1. Controller
The controller responsible for processing personal data on this website is:
OSK-Consult
Olaf Scholtz-Knobloch
Osterather Str. 81
40670 Meerbusch
Phone: 02159 508070
Email: datenschutz@osk-consult.de
2. Website provision and hosting
Whenever you access this website, personal data transmitted by your browser to our hosting provider is processed. This includes your IP address, the date and time of access, the web address requested, browser and operating-system information, and technical status and error messages.
This data is processed to provide the website, ensure that it functions correctly and defend against security threats. The legal basis is Art. 6(1)(f) GDPR. Our legitimate interest is the secure and reliable operation of our website. Technical log data in the Cloudflare Workers Logs hosting service is retained for no more than seven days.
The recipient of the data is our hosting provider, Cloudflare, Inc., 101 Townsend Street, San Francisco, CA 94107, USA. Cloudflare processes the data on our behalf to provide the hosting service. Data may be transferred to countries outside the European Union and the European Economic Area, in particular to the United States. Among other safeguards, Cloudflare provides for the European Commission’s Standard Contractual Clauses for transfers to third countries. Details of the contractual safeguards are available in the Cloudflare Data Processing Addendum. Further information is provided in the Cloudflare Privacy Policy.
3. Contacting us
If you contact us through the contact form, by email or by phone, we process your contact details and the information you provide in order to handle your enquiry and any follow-up questions. Your email address and the text of your message are required to use the contact form. Information about your company and the subject of your enquiry is voluntary. You are not legally or contractually required to provide your data. Without the required information, however, we cannot process your enquiry through the contact form.
Where your enquiry concerns entering into or performing a contract, the legal basis for processing is Art. 6(1)(b) GDPR. In all other cases, processing is based on Art. 6(1)(f) GDPR. Our legitimate interest is to respond to enquiries addressed to us.
We use STRATO GmbH, Otto-Ostrowski-Straße 7, 10249 Berlin, Germany, to send email and manage our email inbox. STRATO processes the messages transmitted and the contact details required for delivery. Further information is available in the STRATO Privacy Policy.
The data is deleted once the enquiry has been dealt with conclusively and further retention is no longer required. Statutory retention obligations remain unaffected. Where data is needed to comply with such obligations or to establish, exercise or defend legal claims, it is retained for those purposes until the relevant period expires. The legal basis in this respect is Art. 6(1)(c) or (f) GDPR.
4. Protection against spam and misuse
We use Cloudflare Turnstile to protect our contact form against automated enquiries and misuse. The provider is Cloudflare, Inc., 101 Townsend Street, San Francisco, CA 94107, USA. In particular, your IP address, browser information, characteristics of the encrypted connection and the address of the website accessed are processed and transmitted to Cloudflare.
The legal basis is Art. 6(1)(f) GDPR. Our legitimate interest is to protect our communication service against spam and misuse. Where access to information on your terminal equipment is strictly necessary for this purpose, such access is based on Section 25(2) no. 2 of the German Telecommunications and Digital Services Data Protection Act (TDDDG).
Cloudflare processes this data on our behalf to carry out the security check and, under its own responsibility under data protection law, to improve its bot detection. The information in section 2 applies to possible transfers to third countries. Further information about processing by Cloudflare, including data retention, is provided in the Cloudflare Turnstile Privacy Policy.
To limit repeated form enquiries, the IP address and the times of submission attempts are also processed temporarily. Enquiries within a ten-minute period are taken into account. Entries that are no longer required are removed during subsequent access or when memory is cleared. The processing is based on Art. 6(1)(f) GDPR and also serves our legitimate interest in preventing misuse.
5. Cookies and embedded content
The website is shown in the language your browser indicates as preferred, provided we offer it. If you open a different language version, for example using the language selector, a cookie named “NEXT_LOCALE” stores that choice. It contains only the language code and is deleted when you close your browser. If the language matches your browser’s, it is not set. Storing it is strictly necessary for the language selection you have requested (Section 25(2) no. 2 TDDDG). Beyond this, no cookies are set and no data is stored in your browser in the publicly accessible part of this website. We do not use advertising or marketing tools; the audience measurement described in section 6 works without cookies and without storing anything in your browser. Fonts are provided locally and no connection is made to external font services. Consent under Section 25(1) TDDDG is therefore not required.
The only exception is the “Contact” page, where Cloudflare Turnstile is loaded to secure the form. Where this involves access to information on your terminal equipment, that access is strictly necessary for the service you have requested (Section 25(2) no. 2 TDDDG). See section 4 for details.
In the access-restricted administration area, technically necessary session cookies are used to authenticate authorised users. The legal basis for storage is Section 25(2) no. 2 TDDDG; the associated processing of personal data is based on Art. 6(1)(f) GDPR. Our legitimate interest is to secure website administration.
6. Audience measurement
To understand how the website is used, we measure page views with PostHog in its cookieless mode. Nothing is stored in your browser and nothing is read from it; consent under Section 25(1) TDDDG is therefore not required. No user profiles are created, and visits are not linked across several days or across other websites.
We record the page viewed, the referring page, date and time, device type, browser, operating system, screen size, language and the country derived from the IP address. When someone submits the contact form, we also count that an enquiry was made and on which topic – not by whom or with what content. To count the page views of one visit together, PostHog computes a hash on its servers from the IP address, the browser identifier and a random value that changes daily. The random value is then deleted; after that the hash can no longer be attributed to a person. The IP address itself is not stored.
The legal basis is Article 6(1)(f) GDPR. Our legitimate interest is to understand, in aggregated form, how our website is used and to improve it. The provider is PostHog, Inc., 2261 Market Street #4008, San Francisco, CA 94114, USA, acting as processor. The data is processed on servers in the European Union (Frankfurt am Main); the European Commission’s standard contractual clauses apply to any access from the USA. The measurement data is deleted after one year at the latest. Further information is available in the PostHog privacy policy.
7. Your rights
Subject to the applicable statutory requirements, you have the following rights:
- access to your personal data under Art. 15 GDPR,
- rectification of inaccurate data or completion of incomplete data under Art. 16 GDPR,
- erasure of your data under Art. 17 GDPR,
- restriction of processing under Art. 18 GDPR,
- data portability under Art. 20 GDPR.
Where processing is based on your consent, you may withdraw that consent at any time with effect for the future. The lawfulness of processing carried out before the withdrawal remains unaffected. To exercise your rights, you may contact the controller named in section 1.
8. Right to object
Under Art. 21(1) GDPR, you have the right to object at any time, on grounds relating to your particular situation, to the processing of your personal data based on Art. 6(1)(f) GDPR. We will then no longer process the data concerned unless we can demonstrate compelling legitimate grounds that override your interests, rights and freedoms, or the processing is necessary for the establishment, exercise or defence of legal claims.
9. Right to lodge a complaint
Under Art. 77 GDPR, you have the right to lodge a complaint with a data protection supervisory authority, in particular in the Member State of your habitual residence, place of work or the place of the alleged infringement. The supervisory authority responsible for us is the North Rhine-Westphalia State Commissioner for Data Protection and Freedom of Information.
10. Automated decision-making
No automated decision-making, including profiling, within the meaning of Art. 22 GDPR takes place.