Privacy
Privacy policy
How personal data is processed on this company website.
1. Controller and contact
The controller is Dr. Blackburn Digital GmbH, acting through Dr. Harvey Gregory Scott Blackburn (known as Dr. Greg Blackburn), its managing director (Geschäftsführer). Address for service: Erich-Kästner-Straße 8, 66346 Püttlingen, Germany. Email: info@drblackburndigital.com.
2. Website hosting and security
Current operation — hosting and infrastructure: Vercel provides hosting and processes hosting data on our behalf. When you visit, its infrastructure processes connection and request data needed to deliver the website, including your IP address and the requested resource. This may include timestamps, browser information, status codes and the referring page. The purposes are website delivery, reliability and security. Direct email enquiries are processed through Google Workspace; their contents do not pass through Vercel via this website.
The Vercel hosting contract is currently held by Harvey Gregory Scott Blackburn personally. The account has not yet been transferred to DBD. Updating the account to the registered company is planned.
The legal basis is Article 6(1)(f) GDPR: our legitimate interest in providing a secure, functional company website. Vercel and its relevant subprocessors receive this data. No additional project log drains are configured. The contact function runs in Frankfurt (fra1); that does not establish that all Vercel or Google processing takes place within the EEA.
The reviewed account settings indicate Vercel Observability Plus for this project, with documented runtime-log retention of 30 days. The application does not log form contents or SMTP error details. No additional log exports are configured. Within our business, access is restricted to the account owner for security and troubleshooting.
Vercel’s Data Processing Addendum (opens in a new tab) applies to processing on our behalf. It includes EU Standard Contractual Clauses for applicable transfers outside the EEA. Vercel also processes certain service-generated metadata for its own purposes under its privacy notice. The 30-day period concerns runtime logs; other provider records and backups follow separate retention arrangements.
3. Domain and DNS
Namecheap is the domain registrar and provides authoritative DNS. DNS queries and technical metadata may be processed when resolving the domain. An authoritative DNS service typically sees queries from the visitor’s DNS resolver; this is not equivalent to receiving a complete website visit or email contents. The purpose is to make the website reachable, with Article 6(1)(f) GDPR as the legal basis.
4. Cookies, analytics and external content
The site itself sets no cookies. After you choose, local browser storage under dbd-consent-v1 holds only the consent version, your analytics choice, and the choice and expiry timestamps for 180 days. This implements your preference; it stores no visitor identifier. Nothing is stored before you choose. If storage is unavailable, your choice applies only to the current page. Storing the privacy preference you request relies on section 25(2)(2) TDDDG and Article 6(1)(f) GDPR.
Optional analytics is currently disabled; no analytics data is sent. Consent is voluntary, is not preselected, and can be withdrawn at any time through “Cookie settings” in the footer. You can use the site and contact form without analytics. Withdrawal stops future events; it does not undo processing that has already occurred. Activated analytics relies on Article 6(1)(a) GDPR and, where applicable, section 25(1) TDDDG.
When permitted, a locally hosted script loaded only after consent sends pageviews and the events ContactSubmission or PartnerSubmission after a successful response from the contact endpoint to Plausible. The payload contains only the event name, configured domain and fixed page address without query parameters or fragments. It excludes names, email addresses, messages, form values and referrer addresses. Events from before consent are not sent retrospectively.
The intended provider is Plausible Insights OÜ, Estonia. The direct connection necessarily includes the IP address and User-Agent. According to the provider, these support time-limited visitor counting and are not stored as raw IP addresses or permanent visitor identifiers. Plausible does not eliminate all personal-data processing. TODO-CONFIRM: verify the account, data processing agreement, current subprocessors and processing locations, and retention and deletion arrangements before activation. Plausible data policy (opens in a new tab).
No advertising pixels, session recordings or Vercel Web Analytics/Speed Insights scripts are included. Fonts come from your device. Images and stylesheets are hosted locally. There are no embedded videos, maps or social-media widgets. The contact form uses local scripts and an endpoint on this site, without a CAPTCHA or external form widget. Technical processing by the host still takes place.
