Privacy Policy

Who is responsible for data collection?

Data processing on this website is carried out by the website operator. Their contact details can be found in the "Data Controller" section of this privacy policy.

How do we collect your data?

On the one hand, your data is collected when you provide it to us. This may, for example, be data that you enter in a contact form.

Other data is collected automatically or with your consent when you visit the website through our IT systems. This is primarily technical data (e.g., internet browser, operating system, or time of page access). This data is collected automatically as soon as you enter this website.

What do we use your data for?

Some of the data is collected to ensure error-free provision of the website. Other data may be used to analyze your user behavior.

What rights do you have regarding your data?

You have the right to receive information free of charge at any time about the origin, recipient, and purpose of your stored personal data. You also have the right to request the correction or deletion of this data. If you have given consent to data processing, you can revoke this consent at any time for the future.

Furthermore, you have the right, under certain circumstances, to request the restriction of the processing of your personal data. You also have the right to lodge a complaint with the competent supervisory authority.

External Hosting

This website is hosted by an external service provider (host). The personal data collected on this website is stored on the host's servers. This may primarily include IP addresses, contact requests, meta and communication data, contract data, contact details, names, website accesses, and other data generated via a website.

Hosting Provider:
Cloudflare, Inc.
101 Townsend St
San Francisco, CA 94107, USA
Server Location: Global edge network; requests are processed at the nearest data center, which may be outside the EU

The use of the host is for the purpose of contract fulfillment towards our potential and existing customers (Art. 6 Para. 1 lit. b GDPR) and in the interest of a secure, fast, and efficient provision of our online offering by a professional provider (Art. 6 Para. 1 lit. f GDPR).

Data Processing Agreement

We have concluded a data processing agreement (DPA) for the use of the above-mentioned service. This is a contract required by data protection law, which ensures that this party processes the personal data of our website visitors only according to our instructions and in compliance with the GDPR.

Purpose and data processed

We use Cloudflare Workers and D1 to process and store contact and quote requests, bookings, subscription preferences, consent records and website statistics. Depending on the feature, this includes names, contact details, messages, appointment details, technical connection data and preferences you provide.

Cloudflare Email Service delivers requested messages such as booking confirmations, reminders, verification links and download links. This involves recipient addresses, message content, any attachments and delivery information. Newsletter and marketing campaign delivery is currently disabled.

Provider and data location

The provider is Cloudflare, Inc., 101 Townsend Street, San Francisco, CA 94107, USA. Our D1 database is restricted to the European Union. This setting covers where the database runs and stores data. Processing by Workers, the email service and support may also take place outside the EU.

See Cloudflare's Privacy Policy and Data Processing Addendum for information about processing and international transfers. The addendum describes processing arrangements and transfer safeguards, including standard contractual clauses where required.

Legal basis and retention

Depending on the activity, processing relies on Article 6(1)(b) GDPR (requests and contract performance), Article 6(1)(a) GDPR (consent), or Article 6(1)(f) GDPR (technical operation and security). Retention depends on the purpose and periods described in this policy. Message content in our delivery queue is deleted 30 days after acceptance by the email service. Technical sending receipts remain to prevent duplicate messages.

Data Protection

The operators of these pages take the protection of your personal data seriously. We treat your personal data confidentially and in accordance with legal data protection regulations and this privacy policy.

When you use this website, various personal data is collected. Personal data is data by which you can be personally identified. This privacy policy explains what data we collect and what we use it for. It also explains how and for what purpose this happens.

SSL and TLS Encryption

For security reasons and to protect the transmission of confidential content, such as orders or inquiries that you send to us as the site operator, this site uses SSL or TLS encryption. You can recognize an encrypted connection by the fact that the address line of the browser changes from "http://" to "https://" and by the lock symbol in your browser line.

If SSL or TLS encryption is activated, the data you transmit to us cannot be read by third parties.

Revocation of Your Consent to Data Processing

Many data processing operations are only possible with your express consent. You can revoke consent you have already given at any time. The legality of the data processing carried out until the revocation remains unaffected by the revocation.

Right to Object to Data Collection in Special Cases

If data processing is based on Art. 6 Para. 1 lit. e or f GDPR, you have the right at any time to object to the processing of your personal data for reasons arising from your particular situation; this also applies to profiling based on these provisions. The respective legal basis on which processing is based can be found in this privacy policy.

Right to Lodge a Complaint with the Competent Supervisory Authority

In the event of violations of the GDPR, data subjects have the right to lodge a complaint with a supervisory authority, in particular in the member state of their habitual residence, their place of work, or the place of the alleged violation. The right to lodge a complaint is without prejudice to other administrative or judicial remedies.

