1. Controller
Gerhard Sartory
Windthorststrasse 6
45701 Herten-Westerholt, Germany
Email: GSartory@gmx.de
Phone: +49 172 2058649
2. Hosting and technical access data
This website uses Google Firebase Hosting and Google Cloud. IP addresses, access times, requested addresses and browser/connection information are processed to deliver and secure the website. Hosting uses a global delivery network; processing is therefore not limited to Germany. The contact form backend and abuse-counter database are located in Frankfurt (europe-west3). The legal basis is Art. 6(1)(f) GDPR, reflecting our interest in secure and reliable operation. Provider privacy information is linked below.
3. Project enquiries and email
We use your project and contact information to assess and respond to your enquiry. Required fields are marked; phone number and free text are optional. The legal basis is Art. 6(1)(b) GDPR for pre-contractual enquiries, otherwise Art. 6(1)(f) GDPR for business communication. The form cannot be sent without the required information. You can also contact us directly by phone or email.
The website forwards the information to GSartory@gmx.de using Brevo transactional email, with your email address set as the reply address. Brevo processes the message and delivery data for this purpose. The receiving mailbox is provided by GMX (1&1 Mail & Media GmbH). Submitting an enquiry does not subscribe you to a newsletter. Full enquiries are not stored in our website database or application logs.
4. Protection against automated abuse
Firebase App Check with Google reCAPTCHA Enterprise loads when you send the form. IP address, device/browser information and interactions may be sent to Google to detect automated requests. App Check creates a security token for submission. This protects the form and service availability under Art. 6(1)(f) GDPR; technically necessary access to your device relies on Section 25(2)(2) of the German TDDDG. It is separate from optional analytics.
To limit repeated requests, Firestore stores pseudonymous identifiers generated with a secret key, together with counters and expiry times. Identifiers are derived from email address and security token; neither the full address nor the enquiry is stored there. Counting windows last 15 minutes. Records expire within 24 hours and are automatically deleted afterwards; physical deletion may be delayed.
5. Browser storage and retention
Incomplete form entries are held in browser session storage so you can resume the form. They are removed once delivery acceptance is confirmed and normally when the browser session ends. This storage supports the form function you use under Section 25(2)(2) TDDDG. The form still works if your browser blocks storage.
Your optional analytics choice is stored locally for up to 180 days so it can be respected on subsequent visits. Enquiry emails and related delivery data are retained while necessary to handle the enquiry, follow-up questions or statutory retention obligations, then deleted. The short-lived abuse counters follow the periods in section 4.
6. Google Analytics with your consent
If you agree, we use Google Analytics 4 to understand website use and improve the service. We measure page views, form starts, enquiries accepted by the delivery provider and contact clicks, along with technical device/browser information and a pseudonymous cookie identifier. Form contents, names, email addresses and phone numbers are not sent to Analytics. Ad personalisation, Google Signals and automatic form measurement are disabled.
The legal bases are your consent under Art. 6(1)(a) GDPR and Section 25(1) TDDDG. Analytics does not load without consent. The _ga and _ga_… cookies last up to 180 days and may be renewed with use. User and event data retention in Analytics is two months; aggregated reports are not subject to that limit. Google technically processes IP addresses during collection but states that it does not store them in Analytics for EU traffic.
You can change or withdraw consent at any time using “Privacy settings” in the footer. Withdrawal stops future measurement and removes the Analytics cookies accessible to this website. It does not affect the lawfulness of earlier processing.
7. Recipients and international processing
The providers listed above support hosting, security, email delivery and optional analytics. Their affiliates and subprocessors may process data outside the EU/EEA, including in the United States. Providers describe their transfer mechanisms, such as adequacy decisions and EU Standard Contractual Clauses, in their linked privacy notices and data-processing terms. Contact us using the address above for information about the safeguards applied to your data.
8. External links and fonts
LinkedIn is included only as a link. Its privacy terms apply when you open the link and visit the service. No social feeds are embedded. Fonts are served by this website; no requests are made to Google Fonts.
9. Your rights
Subject to the GDPR, you may request access, rectification, erasure, restriction and data portability. You may object to processing based on legitimate interests for reasons relating to your particular situation. Consent can be withdrawn for the future at any time. Contact GSartory@gmx.de to exercise your rights. You may also complain to a supervisory authority, including the North Rhine-Westphalia Commissioner for Data Protection and Freedom of Information (www.ldi.nrw.de). No automated decision-making with legal or similarly significant effects takes place.