Privacy Policy

Language notice: This translation is provided for convenience. If meanings differ, the German version is authoritative to the extent permitted by law. Statutory rights remain unaffected. handmen.de/datenschutz

1. Controller

The controller under Article 4(7) GDPR is:

2. Purposes and legal bases

We process personal data to operate this website, assess referral requests, propose a potentially suitable independent provider, establish contact after your separate consent, meet legal duties and measure audience reach only after consent.

• Art. 6(1)(b) GDPR: processing the referral request and related pre-contractual steps.
• Art. 6(1)(a) GDPR: sharing with a previously named provider and Google Analytics 4.
• Art. 6(1)(c) GDPR: legal obligations.
• Art. 6(1)(f) GDPR: security, stable operation, abuse prevention and general business communication.

3. Hosting, logs and encrypted transmission

This website is hosted through ChatGPT Sites by OpenAI. For users in the EEA, the relevant entity is OpenAI Ireland Ltd. OpenAI processes data required for hosting, maintenance, security and support on our behalf.

IP address, time, requested URL, referrer, HTTP status, browser/device details and security logs may be processed. The website uses HTTPS. The legal basis is Article 6(1)(f) GDPR.

ChatGPT Sites Data Processing Addendum

4. Email, enquiry form and Formspree

Email is handled through Gmail by Google Ireland Limited. The enquiry form uses Formspree, Inc.; data is sent from your browser to Formspree and then to our Gmail mailbox.

Depending on your entries, we process name, email address, optional telephone number and street address, postcode, city, requested type of work, property type, timeframe, description, source, submission time and technical connection data. Photographs are sent separately by email.

The privacy checkbox records acknowledgement of this policy. The role checkbox only confirms that the request is for a referral. Neither checkbox is consent to share data with a provider.

Formspree Privacy Policy · Google Privacy Policy

5. Selection of a provider and sharing the request

The initial website request goes only to HandMen. We use the task, location, property type, timeframe and contact details to identify a potentially suitable independent provider.

Before any personal data is shared, HandMen names the specific proposed provider and asks for your explicit consent. Without that consent, the referral request is not shared with the provider.

After consent, only details needed for contact, assessment and quotation are shared under Article 6(1)(a) GDPR. Consent may be withdrawn before sharing and for the future at any time by emailing us. Once received, the independent provider acts as a separate controller and uses the data to contact you, assess the task, issue its own quote and, if agreed, enter into a direct contract with you.

6. Consent storage, Google Analytics 4 and Search Console

You can withdraw analytics consent at any time through “Cookie settings” in the footer by switching off “Analytics” and selecting “Save selection”. Withdrawal does not affect the lawfulness of earlier processing. Analytics uses Article 6(1)(a) GDPR and Section 25(1) TDDDG; necessary consent storage uses Section 25(2)(2) TDDDG.

Your consent version, necessary-storage choice, analytics choice and timestamp remain in local storage until deletion, reset or a change of consent version. Analytics cookies _ga and _ga_ZVCBV59CRD normally last up to two years and are used only with consent.

Cookie preferences are stored locally under handmen-cookie-consent-v2. Google Analytics 4 (measurement ID G-ZVCBV59CRD) loads only after consent to statistics. Google Signals and advertising personalisation are disabled.

Analytics may receive page views, referrer, time, browser/device details, approximate region and interactions. Form analytics use only technical parameters such as form name, broad category, stable activity ID, property type, path and language. Names, contact details, address and message text are not sent to Analytics. Event and user data are retained for 14 months.

Google Search Console is used for technical indexing, security and aggregated search reports. It does not add a separate tracking script or cookie through this website.

7. Recipients, separate controllers and international transfers

• OpenAI Ireland Ltd. — hosting, security and support;
• Formspree, Inc. — form transmission;
• Google Ireland Limited — Gmail, Search Console and Analytics only after consent;
• the independent provider named to you in advance, only after your explicit consent and acting as a separate controller;
• advisers or authorities where necessary or legally required.

We do not sell personal data or distribute requests to unknown businesses for independent advertising.

• Formspree: The provider stores form data on AWS servers in the USA and relies on EU Standard Contractual Clauses as a processor (Article 46 GDPR). Formspree: security.
• Google: Covered transfers to certified Google US entities use the EU-US Data Privacy Framework adequacy decision (Article 45 GDPR). Otherwise, Google provides safeguards including Standard Contractual Clauses. Google: transfer frameworks.
• OpenAI: Section 4 of the ChatGPT Sites data-processing terms provides for an adequacy decision or Standard Contractual Clauses for transfers from the EEA to affiliates or third parties outside the EEA. ChatGPT Sites Data Processing Addendum.

You may request information about the applicable safeguards and a copy at info.handmen@gmail.com.

8. Retention

We retain enquiry data while needed for handling, referral and related communication, then delete it unless statutory retention duties or necessary evidence for pursuing or defending claims require otherwise. This also applies to enquiry copies we manage in Formspree and Gmail.

• Referral requests without sharing or conclusion: generally deleted no later than 12 months after final handling.
• Evidence of consent or withdrawal: as long as required to demonstrate lawful processing and defend claims.
• HandMen business records: applicable commercial and tax periods. The provider retains its own work contract and invoices independently.
• Google Analytics: 14 months for event and user data; cookies normally up to two years.

9. Required fields and automated decisions

Required fields are needed to assess and answer the request. No solely automated decision with legal or similarly significant effects under Article 22 GDPR and no advertising profiling takes place.

10. Your rights

Subject to the statutory conditions, you have rights of access, rectification, erasure, restriction, data portability, objection and withdrawal of consent with future effect under Articles 15–21 and 7(3) GDPR.

You may complain to a data-protection authority under Article 77 GDPR. The authority particularly relevant for Hesse is:

11. Updates

We update this policy when the law, referral process, service providers or technical configuration changes. The current version is available at handmen.de/en/privacy-policy.

Last updated: 19 September 2026