
7. Protection against automated misuse (rate limiting)
To protect the forms against automated repeated submissions, the IP address is hashed using SHA-256 when a form is submitted. Only this hash and a timestamp are stored temporarily on the web server. The information is used solely to block repeat submissions from the same address for 30 seconds for the general contact form and 60 seconds for the ad-review form.
Processing is based on Article 6(1)(f) GDPR. The legitimate interest lies in the security and availability of the forms and the prevention of automated misuse. The blocking effect ends after 30 or 60 seconds. Expired records are removed on subsequent form submissions and may also be removed by the server environment as part of temporary-file cleanup; they are not used for any other purpose.
8. Contact by email or telephone
If you contact me by email or telephone, I process the personal data you provide to handle your enquiry. Google Workspace is used for email communication as described in section 5.
The legal basis is Article 6(1)(b) GDPR for pre-contractual or contractual matters and otherwise Article 6(1)(f) GDPR based on my legitimate interest in communicating with prospective clients, business partners and other enquirers.
9. Postal B2B direct marketing
I may use business contact data to inform companies and professionals by post about services offered by Bobineau Communications and about thematically relevant joint offers. Depending on the mailing, the data processed may include name, form of address, professional role, company, business postal address and business- or sector-related classification information.
Depending on the campaign, the data originates from existing business contacts or publicly available business sources, in particular company websites and business or sector directories. If an external address provider is used for a campaign, information about that provider will be added to the campaign-specific privacy information.
The purpose of the processing is postal outreach to potentially interested business customers. The legal basis is Article 6(1)(f) GDPR. My legitimate interest is direct marketing for my own business services and targeted outreach to companies for which those services may be relevant based on sector, professional role or an identifiable communications need. Existing objections to marketing and identifiable overriding interests are taken into account before a mailing.
Service providers commissioned for printing, enveloping and postal delivery may receive the address data required for those purposes. Where a campaign is planned and carried out jointly with Fischer Design and Bobineau Communications and Fischer Design jointly determine the purposes and means of processing, the processing is carried out under joint controllership pursuant to Article 26 GDPR. In that case, you may exercise your data-subject rights against either party; further information on the allocation of responsibilities is available on request.
You may object at any time and without giving reasons to the processing of your personal data for direct-marketing purposes (Article 21(2) and (3) GDPR). An informal notice is sufficient, for example by email to julien@bobineau.com or by post to the address stated in section 1. Following an objection, your data will no longer be used for direct marketing.
To ensure that a marketing objection is respected permanently, I may retain the minimum information required in a suppression list. This information is used solely to prevent future marketing contacts and is retained on the basis of Article 6(1)(f) GDPR in my legitimate interest in reliably respecting marketing objections.
10. Retention periods
Server logs are generally retained for no more than 14 days as described in section 3, unless exceptionally required for longer to investigate a security incident or establish, exercise or defend legal claims.
Pure contact enquiries that do not result in a contractual relationship are routinely deleted after processing is completed and no later than twelve months afterwards. Where correspondence is required to establish, exercise or defend legal claims, it may be retained until the relevant statutory limitation periods have expired.
If an enquiry results in a contractual relationship, contract and accounting records are retained in accordance with applicable commercial and tax-law retention obligations. The separate deletion period in section 6 applies to ad-review uploads.
11. Cookies, analytics and tracking
The website currently does not use non-essential cookies and does not use web analytics, advertising or tracking services such as Google Analytics or Meta Pixel. External fonts are not loaded from Google Fonts or comparable third-party providers. If this changes, this Privacy Policy will be updated and consent will be obtained where legally required.
12. Recipients
Recipients or categories of recipients may include, where required for the relevant purpose, netcup GmbH as hosting provider, Google Cloud EMEA Limited and subprocessors used for Google Workspace, Theresa Fischer in connection with the ad review, and for postal B2B campaigns commissioned printing, enveloping and delivery service providers and – where joint controllership applies – Fischer Design. Data is otherwise disclosed only where a legal basis exists or disclosure is required by law.
13. Your rights
Subject to the statutory requirements, you have the right to access (Article 15 GDPR), rectification (Article 16), erasure (Article 17), restriction of processing (Article 18), data portability (Article 20) and to object to processing based on Article 6(1)(e) or (f) GDPR (Article 21). Where processing is based on consent, you may withdraw that consent at any time with effect for the future (Article 7(3)).
14. Right to lodge a complaint
Under Article 77 GDPR, you have the right to lodge a complaint with a data-protection supervisory authority. The authority responsible for my place of business is in particular:
Bavarian State Office for Data Protection Supervision (BayLDA)
Promenade 18
91522 Ansbach
Germany
www.lda.bayern.de
15. TLS encryption
This website uses TLS encryption to protect confidential content during transmission. An encrypted connection can generally be identified by the “https://” prefix in your browser's address bar.
16. Changes to this Privacy Policy
This Privacy Policy will be updated if the services used, processing activities or legal requirements change. The version published on this website at the relevant time applies.