Competent Supervisory Authority for Hamburg:
The Hamburg Commissioner for Data Protection and Freedom of Information
Ludwig-Erhard-Str. 22, 7th Floor
20459 Hamburg
Phone: 040 / 428 54 - 4040
Email: mailbox@datenschutz.hamburg.de

Right to Access

You have the right to request confirmation as to whether relevant data is being processed and to receive information about this data as well as further information and a copy of the data in accordance with Art. 15 GDPR.

Right to Rectification

In accordance with Art. 16 GDPR, you have the right to request the completion of data concerning you or the correction of inaccurate data concerning you.

Right to Erasure

You have the right to request that data concerning you be deleted immediately if one of the reasons listed in detail in Art. 17 GDPR applies, e.g., if the data is no longer needed for the purposes pursued.

Right to Restriction of Processing

You have the right to request the restriction of the processing of your personal data if one of the conditions in Art. 18 GDPR is met, e.g., if you have objected to processing, for the duration of the examination by the controller.

Right to Data Portability

You have the right to receive the personal data concerning you that you have provided to us in a structured, commonly used, and machine-readable format, and you have the right to transmit this data to another controller without hindrance from us, provided that processing is based on consent pursuant to Art. 6 Para. 1 lit. a GDPR or Art. 9 Para. 2 lit. a GDPR or on a contract pursuant to Art. 6 Para. 1 lit. b GDPR.

Server Log Files

The provider of the pages automatically collects and stores information in so-called server log files, which your browser automatically transmits to us. These are:

• Browser type and browser version
• Operating system used
• Referrer URL
• Hostname of the accessing computer
• Time of server request
• IP address

This data is not merged with other data sources. Data collection is based on Art. 6 Para. 1 lit. f GDPR. The website operator has a legitimate interest in the technically error-free presentation and optimization of their website. For this purpose, server log files must be recorded.

Contact Form

If you send us inquiries via the contact form, your details from the inquiry form, including the contact details you provide there, will be stored by us for the purpose of processing the inquiry and in case of follow-up questions. We do not pass on this data without your consent.

The processing of this data is based on Art. 6 Para. 1 lit. b GDPR if your inquiry is related to the fulfillment of a contract or is necessary for the implementation of pre-contractual measures. In all other cases, processing is based on our legitimate interest in the effective processing of inquiries sent to us (Art. 6 Para. 1 lit. f GDPR) or on your consent (Art. 6 Para. 1 lit. a GDPR) if this was requested.

We store the data you enter in the contact form until the end of the third calendar year after your inquiry. This matches the regular limitation period (Sections 195, 199 BGB), so we can defend against possible claims (Art. 17(3)(e) GDPR). The data is then deleted automatically. If your inquiry leads to an offer or contract, we keep the related business correspondence for 6 years (Section 257 HGB, Section 147 AO). You can request earlier deletion at any time, unless a statutory retention obligation applies.

Inquiry by Email, Phone, or Fax

If you contact us by email, phone, or fax, your inquiry, including all resulting personal data (name, inquiry), will be stored and processed by us for the purpose of processing your request. We do not pass on this data without your consent.

The processing of this data is based on Art. 6 Para. 1 lit. b GDPR if your inquiry is related to the fulfillment of a contract or is necessary for the implementation of pre-contractual measures. In all other cases, processing is based on our legitimate interest in the effective processing of inquiries sent to us (Art. 6 Para. 1 lit. f GDPR) or on your consent (Art. 6 Para. 1 lit. a GDPR) if this was requested.

Legal Basis

The use of cookies and similar technologies is based on § 25 TDDDG (Telecommunications Digital Services Data Protection Act, formerly TTDSG) and Art. 6 Para. 1 lit. a GDPR (consent) if consent was requested, as well as on Art. 6 Para. 1 lit. f GDPR for technically necessary cookies.

What are Cookies?

Our website uses cookies and similar technologies. Cookies are small text files that are stored on your device. They do not cause any damage and do not contain viruses. Cookies enable us to offer certain functions and improve your user experience.

Types of Cookies

• Necessary Cookies (Required): These cookies are absolutely necessary for the basic functions of the website. Without these cookies, the website cannot function properly. They are set based on Art. 6 Para. 1 lit. f GDPR (legitimate interest).
• Analytical Cookies (Optional): These cookies help us analyze the use of our website and understand how visitors interact with the website. They are only set with your express consent according to Art. 6 Para. 1 lit. a GDPR and § 25 Para. 1 TDDDG.
• Marketing Cookies (Optional): These cookies are used to follow visitors across websites. The intention is to display ads that are relevant and engaging for the individual user. They are only set with your consent.

