This policy explains how personal data is handled on lukasthies.com, in accordance with Regulation (EU) 2016/679 (GDPR) and Spanish Organic Law 3/2018 on Data Protection and Digital Rights (LOPDGDD). It applies to this website and to email correspondence arising from it.
Last updated: 5 October 2026
Data Controller
- Name: Lukas Thies
- Address: Calle Manuel Fernández Caballero 44, 11406 Jerez de la Frontera, Cádiz, Spain
- Email: kontakt@lukasthies.com
- Tax ID (NIF): Y5493520F
There is no separate Data Protection Officer. This is a one-person professional practice, and data protection enquiries reach me directly at the address above.
What Data Is Processed, and Why
Server log data
When you open a page on this site, your browser transmits technical data that the web server records in its log files: IP address, date and time of the request, the page or file requested, the referring page, and browser and operating system identifiers. This happens automatically and is technically necessary to deliver the site and to keep it secure and stable.
Legal basis: Article 6(1)(f) GDPR – my legitimate interest in operating a functioning, secure website. Retention: log data is kept only for as long as the hosting infrastructure retains it for security and diagnostic purposes, and is not combined with other data or used to identify individual visitors.
Email contact
If you write to me – whether from a link on this site or otherwise – I process the data contained in your message: your email address, your name if you give it, and the content of the correspondence. I use it to answer you and to carry out any engagement that follows.
Legal basis: Article 6(1)(b) GDPR where the exchange concerns a contract or its preparation, otherwise Article 6(1)(f) GDPR – my legitimate interest in responding to enquiries addressed to me. Retention: correspondence is kept for as long as it is needed to handle the matter and, where commercial or tax law requires records to be retained, for the statutory period that applies in Spain.
Booking a call
The “Book a 30-minute call” links on this site lead to my scheduling page at Calendly (calendly.com/lukasthies), operated by Calendly LLC. If you follow such a link, you leave this website and the data you enter – typically your name, email address and the time you choose, plus anything you write in the booking form – is processed by Calendly and passed on to me so that the appointment can take place. Calendly is a processor acting on my instructions for this purpose, and transfers to the United States are covered by the standard safeguards Calendly makes available for international data transfers. Calendly’s own privacy notice applies to the scheduling page itself and is published at calendly.com/privacy.
Legal basis: Article 6(1)(b) GDPR – arranging a meeting you requested. Following the link is entirely your choice; nothing is sent to Calendly if you do not.
Live figures and portfolio display (Cloudflare)
Some pages show live figures from my own publications and an interactive view of how I work. The script needed for this, its font files and the statistics file are loaded by your browser from lt-portfolio.00thies.workers.dev, a service I run on Cloudflare, Inc. In doing so, Cloudflare processes your IP address, the date and time and the requested file in order to deliver the content and protect it against abuse. No cookies are set. On personal proposal pages that I send to individual prospects by link, the page also reports the ID of that proposal to the same service when it is opened, so I know the link has arrived. No other data is transmitted.
Legal basis: Article 6(1)(f) GDPR, my legitimate interest in fast, secure delivery and in feedback on proposals I have sent. Cloudflare, Inc. is certified under the EU-US Data Privacy Framework, on the basis of which data may be transferred to the United States.
Fonts
The fonts on this website are hosted on my own server. Opening a page does not connect to Google Fonts or any other font service.
Cookies and Tracking
This site does not set advertising or profiling cookies, and it does not run cross-site tracking. Where a cookie is used, it is a technically necessary one – for example to keep a session working or to remember a display preference – which under Article 22(2) of Spanish Law 34/2002 (LSSI-CE) does not require prior consent. Should I later add analytics or any other non-essential cookie, consent will be requested before it is set and this policy will be updated first.
Who Else Handles Your Data
I do not sell personal data and I do not pass it to third parties for their own purposes. Data is handled on my behalf only by the providers I need in order to run the site and correspond with you, each acting as a processor under a data processing agreement pursuant to Article 28 GDPR:
- netcup GmbH, Emmy-Noether-Straße 10, 76131 Karlsruhe, Germany – web hosting and email. Stores this website, its server log files, and the mailbox for kontakt@lukasthies.com. Processing takes place within the European Union.
- Calendly LLC, United States – appointment bookings made through my scheduling page, as described above. Only data you enter yourself into a booking reaches it.
- Cloudflare, Inc., 101 Townsend St, San Francisco, CA 94107, USA – delivery of the live figures and the portfolio display, as described above. Certified under the EU-US Data Privacy Framework.
Data may also be disclosed where I am legally obliged to do so, for example to a tax authority or a court.
Your Rights
Under the GDPR you may ask me to confirm what data about you I hold and to give you a copy of it; to correct it if it is wrong; to erase it; to restrict how it is used; to send it to you or to another controller in a portable format; and to stop processing that rests on legitimate interest. Where processing rests on consent, you may withdraw that consent at any time, which does not affect anything done before you withdrew it.
To exercise any of these rights, write to kontakt@lukasthies.com. I will respond within one month. If you are not satisfied with how I have handled your data, you may complain to the Spanish supervisory authority, the Agencia Española de Protección de Datos (aepd.es), C/ Jorge Juan 6, 28001 Madrid – or to the supervisory authority in the EU or EEA country where you live or work.
Providing Data Is Voluntary
You are under no obligation to give me any personal data. Reading this site requires nothing from you beyond the technical log data described above. If you choose not to send an email or book a call, the only consequence is that I cannot reply or meet you.
Changes to This Policy
This policy is updated whenever the way data is handled on this site changes – a new tool, a new form, a new processor. The date at the top always reflects the current version.
See also the Legal Notice.