Skip to content
de
en

Right onData protection

Thanks for visiting. We take the protection of your personal data seriously. This policy explains which data we process when you visit this website, for what purpose, on which legal basis, and what rights you have. Personal data is any information that relates to you as a person, such as your name, your email address or your IP address.

1. Controller

The controller responsible for data processing on this website within the meaning of the GDPR is:

Yung & FrishMatern und Lehle GbRrepresented by Benedikt Matern and Roland LehleSaleggstr. 581547 MunichGermany

hello@yungfrish.de

We have not appointed a data protection officer, as we are not legally required to do so. If you have any questions about data protection, just write to the email address above.

2. Hosting and server log files

This website is hosted on Cloudflare Pages and delivered through Cloudflare's network. The provider is Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107, USA ("Cloudflare"). When you visit the website, Cloudflare automatically processes data that your browser transmits (server log files):

  • IP address
  • date and time of access
  • page or file requested and amount of data transferred
  • referrer URL (the page visited before)
  • browser type and version, operating system
  • HTTP status code

This processing is necessary to deliver the website to you, to keep it stable and secure and to fend off attacks (e.g. DDoS). The legal basis is our legitimate interest in a secure and functioning website (Art. 6(1)(f) GDPR). To protect against automated attacks, Cloudflare may set a strictly necessary cookie ("__cf_bm", lifetime 30 minutes); this is permitted without consent under Section 25(2) no. 2 TDDDG.

We have concluded a data processing agreement with Cloudflare (Art. 28 GDPR). Cloudflare may also process data in the USA. Cloudflare is certified under the EU-U.S. Data Privacy Framework, so an adequacy decision of the European Commission applies (Art. 45 GDPR). Cloudflare has also agreed to the European Commission's Standard Contractual Clauses.

More information: Cloudflare privacy policy.

3. Cookies, local storage and consent

We only use what the website needs to work, and anything beyond that only with your consent. On your first visit, our cookie banner asks whether you want to allow statistics (Google Analytics). Rejecting is as easy as accepting, and without your consent it is not loaded.

We store your choice in your browser's local storage under the name "yf-consent": which categories you allowed and when. This information never leaves your browser, and you will be asked again after 12 months. Storing it is strictly necessary to respect your decision (Section 25(2) no. 2 TDDDG); the legal basis is our legal obligation to be able to demonstrate consent (Art. 6(1)(c) in conjunction with Art. 7(1) GDPR).

The legal basis for all services that require consent is your consent (Art. 6(1)(a) GDPR, Section 25(1) TDDDG). You can change or withdraw it at any time with effect for the future: via the "Cookie settings" link in the footer or right here: . Withdrawal does not affect the lawfulness of processing carried out before it.

Overview of all cookies and storage entries:

  • Necessary: “yf-consent” (local storage, this website) stores your choice in the cookie banner, 12 months.
  • Necessary: “__cf_bm” (cookie, Cloudflare) tells humans from bots, 30 minutes; only if Cloudflare sets it to protect the site.
  • Statistics, only with consent: “_ga” and “_ga_<ID>” (cookies, Google Analytics) distinguish visitors and sessions, up to 2 years.

4. Fonts (Adobe Fonts)

The font of our body text (Satoshi) is hosted on our own server; no connection to third parties is made for it. For headlines we use the font "loos-extended" via Adobe Fonts, a service of Adobe Systems Software Ireland Limited, 4–6 Riverwalk, Citywest Business Campus, Dublin 24, Ireland ("Adobe").

When you open a page, your browser loads the font from Adobe's servers. Adobe receives your IP address and technical information about your browser and the page request (e.g. the hostname of this website and details of the web project). According to Adobe, it uses this data to provide the fonts, to fix delivery problems and to settle licence fees with the type foundries. Adobe does not set any cookies.

The legal basis is our legitimate interest in a consistent and appealing presentation of our website (Art. 6(1)(f) GDPR). Data may be transferred to Adobe Inc. in the USA; Adobe Inc. is certified under the EU-U.S. Data Privacy Framework (Art. 45 GDPR).