Cookie Consent & Management

When you first visit our website, a cookie banner appears where you can decide which cookie categories you want to allow. Your consent is voluntary and you can change your decision at any time.

You can change or revoke your cookie settings at any time via the "Cookie Settings" link in the footer of our website. Cookies already set can be deleted at any time in your browser settings.

Browser Settings

You can configure your browser so that:

• You are informed about the setting of cookies
• Cookies are only allowed in individual cases
• The acceptance of cookies is generally excluded
• Cookies are automatically deleted when closing the browser

If you deactivate cookies, the functionality of our website may be limited.

Storage Duration of Cookies

Session Cookies: Are automatically deleted after closing your browser.
Persistent Cookies: Remain stored for a specified period (usually 1-24 months, depending on cookie type) or until you manually delete them.

Compliance with TDDDG (formerly TTDSG)

We comply with the requirements of the TDDDG (Telecommunications Digital Services Data Protection Act). Non-essential cookies are only set after your express consent. Your consent is logged and can be revoked at any time.

Purpose of Use

We use Cloudflare Turnstile on our forms to protect our website from spam and abuse. The service checks whether the input is made by a human or through automated, machine processing.

Provider

Cloudflare, Inc.
101 Townsend St
San Francisco, CA 94107, USA
Cloudflare Privacy Policy

Data Processing

For the check, Cloudflare processes in particular the following data:

• Your IP address
• Information about your browser and device, such as the user agent
• The result of the check

When you submit a form, we send the check result and your IP address to Cloudflare for verification. We only load the Turnstile widget after you have given consent in the cookie settings. Without consent you can still submit our forms; we then protect them with a hidden field, a timing check and a request limit.

Legal Basis

Processing is based on your consent pursuant to Art. 6 Para. 1 lit. a GDPR and Section 25(1) TDDDG. You can withdraw your consent at any time in the cookie settings.

Data Transfer

Cloudflare operates a global edge network; requests are processed at the nearest data center, which may be outside the EU. For transfers to the USA, we rely on the EU Standard Contractual Clauses in the Cloudflare Data Processing Addendum and on Cloudflare's certification under the EU-U.S. Data Privacy Framework (adequacy decision of the European Commission).

Further Information

Further information on Cloudflare Turnstile can be found in Cloudflare's Privacy Policy .

Google Analytics 4

This website uses Google Analytics 4, a web analytics service provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland ("Google"). Google Analytics uses cookies and similar technologies that enable analysis of your use of the website.

Scope of Data Processing

The information generated by cookies about your use of this website is usually transferred to a Google server and stored there. The following data is collected:

• Pages visited and time spent
• Scroll depth (25%, 50%, 75%, 90% and 100% of the page)
• Form interactions and submissions with form IDs
• Clicks on our phone number and email address
• Video engagement (start, progress, completion)
• File downloads
• Search queries on the website
• Outbound links (outbound clicks)
• Device information (type, browser, operating system, screen resolution)
• Geographic data (country, region and city, based on IP address)
• Traffic sources (referrer, campaign parameters)

IP Addresses

According to Google, Google Analytics 4 does not log or store IP addresses. GA4 therefore has no separate IP anonymization setting of the kind the former Universal Analytics offered.

Purpose of Data Processing

On behalf of the operator of this website, Google will use this information to evaluate your use of the website, to compile reports on website activity, and to provide other services related to website use and internet use to the website operator.

Legal Basis

Processing is based on your consent according to Art. 6 Para. 1 lit. a GDPR and § 25 Para. 1 TDDDG. Consent can be revoked at any time.

Data Transfer to the USA

Google also processes your data in the USA. Data transfer to the USA is based on the EU-US Data Privacy Framework.

Note: A legal challenge to the adequacy decision was dismissed by the EU General Court in September 2025. An appeal is pending before the CJEU (Case C-703/25 P). The adequacy decision remains valid until a contrary ruling.

Storage Duration

Data sent by us and linked to cookies is automatically deleted after 14 months. Deletion of data whose retention period has been reached occurs automatically once a month.

Objection and Deactivation

You can prevent the collection and processing of your data by Google Analytics by:

• Revoking your cookie consent (via our cookie settings)
• Installing the browser add-on to deactivate Google Analytics: https://tools.google.com/dlpage/gaoptout

Further Information

More information on the handling of user data at Google Analytics can be found in Google's privacy policy: https://support.google.com/analytics/answer/6004245

Cloudflare Web Analytics

With your consent, we use Cloudflare Web Analytics, a service of Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107, USA. The service shows us how fast our pages load and which pages are viewed. For this purpose, your browser loads a script from static.cloudflareinsights.com. It reads performance data through the browser's Performance API, such as load times, the visited and the referring page, and the browser type, and sends it to Cloudflare.