5. Contact form and email
Enquiry form — fast contact
The enquiry form is live and provides an additional channel for direct contact. We aim to respond within one hour during our contact hours: 08:00–20:00 German local time (CET/CEST), Monday–Sunday. Messages received outside these hours are handled when contact hours resume.
The form collects your name, email address, enquiry type and message. Organisation is optional. These details are used to consider and answer your enquiry. Please do not send patient information or other sensitive personal data.
Processing of submitted enquiry contents: submitted details travel over an encrypted connection to this website’s Vercel function and, after validation, through an encrypted SMTP connection to Google Workspace for delivery to our contact address. Vercel processes submitted enquiry contents alongside Google Workspace, in addition to its hosting role. Their relevant subprocessors may participate. Hosting infrastructure may process connection metadata such as your IP address; the application does not add it to the notification email.
The application has no form database and does not log message contents. Enquiries are stored in the Google Workspace mailbox for handling; sending may also create message copies there. Provider logs and backups follow their separate retention arrangements. This form does not transmit unsubmitted field values or save them in browser storage.
Server-side validation, a hidden honeypot field and request limits help prevent automated abuse. The rate limit uses a keyed, pseudonymous value derived from the IP address, processed by Vercel. This value is not anonymous. Form contents are not passed to the counter service. Counters use ten-minute windows; that does not mean every security record is deleted after ten minutes. The security processing serves our legitimate interest in protecting the form under Article 6(1)(f) GDPR. No CAPTCHA service, marketing automation or additional tracking service is used.
Form notifications are delivered to info@drblackburndigital.com through Google Workspace. Selecting Frankfurt for the function does not exclude processing in other countries.
Direct email — current operation
Email links open your email application. A message is sent only when you choose to send it. We process the contact details, message content and associated communication data you provide to handle your enquiry.
You can contact us directly by email. Company email is processed through Google Workspace. Google processes the contact details, message contents and associated communication and delivery data. Our public contact address is info@drblackburndigital.com. Simply visiting this website does not load Google Workspace in your browser. Article 6(1)(b) GDPR may apply to enquiries about entering a contract with you; Article 6(1)(f) GDPR may apply to other business enquiries.
The Workspace account is currently operated by Harvey Gregory Scott Blackburn personally, trading as ZazaTechnologies. ZazaTechnologies is his business trading name (Geschäftsbezeichnung), not a separate legal entity. The DBD contact address is an alias in Greg’s existing Workspace account, not a separate DBD mailbox. Greg is the only person handling enquiries within the business and is the Workspace super administrator. Google and its authorised service providers may process data to provide the service. Moving the account’s ownership and billing to DBD and creating a separate contact mailbox are planned; these changes have not yet taken place. This notice will be updated when the arrangements change.
Google processes Workspace enquiry data under its Cloud Data Processing Addendum (opens in a new tab), formerly the Google Workspace Data Processing Amendment. Its applicable transfer provisions govern processing outside the EEA. This does not mean email is stored or processed only within the EU.
We use no CRM, helpdesk or marketing automation. Automatic form validation and email delivery serve only to handle your enquiry; no separate marketing consent is collected.
Retention of enquiries
Our policy is to delete ordinary enquiries that do not lead to a business relationship within six months after correspondence closes. This covers the enquiry and related correspondence in the mailbox, including relevant Sent and Trash copies. Where a legal retention obligation or an open dispute requires longer storage, the relevant records are retained for that purpose. The policy applies to direct email and form enquiries. Records relating to business relationships may have separate statutory retention requirements. Provider backup and log retention follow separate arrangements; the six-month policy is not a promise that every provider backup is erased within that period.
6. External links
Links to LinkedIn, Google Scholar, eLearning Industry and academic publishers lead to independent websites. These services are not embedded or loaded simply by visiting this site. Once you follow a link, the destination website’s privacy information applies.
7. Your rights
Subject to the GDPR’s conditions, you have rights to access, rectification, erasure, restriction of processing and, where applicable, data portability. Where processing relies on legitimate interests, you may object on grounds relating to your particular situation. Contact us at the email address above to exercise these rights.
You may complain to a data-protection supervisory authority. In Saarland, this is the Independent Data Protection Centre Saarland (opens in a new tab). The website functions described here do not provide for automated decisions with legal or similarly significant effects.