Privacy Policy

Protecting your personal data matters to me. Below you will find the information required under Articles 13 and 14 GDPR: which data is processed when you visit this website, why, and what rights you have.

1. Controller

Leyla Heinen
Manacor, Mallorca, Spain
Phone: +49 157 75075051
Email: leylaheinen@gmail.com

I am not required to appoint a data protection officer, as the conditions of Article 37 GDPR are not met.

2. Hosting and server log files

This website is hosted by a service provider in Germany (IONOS SE, Elgendorfer Str. 57, 56410 Montabaur). When a page is requested, the server automatically records information that your browser transmits and that is technically necessary to deliver the page:

  • the page requested, plus date and time of access
  • the volume of data transferred and confirmation of successful retrieval
  • browser type and version, operating system
  • referrer URL, i.e. the previously visited page
  • IP address in shortened or anonymised form

The legal basis is Article 6(1)(f) GDPR; my legitimate interest lies in the technically faultless and secure operation of the website. Log files are deleted automatically by the hosting provider after a short period, unless they are needed to investigate a specific security incident. A data processing agreement under Article 28 GDPR is in place with the hosting provider.

3. Cookies

This website sets no cookies for analytics, marketing or tracking. There is no Google Analytics, no Meta pixel, no advertising network and no comparable service. A cookie banner is therefore not required.

4. Fonts and external content

All fonts are served from my own server. There is no connection to Google Fonts or any other content delivery network, so no IP addresses are transmitted to third parties.

No videos, maps or social media content are embedded. Links to Instagram are plain text links – data is only transferred if you actively click them, and the operators of those sites are then responsible for it.

5. Contact form

When you write to me using the form on the contact page, I process the details you provide: first name, last name, email address, optionally your wedding date and venue, and your message.

The form is sent as an email to my address directly by the web server of this website (IONOS SE, see section 2); no other form service is involved, and the data is not stored on the server. My mailbox is hosted by Google (Gmail).

The legal basis is your consent under Article 6(1)(a) GDPR, given via the checkbox in the form, and – where the enquiry concerns entering into a contract – Article 6(1)(b) GDPR. You may withdraw your consent at any time by email; this does not affect the lawfulness of processing carried out beforehand.

I delete your enquiry once it has been dealt with and no statutory retention periods apply, and after three years at the latest. Commercial and tax retention periods of six and ten years respectively remain unaffected.

6. Contact by email, phone and WhatsApp

If you contact me by email or phone, I process your details in order to deal with your enquiry, on the basis of Article 6(1)(b) or (f) GDPR.

If you contact me via WhatsApp, data is processed by WhatsApp Ireland Ltd. and may be transferred to Meta Platforms Inc. in the USA. I have no influence over that processing. If you would rather avoid it, please use email or the contact form.

While preparing a bridal booking I offer a shared WhatsApp group on request. Taking part is voluntary and the email alternative is always available.

7. Recipients and transfers to third countries

Your data is received only by the hosting provider IONOS SE as a processor and by Google as the provider of my email account, in each case solely to provide the services described. With Google, a transfer to the USA cannot be ruled out; Google is certified under the EU-US Data Privacy Framework (Art. 45 GDPR). Beyond this, data is transferred to third countries only in the case described in section 6.

8. Your rights

Under the GDPR you have the right to:

  • access the data stored about you (Article 15)
  • rectification of inaccurate data (Article 16)
  • erasure of your data (Article 17)
  • restriction of processing (Article 18)
  • data portability (Article 20)
  • object to processing based on legitimate interests (Article 21)
  • withdraw consent with future effect (Article 7(3))

An informal message to the contact details above is enough.

9. Right to lodge a complaint

You have the right to lodge a complaint with a data protection supervisory authority. The authority responsible for me is the Spanish Data Protection Agency: Agencia Española de Protección de Datos (AEPD), C/ Jorge Juan 6, 28001 Madrid, aepd.es. You may also contact the supervisory authority where you live.

10. Obligation to provide data

Providing your data in the contact form is neither legally nor contractually required. Without a name, an email address and a message, however, I cannot answer your enquiry.

11. Automated decision-making

No automated decision-making, including profiling, within the meaning of Article 22 GDPR takes place.

12. Version

Last updated: October 2026. I update this policy whenever the legal situation or the services used on this website change.