Privacy Policy
Last updated: September 12, 2026
This Privacy Policy explains how personal data is processed when you visit and use Larasell at https://larasell.dev/ (the "Website").
The Website is operated by a sole proprietor (Einzelunternehmer) based in Germany and is subject to the General Data Protection Regulation (GDPR/DSGVO) and applicable German data protection laws.
1. Controller
The controller responsible for processing personal data on this Website is:
Nils Haberkamp
Larasell
Bernhardstraße 14A
48727 Billerbeck
Germany
Email: nils@larasell.dev
2. General information about data processing
We process personal data only to the extent necessary to provide and operate this Website, respond to enquiries, maintain the security of our systems, and comply with legal obligations.
"Personal data" means any information relating to an identified or identifiable natural person, such as an IP address, email address, or information contained in a message you send to us.
Where applicable, we process personal data on the basis of the following legal grounds under Article 6 GDPR:
- Art. 6(1)(a) GDPR — consent;
- Art. 6(1)(b) GDPR — processing necessary to perform a contract or take steps at your request before entering into a contract;
- Art. 6(1)(c) GDPR — compliance with a legal obligation;
- Art. 6(1)(f) GDPR — our legitimate interests, provided that those interests are not overridden by your interests or fundamental rights and freedoms.
3. Visiting the Website
When you access the Website, technical information may be processed automatically by the server hosting the Website.
This may include:
- IP address;
- date and time of access;
- requested URL;
- HTTP status code;
- browser type and version;
- operating system;
- referrer URL;
- amount of data transferred; and
- other technically necessary information.
This information is processed to deliver the Website, maintain its stability and security, detect and prevent misuse, and diagnose technical problems.
The legal basis is generally Art. 6(1)(f) GDPR, based on our legitimate interest in operating a secure and reliable website.
Hosting provider: Laravel Cloud (operated by Laravel Holdings Inc.)
60 Broad Street, 24th Floor, #1559
New York, NY 10004
United States
Privacy policy: laravel.com/cloud/legal/privacy
Legal documents (including Data Processing Agreement): laravel.com/legal
Trust Center: trust.laravel.com
Laravel Cloud processes visitor data on our behalf as a processor within the meaning of Art. 28 GDPR. Laravel Cloud's own privacy policy primarily describes how Laravel processes account-holder data; the processing of Website visitor data by Laravel Cloud on our behalf is governed by the applicable customer agreement and Data Processing Agreement.
Server and access logs are retained for between 1 and 30 days, depending on our Laravel Cloud plan (see Laravel Cloud log retention), unless a longer retention period is required for security investigations or by law.
4. Contacting us
If you contact us by email or another communication channel, we process the information you provide, including your email address, name, message, and any attachments or other information contained in your communication.
We use this information solely to process and respond to your enquiry and, where applicable, to take steps before entering into a contract.
The legal basis is Art. 6(1)(b) GDPR where your enquiry relates to a contract or pre-contractual measures, or Art. 6(1)(f) GDPR where we have a legitimate interest in responding to general enquiries.
We retain correspondence only for as long as necessary to handle your enquiry and, where applicable, for the periods required by statutory retention obligations.
5. Cookies and similar technologies
The Website uses cookies and similar technologies.
Cookies are small files or other information that can be stored on your device or accessed from your device when you visit a website.
Under German law, consent is generally required for storing information in or accessing information from a user's device unless a statutory exception applies. In particular, consent is not required where the storage or access is strictly necessary to provide a digital service explicitly requested by the user.
The legal requirements concerning cookies and similar technologies arise in particular from Section 25 TDDDG in conjunction with the GDPR.
Necessary technologies
The Website currently uses the following strictly necessary cookies and similar technologies:
| Name | Type | Purpose | Duration | Legal basis |
|---|---|---|---|---|
appearance | Cookie | Stores your display preference (light, dark, or system) | 1 year | Art. 6(1)(f) GDPR; Section 25(2) No. 2 TDDDG |
appearance | Local storage | Stores your display preference when you change the theme | Until cleared in your browser | Art. 6(1)(f) GDPR; Section 25(2) No. 2 TDDDG |
XSRF-TOKEN | Cookie | Protects against cross-site request forgery when you submit the contact form | Session / up to 2 hours | Art. 6(1)(f) GDPR; Section 25(2) No. 2 TDDDG |
larasell-session | Cookie | Maintains your session for security features such as CSRF protection | Up to 2 hours | Art. 6(1)(f) GDPR; Section 25(2) No. 2 TDDDG |
The session cookie name may vary depending on server configuration, but it serves the purposes described above.
Optional technologies
We do not currently use analytics, advertising, tracking, or other optional technologies that require consent.
