Legal notice &
privacy.

1. Controller and contact

The controller responsible for processing your personal data is BlackFly Media GmbH, Övelgönne 63, 22605 Hamburg, Germany, represented by Managing Director Michael Schmidt.

For privacy questions and to exercise your rights, contact us at mail@blackfly.media.

This notice explains how we process personal data when you visit our website, contact us or book an appointment. Personal data means information relating to an identified or identifiable person, such as a name, email address or IP address.

2. Website, hosting and videos

When you access our website, technical data is processed to deliver the requested content to your device. This includes your IP address, the time and destination of the request, and browser and operating system information. Depending on your browser settings, the previously visited page may also be transmitted. Technical requests may be recorded in server logs.

We use this processing to provide the website, resolve errors and defend against attacks. The legal basis is Article 6(1)(f) GDPR. Our legitimate interest is to operate an accessible, reliable and secure website.

The website is hosted by Webflow, Inc., 398 11th Street, 2nd Floor, San Francisco, CA 94103, USA. Files used to display and operate the website are also delivered through infrastructure and content delivery networks used by Webflow. The relevant servers receive the technical request data.

Some of our videos are delivered through data.blackfly.media from an Alfahosting server. The provider is Alfahosting GmbH, Edmund-von-Lippmann-Straße 13-15, 06112 Halle (Saale), Germany. Loading video files involves processing your IP address and technical request data. Loading may begin when you open the page or reach the relevant section, without pressing a play button.

Connections to our website are encrypted using HTTPS. For retention information, see “Retention”; for international transfers, see “Service providers and international processing”.

Webflow: privacy

Alfahosting: privacy

3. Contact form and email

When you contact us, we process the information you provide to understand your request, reply and coordinate any further work together. This includes your contact details, message content and any attachments.

The contact form currently requires your first name, last name, email address, telephone number and company. An additional message is optional. The form cannot be submitted without the required information. Alternatively, you can contact us directly by email.

Form submissions are processed and stored by Webflow. A notification is sent to mail@blackfly.media. We use Google Workspace with Gmail for business email. This service processes messages, sender and recipient details, attachments and technical transmission information. Under its standard terms, Google Workspace is provided to customers in Germany by Google Cloud EMEA Limited, 70 Sir John Rogerson’s Quay, Dublin 2, Ireland.

If your request concerns a contract with you or steps you request before entering into one, the legal basis is Article 6(1)(b) GDPR. For other enquiries, including those made as a company contact person, we rely on Article 6(1)(f) GDPR. Our legitimate interest is to handle incoming enquiries and business communication appropriately.

We do not use the information from your enquiries for newsletters or similar marketing messages.

Google Workspace: privacy information

4. Appointment booking with HubSpot

“Book a call” opens our external HubSpot booking page. The booking form is not embedded in our website. Following the link loads the HubSpot page, where the privacy information provided there also applies.

HubSpot processes technical access data and the information you provide when booking, particularly your name, email address and selected appointment. We use the booking data to organise and prepare the conversation and send related information. We use HubSpot for appointment bookings, not newsletter campaigns. Under its current standard terms, HubSpot Germany GmbH is the contracting entity for customers in Germany; other HubSpot group companies also help provide the service.

The legal basis is Article 6(1)(b) GDPR if the appointment concerns a contract with you or steps towards one. Otherwise, Article 6(1)(f) GDPR applies, based on our legitimate interest in reliable appointment scheduling. You can also request an appointment by email.

HubSpot: privacy

5. Spam protection with Google reCAPTCHA

Our contact form uses Google reCAPTCHA v2 to detect automated input. In the current integration, the associated Google scripts load when a page is opened, including pages without a contact form.

This involves processing technical information such as your IP address, browser and device information, and signals about interactions with the website or security challenge. reCAPTCHA also uses a cookie for risk analysis. The purpose is to detect automated and abusive form entries. Our legitimate interest in protecting the form against spam is the basis under Article 6(1)(f) GDPR.

Storing information on or accessing information from your device is additionally governed by section 25 of the German TDDDG. This privacy notice does not replace any consent that is required. You can contact mail@blackfly.media directly without using the form.

According to Google’s information effective from 2 April 2026, Google processes reCAPTCHA customer data as a processor. Details of processing and contractual terms are available in the linked reCAPTCHA documentation and Cloud Data Processing Addendum.

Google: reCAPTCHA information

6. Links to social networks

The links to LinkedIn, Instagram and X are ordinary links to those services. They do not embed social media feeds or social plug-ins. You visit the linked service when you open the link. Processing there is governed by the provider’s privacy information. If you are signed into the platform, it may associate your visit with your account.

7. Retention

Retention depends on the purpose and whether there are further legal reasons to keep the data. Contact and booking data is needed to handle the enquiry and any outstanding questions or agreed next steps. Once the matter is closed and no further retention ground exists, data that is no longer needed must be deleted. We do not retain it for newsletter use.

If a business relationship results, the records necessary to carry it out are retained. Statutory retention duties may apply beyond that, generally including six years for commercial correspondence subject to retention requirements and eight years for accounting vouchers. These periods do not automatically apply to every informal enquiry. Statutory retention is based on Article 6(1)(c) GDPR.

Where particular records are necessary to establish, exercise or defend specific legal claims, continued retention may rely on Article 6(1)(f) GDPR. Our interest is to protect our rights. The relevant claim and applicable limitation periods determine the retention required.

For technical logs and security data, the relevant criterion is how long they are needed for secure operation, error analysis or investigation of a specific incident. Further retention requires a continuing purpose or legal obligation. When handling a deletion request, we also consider data processed for us in the relevant service provider systems.

8. Service providers and international processing

The named providers receive data in connection with the functions described above: hosting and file delivery, form processing, email communication, scheduling and spam protection. Their subprocessors may also be involved. Within our company, the people handling the relevant matter need access to the corresponding data.

Webflow, Google and HubSpot may process data outside the European Economic Area, particularly in the United States. Their published data processing agreements include provisions for international transfers, in particular the European Commission’s Standard Contractual Clauses. Where an applicable adequacy decision covers a specific transfer, that decision may provide the basis. Article 46 GDPR applies to transfers based on Standard Contractual Clauses, and Article 45 GDPR to adequacy decisions.

The agreements linked below explain these safeguards. You can request further information about the safeguards relevant to our processing and a copy by contacting mail@blackfly.media.

Webflow: Data Processing Addendum

Google: Cloud Data Processing Addendum

HubSpot: Data Processing Agreement

9. Your rights

Subject to the legal requirements, you can request access to your personal data and a copy. You can ask for inaccurate information to be corrected and for processing to be restricted or data to be deleted. Where the requirements are met, you can receive the data you provided in a structured, commonly used, machine-readable format and request its transfer to another controller.

Right to object: Where processing is based on a legitimate interest under Article 6(1)(f) GDPR, you can object on grounds relating to your particular situation. We will stop processing the affected data unless we demonstrate compelling legitimate grounds that override your interests, rights and freedoms, or processing is necessary to establish, exercise or defend legal claims. You can object to processing for direct marketing at any time without giving a reason.

You can withdraw consent at any time with effect for the future. This does not affect the lawfulness of processing before withdrawal. Contact us at mail@blackfly.media to exercise your rights.

You can lodge a complaint with a data protection supervisory authority, particularly in the country of your habitual residence, workplace or the alleged infringement. Our supervisory authority is generally the Hamburg Commissioner for Data Protection and Freedom of Information, Ludwig-Erhard-Str. 22, 20459 Hamburg, Germany.