Kontaktformular verschickt wirklich

Abschnitt 06 uebergab die Eingaben bisher dem Mailprogramm der Besucherin.
Jetzt geht der Inhalt per fetch an /api/contact beim Hoster; von dort stellt
der Dienst site-mail die Nachricht ueber das Postfach info@anelia-wolf.com
(Strato) zu - kein Formulardienst eines Dritten. Faellt der Endpunkt aus,
bietet das Formular weiterhin den mailto-Weg an, damit keine Anfrage verloren
geht. Ein unsichtbares Honeypot-Feld haelt automatisierte Sendungen ab.

Die Datenschutzerklaerung zieht mit: neue Ziffer 5 (Kontaktformular) in beiden
Sprachen, Ziffer 2 nennt jetzt drei statt zwei Verarbeitungsfaelle, die
Folgeziffern sind neu durchnummeriert. README und HANDOVER beschreiben den
Weg ebenfalls.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

src/content/en/home.ts

@@ -222,8 +222,12 @@ export const homeEn: HomeContent = {
       },
       submit: "Send enquiry",
       subject: "Enquiry via anelia-wolf.com",
-      note: "Sending opens your own email programme with the message ready to go. No data is passed to third parties.",
-      opened: "Your email programme should have opened. If it did not, write to me directly at the address on the right.",
+      note: "Your message goes straight to my inbox. No form service, nothing passed to third parties.",
+      submitBusy: "Sending …",
+      sending: "Sending your message …",
+      sent: "Thank you – your message has arrived. I will come back to you shortly.",
+      error: "That did not work just now. Please send it to me by email instead:",
+      errorLink: "Open email",
       privacy: "Privacy",
     },
     links: {

src/content/en/legal.ts

@@ -160,10 +160,10 @@ export const datenschutzEn: LegalPage = {
         "– sets no cookies and stores no information on your device (no local storage, no session storage),",
         "– uses no analytics, tracking or marketing services (no Google Analytics, no pixels, no fingerprinting),",
         "– embeds no third-party content (no external fonts, no videos, no maps, no social media plugins),",
-        "– does not send the contact form itself: it assembles an email from what you enter and hands it to your own email programme. Until you send that message there, no data is transmitted to me or to anyone else,",
+        "– sends the contact form via the hosting provider's server directly to my email inbox (section 5); no third-party form service is involved,",
         "– contains no newsletter.",
         "All fonts, scripts and images are delivered from the server of the hosting provider named below. A cookie banner is therefore not required.",
-        "Personal data is processed in two cases only: when the pages are technically retrieved (server log files, section 3) and when you contact me by email or telephone (section 4).",
+        "Personal data is processed in three cases only: when the pages are technically retrieved (server log files, section 3), when you contact me by email or telephone (section 4) and when you submit the contact form (section 5).",
       ],
     },
     {
@@ -208,26 +208,38 @@ export const datenschutzEn: LegalPage = {
       ],
     },
     {
-      h2: "5. External links",
+      h2: "5. Contact form",
+      paragraphs: [
+        "When you submit the contact form on the home page, the data you enter (name, email address, optionally your company and the content of your message) is transmitted in encrypted form to the hosting provider's server (section 3) and delivered from there as an email to my inbox. The email also records the time of sending and the page from which the form was submitted. No third-party form service is involved, and no cookies are set.",
+        "Purpose: receiving and answering your enquiry.",
+        "Legal basis: Art. 6 (1) (b) GDPR where your enquiry is aimed at entering into or performing a contract; otherwise Art. 6 (1) (f) GDPR – legitimate interest in answering enquiries.",
+        "Storage period: the hosting provider's server does not store the form data permanently; it delivers it immediately as an email. The periods set out in section 4 then apply to that email.",
+        "Recipients: the hosting provider (section 3) and my email provider (section 4), each as a processor pursuant to Art. 28 GDPR. Your data is not passed on to any other third parties.",
+        "To guard against automated messages the form contains a field that is invisible to you and is filled in only by programmes; in addition the server limits the number of submissions per IP address within a short period. Your IP address is processed in memory only for that purpose, is not stored and is not included in the email.",
+        "Providing your data is voluntary. Without your name, email address and message I cannot answer your enquiry; you are welcome to reach me directly by email or telephone instead (section 4).",
+      ],
+    },
+    {
+      h2: "6. External links",
       paragraphs: [
         "This website contains links to external websites (e.g. LinkedIn, herCAREER). Simply clicking a link transmits no data from this website to the operator of the target page; from the moment you open the target page, only that provider's privacy policy applies. Social media plugins, share buttons and tracking pixels belonging to those providers are not embedded on this website.",
         "LinkedIn is operated by LinkedIn Ireland Unlimited Company, Wilton Place, Dublin 2, Ireland. Privacy policy: https://www.linkedin.com/legal/privacy-policy",
       ],
     },
     {
-      h2: "6. Fonts",
+      h2: "7. Fonts",
       paragraphs: [
         "The fonts used on this website (Playfair Display, Source Sans 3, DM Mono) are stored locally on the web server and are delivered from there only. No connection is made to servers operated by Google (Google Fonts) or any other font provider; your IP address is therefore not transmitted to any third party.",
       ],
     },
     {
-      h2: "7. Encryption",
+      h2: "8. Encryption",
       paragraphs: [
         "This website uses TLS/SSL encryption (recognisable by “https://” and the padlock symbol in your browser's address bar). Data transferred between your browser and the server cannot therefore be read by third parties.",
       ],
     },
     {
-      h2: "8. Your rights as a data subject",
+      h2: "9. Your rights as a data subject",
       paragraphs: [
         "You have the following rights in respect of the personal data concerning you:",
         "– right of access (Art. 15 GDPR),",
@@ -254,15 +266,15 @@ export const datenschutzEn: LegalPage = {
       ],
     },
     {
-      h2: "9. Obligation to provide data, automated decision-making",
+      h2: "10. Obligation to provide data, automated decision-making",
       paragraphs: [
         "You are under no statutory or contractual obligation to provide your personal data. Without your contact details, however, I cannot answer an enquiry. Automated decision-making, including profiling (Art. 22 GDPR), does not take place.",
       ],
     },
     {
-      h2: "10. Changes to this privacy notice",
+      h2: "11. Changes to this privacy notice",
       paragraphs: [
-        "I update this privacy notice whenever the website or the legal situation changes – for example if a server-side contact form, a newsletter, online appointment booking or embedded video is introduced. The version published on this page at the time applies.",
+        "I update this privacy notice whenever the website or the legal situation changes – for example if a newsletter, online appointment booking or embedded video is introduced. The version published on this page at the time applies.",
       ],
     },
   ],