Privacy Policy
Last updated: 2 November 2026
This policy explains what personal data we handle, why, and what rights you have. It covers this website (workinghandsweb.com, including the preview and example pages), the businesses we contact about our services, and our clients. We wrote it in plain English. If anything is unclear, email us.
1. Who is responsible
The controller under the EU General Data Protection Regulation (GDPR) and the UK GDPR is:
Daniil Kirillov, trading as Working Hands WebsitesGuerickestr. 19, 80805 München, Germany
Email: hello@workinghandsweb.com · Phone: +1 832 900 3262
We are a one-person business and are not required to appoint a data protection officer.
2. Visiting this website
Hosting and server logs
This website is served by Cloudflare, Inc. (101 Townsend St, San Francisco, CA 94107, USA). When you open a page, your browser sends technical data that Cloudflare needs to deliver the page and protect it from attacks: IP address, date and time, the page requested, referring page, browser and operating system. Cloudflare processes this data on our behalf and keeps it only briefly. We don't use it to identify you. Legal basis: our legitimate interest in running a secure, working website (Art. 6(1)(f) GDPR).
No cookies, no tracking
We don't use cookies, analytics, advertising pixels or any other tracking. Fonts and icons are stored on our own server, so loading them sends no data to Google or anyone else.
Photos on preview and example pages
Some photos on preview and example pages load from Unsplash's image servers (images.unsplash.com, Unsplash Inc., Canada, using servers that may be in the USA). Your browser sends your IP address and browser details to load them. Legal basis: Art. 6(1)(f) GDPR, our interest in showing good photos without hosting every image ourselves.
Maps on preview pages
Preview pages show a service-area map from Google Maps only if you click "Show map". Until you click, nothing is sent to Google. After you click, Google (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, and Google LLC, USA) receives your IP address and may set cookies. Legal basis: your consent (Art. 6(1)(a) GDPR, § 25(1) TDDDG), given by clicking. It applies to that page view only; reload the page and the map is gone again. See Google's privacy policy.
Links to other sites
Preview pages link to a business's Google reviews. Those pages are run by Google, and their privacy policy applies once you click.
Forms on preview pages
The contact forms on preview and example pages are demonstrations. Nothing you type is sent to us or anyone else. It stays in your browser.
3. Calling or emailing us
If you email or call us, we use your name, contact details and what you tell us to reply and, if you want, to prepare an offer. Legal basis: steps before a contract (Art. 6(1)(b) GDPR) or our legitimate interest in answering enquiries (Art. 6(1)(f) GDPR). Emails are handled with Google Workspace/Gmail (Google). Phone calls run through LeadConnector, our phone and customer management system (see section 7). If we ever record a call, we tell you at the start and only go ahead if you agree. We delete enquiries that don't lead to a contract after 12 months at the latest.
4. Businesses we contact
We contact trade businesses that don't seem to have a website and offer them ours. If we contacted you or built a preview page for your business, this section is for you. Most of the information is about the business, but for sole traders it can be personal data.
- What we use: business name, business phone number, town or city, trade, Google rating and number of reviews, and whether a website is listed.
- Where it comes from: public business listings on Google Maps.
- Why: to call you about our services and to build a preview page showing what your website could look like.
- Legal basis: our legitimate interest in offering our services to businesses (Art. 6(1)(f) GDPR). Preview pages are marked as unofficial, carry a "noindex" tag so search engines don't list them, and use only the public details above.
- Who receives it: LeadConnector (our phone and customer management system) and Cloudflare (which hosts preview pages). See section 7.
- How long: if you don't become a client, we delete your details and preview page within 12 months. If you tell us to stop, we remove the preview within 2 business days and only keep your business name and number on a do-not-contact list, so we never call you again.
Your right to object: you can object at any time to us using your details to offer our services (Art. 21(2) GDPR). Tell us on the phone or email hello@workinghandsweb.com, and we stop.
5. Clients
For clients we process contact details, business details, website content, billing details and our messages with you, to deliver the service and get paid (Art. 6(1)(b) GDPR) and to meet tax and accounting duties (Art. 6(1)(c) GDPR). Payments are handled by Stripe (Stripe Payments Europe, Ltd., 1 Grand Canal Street Lower, Dublin 2, Ireland) or PayPal (PayPal (Europe) S.à r.l. et Cie, S.C.A., 22–24 Boulevard Royal, L-2449 Luxembourg). We never see your full card details. We keep invoices and accounting records for as long as German tax and commercial law require (currently up to 10 years), and delete everything else within 3 months after you leave, once your data has been exported or handed over.
6. Leads on our clients' websites
When someone sends a request through a website we run for a client, that client decides what happens to the request and is the controller. We only process it on the client's behalf, under a data processing agreement (our DPA). The privacy policy on the client's own website applies. Please contact that business directly. We'll pass on anything that reaches us.
7. Service providers and transfers outside the EU
| Provider | What for | Transfer safeguard |
|---|---|---|
| Cloudflare, Inc., USA | Hosting, security, DNS, email forwarding | EU-US Data Privacy Framework (DPF), Standard Contractual Clauses |
| HighLevel Inc. / LeadConnector LLC, USA | Phone calls, customer management, client websites' lead handling | DPF, Standard Contractual Clauses |
| Google (Ireland / USA) | Email (Gmail), maps on request | DPF, Standard Contractual Clauses |
| Stripe, PayPal (EU) | Payments | Processed in the EU; transfers under their own safeguards |
| Unsplash Inc. | Photos on preview pages | Canada (EU adequacy decision); servers may be in the USA |
Transfers to the USA rely on the EU Commission's adequacy decision for the Data Privacy Framework (Art. 45 GDPR) where the provider is certified, and otherwise on Standard Contractual Clauses (Art. 46 GDPR). We don't sell personal data, and we don't share mobile numbers with third parties for their marketing.
8. Your rights
You have the right to:
- find out what data we hold about you and get a copy (Art. 15 GDPR);
- have wrong data corrected (Art. 16) or deleted (Art. 17);
- have its use restricted (Art. 18);
- get data you gave us in a machine-readable format (Art. 20);
- object to processing based on legitimate interests (Art. 21), and to direct marketing at any time;
- withdraw consent at any time, for the future (Art. 7(3)).
Email hello@workinghandsweb.com and we'll answer within one month. You can also complain to a data protection authority. Ours is the Bayerisches Landesamt für Datenschutzaufsicht (BayLDA), Promenade 18, 91522 Ansbach, Germany, lda.bayern.de. In the UK you can complain to the Information Commissioner's Office (ico.org.uk).
We don't make automated decisions about you that have legal or similarly significant effects. You don't have to give us any data, but without contact details we can't reply to you or work for you.
We update this policy when what we do changes. The date at the top shows the latest version.