1. Controller

The controller responsible for data processing on this website within the meaning of the General Data Protection Regulation (GDPR) is:

No data protection officer has been appointed, as there is no legal obligation to do so (Art. 37 GDPR, Section 38 BDSG). If you have any questions about data protection, please use the contact details above.

2. Summary

• Web analytics (Umami, on our own servers) only takes place with your consent. We do not use third-party advertising or tracking services. Without consent, only your choice in the cookie banner is stored.
• The website runs on our own servers. No third-party content (such as Google Fonts, maps or videos) is loaded.
• IP addresses are recorded only in server log files for security purposes and are deleted automatically after 7 days.
• We use the details you enter in forms and inquiries solely to handle your request.

3. Hosting on our own servers

This website runs on our own servers, which we administer ourselves. The servers are located in the data centre of XSServer GmbH, F.-W.-Raiffeisen-Straße 34, 52531 Übach-Palenberg, Germany. The data centre is located in the Netherlands and thus within the European Union.

XSServer GmbH only provides rack space, power and network connectivity (colocation). It has no access to our systems or to the data stored on them. Personal data is therefore not disclosed to the data centre operator. Traffic between your browser and our server is encrypted (see section 12).

4. Server log files

Every time you visit this website, your browser automatically transmits data to our server. Our web server (Apache HTTP Server, acting as a reverse proxy in front of the website) records these requests in log files:

• IP address of the requesting device
• date and time of the request
• requested page or file (URL), HTTP method and status code
• amount of data transferred
• referrer URL (the previously visited page, if your browser sends it)
• browser type and version as well as operating system (user agent)

This data is used to deliver the website, to ensure its stability and security – in particular to detect and fend off attacks such as overload, brute-force or scanning attacks – and to analyse technical errors. It is not evaluated for marketing purposes or combined with other data sources.

The legal basis is Art. 6(1)(f) GDPR. Our legitimate interest lies in the secure and uninterrupted operation of the website; we are also obliged under Art. 32 GDPR to take appropriate technical security measures.

Retention: log files are deleted automatically after 7 days. If a specific security incident has to be investigated, we keep the relevant entries until the investigation is complete and delete them afterwards.

5. Protection against attacks with CrowdSec

To protect our servers, we use the security software CrowdSec. It runs on our own servers and automatically analyses the server log files for typical attack patterns, such as mass login attempts, probing for known vulnerabilities or an unusually high number of requests in a short time. If such a pattern is detected, the IP address concerned is blocked temporarily.

Only when an attack pattern has been detected are the IP address, the time and the type of attack transmitted to CrowdSec SAS, 20 rue Maurice Arnoux, 92120 Montrouge, France. In return, we receive a list of IP addresses that have been identified as attackers in the CrowdSec network and can block them preventively. No data is transmitted to CrowdSec during an ordinary visit to our website, and the log files themselves never leave our server.

We and CrowdSec SAS are joint controllers for the processing of reported IP addresses in the CrowdSec network (Art. 26 GDPR); you can exercise your rights against either of us. According to CrowdSec, IP addresses are kept at full precision for no more than three months and are coarsened step by step afterwards. CrowdSec uses cloud providers that partly process data outside the EU; such transfers are safeguarded by EU standard contractual clauses. More information: https://www.crowdsec.net/privacy-policy

The legal basis is Art. 6(1)(f) GDPR. Our legitimate interest lies in protecting our systems and our visitors' data against attacks. Temporarily blocking an IP address is a technical safeguard and not a decision producing legal effects within the meaning of Art. 22 GDPR.

6. Contact form and project configurator

You can send us an inquiry via the contact form or the project configurator. In doing so, we process the details you enter yourself:

• name and email address (required)
• phone number and company (optional)
• selected topic or area and selected services
• your message

Your details are sent to us by email; we use ALL-INKL.COM for sending and receiving (see section 11). Your IP address is not included. We then transfer the inquiry to our customer management system (Odoo), which we operate ourselves on our own servers.

