Pi nebenbei

A note to you, not to your visitors – remove before going live This policy describes the site exactly as it is delivered: no analytics tools, no external fonts, no embedded videos. As soon as you add something, you have to extend this text. Fill in the spots marked in colour. A privacy policy that doesn't match the actual processing is worse than none at all – have it reviewed before going live.

Privacy policy

Protecting your data matters to me. Below you can read which data is processed when you visit this site, for what purpose that happens and which rights you have. The policy is deliberately written in everyday language wherever the legal situation allows it.

This site is operated and hosted in Germany. Processing is therefore governed by the EU General Data Protection Regulation (GDPR) and the German Telecommunications Digital Services Data Protection Act (TDDDG). References to those statutes are kept in the original; the English wording is a translation provided for convenience.

  1. The essentials in brief
  2. Controller
  3. Hosting and server logs
  4. Storage in your browser
  5. Consent and withdrawal
  6. Getting in touch
  7. Downloading the cheat sheet
  8. Referral and affiliate links
  9. Fonts, images, external content
  10. Transfers to third countries
  11. Retention periods
  12. Your rights
  13. Right to lodge a complaint
  14. Changes to this policy

1. The essentials in brief

This site is deliberately built to be lean. There are no analytics tools, no advertising networks, no embedded videos and no fonts loaded from external servers. There are no user accounts, no newsletter sign-up and no forms. The cheat sheet can be downloaded without giving an email address.

What inevitably occurs are server logs when the site is accessed. On top of that there are two entries in your browser's storage that remember your cookie decision and your choice between the light and dark theme. Neither of them leaves your device.

2. Controller

The controller within the meaning of Art. 4 (7) GDPR is:

Lars Kraume-Flügel
Karolinenstr. 12
34127 Kassel
Germany
Email: kontakt@pi-nebeneinkommen.de

3. Hosting and server logs

This site is hosted by Strato AG, Otto-Ostrowski-Straße 7, 10249 Berlin, Germany. The provider processes data on my behalf; the basis for this is a data processing agreement pursuant to Art. 28 GDPR.

Every time the site is accessed, information transmitted by your browser is recorded automatically. In detail this is:

Purpose: delivering the site, operational security and investigation in the event of attacks.
Legal basis: Art. 6 (1) (f) GDPR. My legitimate interest lies in the technically error-free and secure operation of this site.
Retention period: The original server log files are stored by our web host STRATO for a maximum of 7 days and are anonymised afterwards. The data is stored there for security reasons, for example in order to investigate attacks or cases of misuse, as well as to optimise the services and for statistical analysis. If data has to be retained as evidence, it is exempt from deletion until the incident has been finally resolved.

4. Storage in your browser

This site does not set cookies in the classic sense. It does, however, place two entries in your browser's local storage. This data is not transmitted to any server and does not leave your device:

NamePurposeDuration
ccm-einwilligung Stores your decision on the cookie categories together with the time it was made, so that you are not asked again on every visit. 12 months
ccm-design Remembers whether you chose the light or the dark appearance. until you clear your browser storage

Legal basis: § 25 (2) no. 2 TDDDG. Both entries are strictly necessary in order to provide the function you requested – in one case implementing your privacy decision, in the other the appearance you selected. No consent is required for this, and you cannot deselect them without losing the respective function.

The electricity cost calculator on the home page runs entirely in your browser. Your entries are neither stored nor transmitted and are gone once you close the page.

5. Consent and withdrawal

Should services that require consent be embedded in the future – an analytics tool, for example – they will only be loaded after you have agreed. Before that, no processing by those services takes place at all. The consent banner only appears if services requiring consent are actually embedded.

Legal basis: Art. 6 (1) (a) GDPR and § 25 (1) TDDDG.

You can withdraw consent you have given at any time with effect for the future. The lawfulness of the processing carried out up to the withdrawal remains unaffected.

6. Getting in touch

If you send me an email, I process the details you provide solely in order to deal with your request and in case of follow-up questions.

Legal basis: Art. 6 (1) (f) GDPR based on the legitimate interest in answering enquiries, and additionally Art. 6 (1) (b) GDPR where there is a contractual context.
Retention period: until your request has been conclusively dealt with, unless statutory retention obligations apply.

7. Downloading the cheat sheet

The cheat sheet can be downloaded without registration and without giving an email address. Only the file request is recorded, as part of the server logs described in section 3. No recording beyond that takes place.

This site contains links to providers with whom I have a referral or affiliate arrangement. Such links are marked in place. If you click one of them, you leave this site. Only on the destination site can the respective provider set cookies or use similar techniques in order to trace the referral and attribute it to me. As a rule, your IP address, information about your device and a referral identifier are processed in the course of this.

I have no influence over this processing, and it does not take place on this site. The respective provider is responsible for it. From the providers I only receive aggregated billing data and do not learn which individual person signed up.

Legal basis for the linking: Art. 6 (1) (f) GDPR based on the legitimate interest in financing this site.

The privacy notices of the linked providers can be found here:

9. Fonts, images, external content

This site does not load any fonts from external servers. Only the fonts already present on your device are used. No connection is established to Google Fonts or comparable services.

All graphics are embedded directly in the page source as vector drawings. No images, videos, maps or social network buttons are loaded from third-party servers.

10. Transfers to third countries

The operation of this site itself does not involve any transfer of personal data to countries outside the European Union.

If you follow a referral or affiliate link, you leave this area. Some of the linked providers are based outside the EU. The respective provider is responsible for the processing that takes place there; details can be found in their privacy notices.

11. Retention periods

Personal data is deleted as soon as the purpose of the processing no longer applies and no statutory retention obligations stand in the way. The specific periods are stated with the individual processing activities above.

12. Your rights

You have the following rights vis-à-vis the controller:

Right to object under Art. 21 GDPR Insofar as processing is based on legitimate interests pursuant to Art. 6 (1) (f) GDPR, you have the right to object at any time on grounds relating to your particular situation. I will then no longer process the data concerned unless I can demonstrate compelling legitimate grounds that override your interests, rights and freedoms, or unless the processing serves to establish, exercise or defend legal claims.

To exercise your rights, an informal message to kontakt@pi-nebeneinkommen.de is sufficient.

13. Right to lodge a complaint

Without prejudice to other remedies, you have the right under Art. 77 GDPR to lodge a complaint with a data protection supervisory authority if you consider that the processing of your data infringes the GDPR. As a rule, the competent authority is the one at your habitual residence, your place of work or the place of the alleged infringement.

Supervisory authority responsible for me as the controller: The Hessian Commissioner for Data Protection and Freedom of Information (HBDI), Wiesbaden, Germany.

14. Changes to this policy

I update this policy whenever the functions of the site or the legal requirements change. The version available here is the one that applies.

Last updated: 26 July 2026