More information: Adobe Fonts privacy notice.

5. Web analytics with Google Analytics

Only if you consent to the "Statistics" category in the cookie banner do we use Google Analytics 4, a web analytics service of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland ("Google"). Google Analytics helps us understand how our website is used, which content lands and where we can improve it.

For this, Google Analytics sets cookies ("_ga", "_ga_<ID>", lifetime up to 2 years) and processes pseudonymous usage data, such as pages viewed, time spent, where the visit came from (referrer), device and browser information and your approximate location. Your IP address is used to derive the location and, for users in the EU, is not stored by Google Analytics 4. The data is deleted from our Google Analytics account after 14 months at the latest.

The legal basis is your consent (Art. 6(1)(a) GDPR, Section 25(1) TDDDG). We have concluded a data processing agreement with Google. Google may transfer data to Google LLC in the USA; Google LLC is certified under the EU-U.S. Data Privacy Framework (Art. 45 GDPR).

If you withdraw your consent, Google Analytics stops immediately and its cookies are deleted: .

More information: Google privacy policy.

6. Contact by email

If you email us, we process the data you give us: your email address, your name if you give it and the content of your message.

We only use this data to handle your request and reply to you. The legal basis is taking steps prior to entering into a contract (Art. 6(1)(b) GDPR) or, for other enquiries, our legitimate interest in answering them (Art. 6(1)(f) GDPR).

We delete your request once it has been fully dealt with and no further communication is expected. If it leads to a contract or statutory retention obligations apply (e.g. 6 years for business letters under Section 257 of the German Commercial Code, 8 or 10 years for tax-relevant documents under Section 147 of the German Fiscal Code), we keep the data for that period.

7. Links to social networks

Our website links to our profiles on Instagram, Behance and Dribbble and to our team's LinkedIn profiles. These are plain links: no data is sent to these networks when you visit our website. Only when you click a link are you taken to the provider's site, where its own privacy policy applies.

8. SSL/TLS encryption

For security reasons, this website uses SSL/TLS encryption. You can recognise an encrypted connection by "https://" in your browser's address bar. Data you send us cannot be read by third parties.

9. Recipients and storage period

Only the service providers named in this policy receive your data, and only as far as needed for the respective purpose. We do not sell data or pass it on for advertising. We only disclose data to authorities if we are legally obliged to.

We store personal data only as long as necessary for the respective purpose or as required by statutory retention periods. The specific periods are given in the sections above.

10. Your rights

You have the following rights regarding your personal data at any time:

  • access to the data we process (Art. 15 GDPR)
  • rectification of inaccurate data (Art. 16 GDPR)
  • erasure of your data (Art. 17 GDPR)
  • restriction of processing (Art. 18 GDPR)
  • data portability (Art. 20 GDPR)
  • withdrawal of consent with effect for the future (Art. 7(3) GDPR)
  • lodging a complaint with a data protection supervisory authority (Art. 77 GDPR)

Right to object (Art. 21 GDPR): Where we process data on the basis of our legitimate interest (Art. 6(1)(f) GDPR), you can object to this processing at any time on grounds relating to your particular situation. We will then no longer process your data unless we can demonstrate compelling legitimate grounds that override your interests, or the processing serves the establishment, exercise or defence of legal claims.

To exercise your rights, just write to hello@yungfrish.de. It is free of charge, and we will reply within one month.

The supervisory authority responsible for us is the Bavarian Data Protection Authority (Bayerisches Landesamt für Datenschutzaufsicht, BayLDA), Promenade 18, 91522 Ansbach, Germany, lda.bayern.de. You can also contact the supervisory authority where you live or work.

11. No obligation to provide data, no automated decisions

You are not legally or contractually obliged to provide us with personal data. Without the server log files, however, we cannot deliver the website to you, and without your contact details we cannot reply to you. We do not use automated decision-making, including profiling (Art. 22 GDPR).

12. Changes to this privacy policy

We update this privacy policy when our website or the services we use change, or when the law requires it. The version published here applies.

Last updated: September 2026