The purpose is to handle your inquiry and, where applicable, to prepare a quote. The legal basis is Art. 6(1)(b) GDPR where your inquiry aims at concluding a contract, and otherwise Art. 6(1)(f) GDPR; our legitimate interest lies in responding to inquiries addressed to us.

By ticking the checkbox before sending, you confirm that you have taken note of this privacy policy. This is not consent – the processing is based on the legal grounds stated above.

We need your name and email address in order to reply; without them we cannot process your inquiry. All other details are optional.

Retention: if no contract is concluded, we delete the inquiry from our mailbox and customer management system six months after the last contact. If you place an order, we keep the data for the duration of the business relationship and beyond that as long as statutory retention periods apply – generally six years for business correspondence and eight years for accounting records (Section 257 HGB, Section 147 AO).

7. Contact by email and phone

If you contact us by email or phone, we process your details (e.g. name, email address, phone number and the content of your request) in order to handle your inquiry. Emails are stored in our mailbox at ALL-INKL.COM, project inquiries additionally in our self-hosted customer management system. Legal basis and retention follow section 6.

8. Contact via WhatsApp

You can also reach us via WhatsApp. We use the “WhatsApp Business” app provided by WhatsApp Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland. When you message us via WhatsApp, WhatsApp receives your phone number and communication metadata (e.g. time and device information). Message content is end-to-end encrypted and cannot be read by WhatsApp.

WhatsApp is part of the Meta group and may also transfer data to Meta Platforms, Inc. in the USA. Meta Platforms, Inc. is certified under the EU-US Data Privacy Framework, for which the European Commission has adopted an adequacy decision (Art. 45 GDPR). WhatsApp's privacy policy applies to its processing: https://www.whatsapp.com/legal/privacy-policy-eea

Using WhatsApp is voluntary; you can equally reach us by email, phone or via the contact form. The legal basis is Art. 6(1)(b) GDPR where an order is concerned, and otherwise Art. 6(1)(f) GDPR; our legitimate interest lies in communicating with you quickly and easily through the channel you have chosen. We delete chat histories once they are no longer needed to handle your request; for order-related content, the periods in section 6 apply.

9. Social media and external links

This website links to our profiles on Instagram and LinkedIn. These are plain links, not embedded plugins: no data is transmitted to these networks when you visit our website. Only when you click a link are you taken to the respective provider's platform, where its privacy policy applies.

Instagram: we operate a business profile on Instagram, a service of Meta Platforms Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland. When you visit or interact with our profile, Meta processes your data, among other things to provide us with aggregated statistics about the use of the profile (“Insights”). We and Meta are joint controllers for these statistics (Art. 26 GDPR). In an agreement, Meta has assumed primary responsibility, in particular for informing users and fulfilling data subject rights: https://www.facebook.com/legal/terms/page_controller_addendum

You can exercise your rights against Meta as well as against us. Meta also processes data in the USA; Meta Platforms, Inc. is certified under the EU-US Data Privacy Framework. The legal basis for operating our profile is Art. 6(1)(f) GDPR; our legitimate interest lies in presenting our business and communicating with prospective clients. Instagram's privacy policy: https://privacycenter.instagram.com/policy

LinkedIn: we link to the personal LinkedIn profile of Sven Veldhoff. The provider is LinkedIn Ireland Unlimited Company, Wilton Plaza, Wilton Place, Dublin 2, Ireland. LinkedIn is responsible for processing on its platform: https://www.linkedin.com/legal/privacy-policy

The references page also contains links to our clients' websites. Here too, a connection to the respective provider is only established once you click.

10. Consent, web analytics, local storage and fonts

On your first visit, a notice (“cookie banner”) asks whether you consent to web analytics. Without your consent no web analytics takes place and the analytics scripts are not loaded at all. You can change or withdraw your decision at any time via the “Cookie settings” link at the bottom of every page; withdrawal takes effect for the future.

Necessary storage: we store your choice in the notice in a cookie (“cc_cookie”, valid for 6 months) together with a random identifier, the time and the selected categories. To be able to demonstrate your consent (Art. 7(1) GDPR), we log the same information without your IP address on our server and delete it after 3 years. The legal bases are Section 25(2) No. 2 TDDDG and Art. 6(1)(c) GDPR.