Current optional services used by this Website:
- None
6. Analytics
We do not currently use third-party analytics services to analyse visitors to the Website.
7. External links and third-party content
The Website may contain links to external websites or third-party services.
When you follow an external link, the privacy practices of the respective third-party provider apply. We are not responsible for the content or privacy practices of external websites.
Where third-party content is embedded directly into the Website, such as videos, maps, fonts, analytics services, or other external resources, the respective provider may process personal data when that content is loaded.
Third-party services currently embedded or loaded by this Website:
- Bunny Fonts (bunny.net) — delivery of web fonts (Geist, Inter)
8. Fonts and content delivery networks
The Website loads web fonts from an external content delivery network.
When fonts are requested from the provider's servers, your IP address and technical connection information may be transmitted to that provider.
Provider: BunnyWay d.o.o. (Bunny Fonts / bunny.net)
Dunajska cesta 165, 1000 Ljubljana, Slovenia
Purpose: Delivery of web fonts (Geist, Inter)
Legal basis: Art. 6(1)(f) GDPR
Provider privacy policy: bunny.net/privacy
9. Data sharing with third parties
We do not sell personal data.
Personal data may be disclosed to third parties where this is necessary to operate the Website, provide requested services, fulfil contractual or legal obligations, or where we have another lawful basis for doing so.
Possible recipients may include:
- hosting and infrastructure providers (Laravel Cloud);
- font and content delivery providers (Bunny Fonts);
- email and communication providers;
- IT and security service providers;
- professional advisers, where necessary; and
- public authorities where legally required.
Where we use processors within the meaning of Art. 28 GDPR, we enter into the required data processing agreements where applicable.
10. International data transfers
Some of the providers we use process personal data in countries outside the European Economic Area (EEA), in particular the United States.
Where personal data is transferred to a country outside the EEA, we ensure that an appropriate legal mechanism under applicable data protection law is in place. Depending on the circumstances, this may include an adequacy decision of the European Commission, Standard Contractual Clauses, or another legally recognised transfer mechanism.
In particular, our hosting provider Laravel Cloud (Laravel Holdings Inc., United States) may process personal data in the United States and other jurisdictions. Laravel states that it relies on appropriate safeguards for such transfers, including contractual protections and participation in the EU-U.S. Data Privacy Framework where applicable. Further information is available in Laravel's privacy policy and legal documents.
Our font provider Bunny Fonts (BunnyWay d.o.o.) is established in Slovenia within the EEA.
11. Data retention
We retain personal data only for as long as necessary for the respective processing purpose.
After the purpose has been fulfilled, personal data will generally be deleted unless:
- we are legally required to retain it;
- it is necessary for the establishment, exercise, or defence of legal claims; or
- another lawful basis for continued processing applies.
Statutory retention periods may require certain business and tax-related records to be retained for longer periods.
12. Your rights under the GDPR
Subject to the applicable legal requirements, you have the following rights regarding your personal data:
Right of access
You have the right to request confirmation as to whether we process personal data about you and, where applicable, to obtain a copy of that data.
Right to rectification
You may request correction of inaccurate or incomplete personal data.
Right to erasure
You may request deletion of your personal data where the legal requirements for erasure are met.
Right to restriction of processing
You may request that processing of your personal data be restricted in certain circumstances.
Right to data portability
Where applicable, you have the right to receive personal data that you have provided to us in a structured, commonly used, and machine-readable format.
Right to object
Where processing is based on Art. 6(1)(f) GDPR, you have the right to object to processing on grounds relating to your particular situation.
You may also object to processing for direct marketing purposes at any time.
Right to withdraw consent
Where processing is based on your consent, you may withdraw your consent at any time with effect for the future.
The withdrawal of consent does not affect the lawfulness of processing carried out before the withdrawal.
To exercise any of these rights, please contact:
13. Right to lodge a complaint with a supervisory authority
You have the right to lodge a complaint with a data protection supervisory authority if you believe that the processing of your personal data violates applicable data protection law.
You may contact the data protection authority responsible for your place of residence, place of work, or the location of the alleged infringement.
For a business established in Germany, the competent supervisory authority depends on the federal state (Bundesland) in which the business is established. As we are established in North Rhine-Westphalia (Nordrhein-Westfalen), the competent authority is the Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen (LDI NRW).
14. Data security
We use appropriate technical and organisational measures to protect personal data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure, or unauthorised access.
These measures are reviewed and adapted where appropriate to account for technological developments and the risks associated with the processing.
15. Changes to this Privacy Policy
We may update this Privacy Policy from time to time to reflect changes to the Website, the services we use, applicable legal requirements, or our data processing practices.
The current version will always be published on this page.
Last updated: September 12, 2026