No cookies are set and no data is stored on your device. Cloudflare does not create user profiles and does not track you across different websites. Your IP address is transmitted for technical reasons. According to Cloudflare, it is discarded at the nearest data center and not stored.

The legal basis is your consent under Art. 6(1)(a) GDPR and Section 25(1) TDDDG. You can withdraw your consent at any time with effect for the future via the cookie settings.

Cloudflare is certified under the EU-US Data Privacy Framework (adequacy decision under Art. 45 GDPR). In addition, a data processing agreement with standard contractual clauses is in place.

Further information: https://www.cloudflare.com/privacypolicy/

Anonymous Reach Measurement

If you consent to "Anonymous reach measurement" in the cookie banner, your browser sends a short message to our own server on each page view. We use it to build anonymous, aggregated statistics (page, device type, browser, country, referring domain, hour of the visit). No visitor ID, session ID or IP address is stored. Without your consent, nothing is measured.

The legal basis is your consent under Section 25(1) TDDDG and Art. 6(1)(a) GDPR. You can withdraw it at any time with effect for the future via the cookie settings. As the aggregated statistics contain no personal data, they are not subject to a deletion period and are kept permanently.

Internal Usage Analysis (with consent)

If you consent to the internal usage analysis in the cookie settings, your browser creates a random visitor ID and a session ID in LocalStorage. It then sends an event to our server on page views, while you scroll, when you click links or buttons and when you submit a form. We process:

• Visitor ID and session ID
• Page path, event type and scroll depth
• Text and target of clicked links and buttons, and the ID and name of submitted forms, without your entries
• Referring page and campaign parameters (UTM)
• Screen size, plus device type, browser and operating system from the user agent
• Start, duration and number of page views of a session

We store this data in our database at Cloudflare (see section 3a) and do not share it with third parties. We do not write your IP address to the database. The legal basis is your consent under Section 25(1) TDDDG and Art. 6(1)(a) GDPR. We delete the data 12 months after the last activity. You can withdraw your consent at any time in the cookie settings.

What is LocalStorage?

In addition to cookies, we also use LocalStorage technology to store data locally in your browser. LocalStorage allows us to permanently store information on your device without it being transmitted to the server with every request.

Used LocalStorage Data

We store the following information in your LocalStorage:

• Cookie Consent Status: Your decisions regarding cookie categories (necessary, analytical, marketing)
• Language: Your preferred language (German or English)
• Project Calculator: Your entries in the project calculator on the pricing page
• Statistics (only with consent): A pseudonymous visitor and session ID
• Form Drafts: Your form entries in SessionStorage, so they survive an accidental reload. The browser deletes them when you close the tab.

Legal Basis

Storage is based on:

• Section 25(2) No. 2 TDDDG and Art. 6 Para. 1 lit. f GDPR (legitimate interest) for storage that is strictly necessary for a service you requested, such as your cookie choice or your language
• Section 25(1) TDDDG and Art. 6 Para. 1 lit. a GDPR (consent) for statistics

Storage Duration and Deletion

LocalStorage data remains permanently stored in your browser until you manually delete it. You can delete all LocalStorage data at any time via your browser settings:

• Chrome: Settings → Privacy and security → Clear browsing data → Site data
• Firefox: Settings → Privacy & Security → Cookies and Site Data → Clear Data
• Safari: Settings → Privacy → Manage Website Data
• Edge: Settings → Privacy, search, and services → Clear browsing data

Functional Description

We offer an online booking system on our website through which you can book consultation appointments and services directly. This lets you schedule an appointment without calling us.

Processed Data

When using the booking system, the following data is collected:

• First name and last name
• Email address
• Phone number (optional)
• Company name (if applicable)
• Desired service / type of consultation
• Appointment request (date and time)
• Additional notes or concerns
• IP address at time of booking
• Confirmation and cancellation tokens (technically required)

Email delivery through Cloudflare

We use Cloudflare Email Service to send booking confirmations, reminders and cancellation confirmations. This involves your email address and the content needed for the message. Section 3a describes the provider, data transfers and storage.

Purpose of Processing

Data processing is carried out for the following purposes:

• Execution and management of your appointment booking
• Sending booking confirmations and reminders
• Enabling appointment changes and cancellations
• Preparation for the consultation appointment
• Documentation of the contractual relationship

Legal Basis

Processing of your data is based on Art. 6 Para. 1 lit. b GDPR for the fulfillment of a contract or the implementation of pre-contractual measures. Providing the data is necessary for the appointment booking. Without this data, we cannot carry out the booking.