Only the following is stored on your device: if you actively switch between the light and dark theme using the toggle in the header, your choice is saved in your browser's local storage (localStorage, entry “theme”) so that it is kept for your next visit. Nothing is stored as long as you do not use the toggle. This storage is strictly necessary to provide the service you have explicitly requested and is therefore permitted without consent under Section 25(2) No. 2 TDDDG. You can delete the entry at any time in your browser settings.

Web analytics with Umami (only with consent to “Statistics”): we use the open-source software Umami, which we operate ourselves on our servers in Germany (analytics.sev.solutions). The following is processed: pages visited and time spent, the previously visited page (referrer), country, region and city derived from the IP address, device type, browser, operating system, screen size and language, how long individual sections of a page were visible, scroll depth, and clicks on contact options as well as the submission of the contact form and configurator, without your inputs. Umami sets no cookies and does not store your IP address. To group page views into a visit, Umami derives an identifier from the IP address, browser identifier and a random value that changes monthly; the IP address cannot be recovered from it.

Session recordings and heatmaps (only with separate consent): if you additionally consent to “Session recordings & heatmaps”, Umami records the page layout as well as clicks, scrolling and mouse movement for some visits so that we can identify usability problems. Inputs in form fields are masked and not recorded.

The purpose of web analytics is to improve the website and its content. The legal basis is your consent (Section 25(1) TDDDG, Art. 6(1)(a) GDPR). The data stays on our servers, is not passed on to third parties and is not combined with other data. Statistics are deleted automatically after 14 months, session recordings after 30 days.

The fonts used (Inter and Instrument Sans) are served from our own server. No connection to Google or any other third party is established when you visit the website.

11. Recipients and transfers to third countries

We only disclose personal data as described in this policy. Recipients are:

• ALL-INKL.COM – Neue Medien Münnich, owner René Münnich, Hauptstraße 68, 02742 Friedersdorf, Germany: email delivery and mailbox. ALL-INKL.COM acts as our processor; we have concluded a data processing agreement with it under Art. 28 GDPR.
• CrowdSec SAS, France: only IP addresses of detected attackers (section 5).
• WhatsApp Ireland Limited or Meta Platforms Ireland Limited: only if you contact us via WhatsApp or visit our Instagram profile (sections 8 and 9).

Beyond that, we only disclose data where we are legally obliged to do so, for example to tax authorities.

We do not transfer any data to countries outside the EU/EEA ourselves. Meta (WhatsApp, Instagram) and CrowdSec partly process data in third countries; the respective safeguards are described in sections 5, 8 and 9.

12. SSL/TLS encryption

For security reasons, this website uses TLS encryption, recognisable by “https://” in your browser's address bar. With encryption active, the data you send to us cannot be read by third parties.

13. Your rights

You have the following rights regarding the personal data concerning you:

• right of access (Art. 15 GDPR)
• right to rectification (Art. 16 GDPR)
• right to erasure (Art. 17 GDPR), unless statutory retention obligations apply
• right to restriction of processing (Art. 18 GDPR)
• right to data portability (Art. 20 GDPR)
• right to withdraw consent with effect for the future (Art. 7(3) GDPR), where processing is based on your consent

To exercise your rights, an informal message to moin@sev.solutions is sufficient.

14. Obligation to provide data and automated decisions

You are under no statutory or contractual obligation to provide us with personal data. You can use the website without providing personal details; only the connection data listed in section 4 is technically required. To send an inquiry, we need your name and email address (section 6).

No automated decision-making, including profiling, within the meaning of Art. 22 GDPR takes place.

15. Right to lodge a complaint with a supervisory authority

Without prejudice to any other remedy, you have the right to lodge a complaint with a data protection supervisory authority if you consider that the processing of your data infringes the GDPR (Art. 77 GDPR) – in particular in the member state of your habitual residence, place of work or place of the alleged infringement. The authority responsible for us is:

16. Updates and changes

We update this privacy policy whenever the website, our processes or the legal situation change. The version published here applies.