Storage Duration

We store your booking data for the duration of contract processing and beyond until the end of the third calendar year after the appointment (limitation period, Sections 195, 199 BGB). This serves traceability for questions and the defense against possible claims. Name and contact details are then anonymized automatically. Statutory retention periods for invoices and business correspondence remain unaffected.

Your Rights

You can reschedule or cancel the appointment with the links in your confirmation email. For access to, correction or deletion of your booking data, send us an email. If you delete your data, the booked appointment will also be automatically canceled.

Free Resources and Guides

We offer free resources such as e-books, guides, checklists, whitepapers, and other downloadable materials on our website. To download these resources, you are usually required to provide your contact details.

Processed Data

When requesting download resources, we collect the following data:

• First name and last name
• Email address
• Company name (optional)
• Requested resource / topic area
• Download time and date
• Device information (browser, operating system)
• IP address at time of download

Email delivery through Cloudflare

We use Cloudflare Email Service to send requested download links. This involves your email address and the content needed for the message. Section 3a describes the provider, data transfers and storage.

Purpose of Processing

Data processing is carried out for the following purposes:

• Providing the requested download resources
• Lead generation and contact for marketing purposes (only with consent)
• Analysis of user interests to improve our offering
• Sending further information and offers (only with consent)
• Personalization of future communication

Legal Basis

Processing of your data is based on:

• Art. 6 Para. 1 lit. a GDPR (consent) for providing the resource and for marketing communication
• Art. 6 Para. 1 lit. f GDPR (legitimate interest) for analyzing download activities to optimize our offering

Providing contact details is voluntary but necessary for downloading resources. When requesting, you can optionally consent to us contacting you for marketing purposes. This consent is independent of the download and can be granted or refused separately.

Storage Duration

Your data is stored as long as you do not object to processing and no deletion reason exists. If you have consented to marketing communication, your data will be stored until revocation, at the latest until the end of the third calendar year after the last interaction. The data, including download logs, is then deleted automatically.

Revocation and Deletion

You can revoke your consent to process your data at any time. Send an email to ed.tirones@tkatnok for this purpose. After revocation, your data will be deleted immediately unless there are legal retention periods. Downloaded resources remain with you.

Performance Monitoring

We measure how fast our pages load for real visitors and how quickly they respond to input. This shows us technical problems that lab tests miss.

Collected Metrics

After a page view, your browser sends the following values to our server:

• Core Web Vitals: Largest Contentful Paint (LCP), Interaction to Next Paint (INP) and Cumulative Layout Shift (CLS)
• The measured value, its rating (good, needs improvement, poor) and a random measurement ID
• The type of page view, such as a reload or back navigation
• The path of the page, without URL parameters
• The time of the measurement

We collect no session ID and no device or browser data, and we set no cookies for this. For technical reasons your IP address also reaches our server. We do not add it to the stored values.

Purpose of Processing

We use the values to check load time, responsiveness and layout stability of our pages and to fix errors.

Legal Basis

We only measure if you have agreed to anonymous reach measurement in the cookie settings. The legal basis is your consent under § 25(1) TDDDG for reading the values in your browser and Art. 6 Para. 1 lit. a GDPR for the processing. You can withdraw your consent at any time in the cookie settings. The values contain no information that would allow us to identify you.

Storage Duration

The values only end up in the server logs of our hosting provider Cloudflare (Workers Logs). Cloudflare deletes these logs after 7 days at the latest.

No Disclosure to Third Parties

We do not pass the values on to third parties. Cloudflare stores the logs on our behalf as our hosting provider.

Campaign delivery is paused

We currently send no newsletters or marketing campaigns. Existing subscription preferences, consent and unsubscribe records are retained. Signing up triggers an email to verify your address; it does not start a marketing campaign.

Registration and records

We store your email address, any name and preferences you provide, registration, confirmation and unsubscribe times, and technical data collected during registration. Email verification (double opt-in) helps prevent registrations using someone else's address. Processing your registration relies on consent under Article 6(1)(a) GDPR. Keeping evidence of consent and withdrawal serves our legitimate interest under Article 6(1)(f) GDPR.

Provider and withdrawal

These records are stored in our Cloudflare database. Verification links are sent through Cloudflare Email Service. Section 3a describes the provider, data location and transfers.

You can withdraw consent at any time using an existing unsubscribe link or by contacting us. We then mark your address as unsubscribed. Registration and withdrawal records are retained only as needed to document or respect your withdrawal. Your statutory rights to erasure remain unaffected.