Privacy policy

This is a translation provided for convenience. In the event of discrepancies, the German version is authoritative.

1. Controller

The controller within the meaning of the General Data Protection Regulation (GDPR) is:

Jonathan Lang
Staffelsee Consulting
Seestraße 43
82418 Seehausen am Staffelsee
Phone: +49 160 3896720
Email: kontakt@staffelseeconsulting.com

2. General information on data processing

We generally process our visitors’ personal data only to the extent necessary to provide a functioning website along with our content and services. Processing regularly takes place only with consent or on the basis of statutory permissions (Art. 6 (1) GDPR).

3. Hosting

This website is hosted by ALL-INKL.COM – Neue Medien Münnich, owner: René Münnich, Hauptstraße 68, 02742 Friedersdorf, Germany (“All-Inkl”). The servers are located in Germany.

When you access our website, All-Inkl automatically collects information in so-called server log files that your browser transmits: browser type and version, operating system used, referrer URL, host name of the accessing computer, time of the server request and IP address. This data is not merged with other data sources. Collection takes place on the basis of Art. 6 (1) (f) GDPR (legitimate interest in the technically faultless presentation and security of the website). The log files are deleted automatically after a short period.

We have concluded a data processing agreement with All-Inkl pursuant to Art. 28 GDPR.

4. SSL encryption

For security reasons this site uses SSL or TLS encryption. You can recognise an encrypted connection by the browser address bar switching from “http://” to “https://” and by the padlock symbol in your browser bar.

5. Contact form and email contact

If you send us enquiries via the contact form or by email, your details (name, company where applicable, email address, content of the message) are stored by us for the purpose of processing the enquiry and in case of follow-up questions. We do not pass this data on without your consent.

Processing takes place on the basis of Art. 6 (1) (b) GDPR where your enquiry relates to the initiation or performance of a contract, and otherwise on the basis of our legitimate interest in effectively handling the enquiries addressed to us (Art. 6 (1) (f) GDPR) or your consent (Art. 6 (1) (a) GDPR).

The information from the contact form is stored in this website’s database on All-Inkl’s servers and also forwarded to us by email. Our mailbox is operated by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (Google Workspace), on the basis of Google’s data processing terms (Cloud Data Processing Addendum).

We delete enquiries once they have been dealt with and no follow-up questions are to be expected. Entries from the contact form are deleted from the database automatically after twelve months at the latest. If an enquiry leads to an engagement, the statutory retention periods for business correspondence and invoices apply (six and eight years respectively).

6. Website review

Using the “Website review” form, you can send us the address of your website so that we can take a look at it. We process your name, your email address, the website address and, if provided, your question about it. This information is not stored in the database but sent to us by email; you receive a confirmation at the email address you entered.

To prevent misuse, we count for one hour how often the form is submitted from the same IP address and for the same email address. For this we store only an irreversible check value (hash), not the address itself; it is deleted automatically after one hour. The email we receive contains the sender’s IP address so that we can recognise misuse.

The legal basis is Art. 6(1)(b) GDPR (pre-contractual measures at your request) and, for misuse prevention, Art. 6(1)(f) GDPR (legitimate interest in a form that is not misused). We delete these emails in the same way as enquiries from the contact form.

7. Cookies and consent management

Our website uses cookies. Technically necessary cookies are stored on the basis of Art. 6 (1) (f) GDPR and section 25 (2) of the German TDDDG. All other cookies – in particular for statistical purposes – are set only with your express consent (Art. 6 (1) (a) GDPR, section 25 (1) TDDDG).

We use a consent management solution (cookie banner) to obtain and manage your consent. You can change or withdraw your choice at any time via the “Cookie settings” link in the footer of this website.

To manage consent we use Cookiebot, provided by Usercentrics A/S, Havnegade 39, 1058 Copenhagen, Denmark. Cookiebot stores your choice in a cookie on your device and logs the consent with a random identifier, date and time, the truncated IP address, browser information and the page visited. This serves as proof that consent has been given (Art. 7(1) GDPR); the legal basis is Art. 6(1)(c) GDPR. The cookie containing your choice is deleted after twelve months. Usercentrics processes this data on our behalf (Art. 28 GDPR).

We also set the technically necessary cookie “pll_language”, which remembers the language you selected on this website for one year.

8. Google Tag Manager and Consent Mode

We use Google Tag Manager provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Google Tag Manager is a tool that allows us to integrate and manage tracking or statistics tools and other technologies on our website. Google Tag Manager itself does not create user profiles, store cookies or carry out any analysis of its own. It merely manages and delivers the tools integrated through it. Cookies for statistical purposes are only set after you have given your consent.

We use Google’s Consent Mode. As long as you have not given your consent, Google does not set cookies or store identifiers on your device. In this case, however, the Google tag sends individual requests without cookies to Google, such as the consent status, the page visited, the time and technical information about your browser; your IP address is necessarily transmitted in the process. These requests contain no identifier that would allow Google to recognise you and are used only for aggregated, modelled statistics.

The legal basis for these cookieless requests is our legitimate interest in a rough measurement of our website’s reach (Art. 6(1)(f) GDPR). You can object to this at any time (Art. 21 GDPR), for example by email to kontakt@staffelseeconsulting.com.

9. Google Analytics 4

Where you have given your consent, this website uses Google Analytics 4, a web analytics service provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (“Google”).

Google Analytics uses cookies and similar technologies that enable an analysis of how the website is used. The information generated about your use of this website is generally transmitted to a Google server and stored there. In Google Analytics 4, IP anonymisation is enabled by default; your IP address is shortened by Google within member states of the European Union or in other states party to the Agreement on the European Economic Area before transmission.

The legal basis for processing is solely your consent pursuant to Art. 6 (1) (a) GDPR and section 25 (1) TDDDG. You can withdraw your consent at any time via the cookie settings.

Data retention in Google Analytics is set to 14 months; user and event data is deleted automatically after that. Where data is transferred to the United States, the transfer is based on the European Commission’s adequacy decision on the EU-US Data Privacy Framework and on standard contractual clauses.

Further information on how Google Analytics handles user data can be found in Google’s privacy policy: https://policies.google.com/privacy

10. Fonts

The fonts used on this website (Playfair Display, Inter) are embedded locally on our server. No connection to servers of Google or other third parties is established when the fonts are loaded.

11. Website security

To protect against attacks, we use the security plugin Wordfence provided by Defiant, Inc., 1700 Westlake Ave N Ste 200, Seattle, WA 98109, USA. Wordfence analyses requests to this website, including IP address, requested address, time and browser identifier, in order to detect and block attacks. IP addresses of requests that Wordfence classifies as an attack or as suspicious are transmitted to Defiant’s servers in the USA to identify attack patterns.

The legal basis is Art. 6(1)(f) GDPR (legitimate interest in the security of the website). The transfer to the USA is based on the European Commission’s standard contractual clauses provided for in Defiant’s data processing agreement.

12. Links to WhatsApp and LinkedIn

This website links to WhatsApp and LinkedIn. These are plain links: no data is transmitted to these services when our pages load. Only when you click a link do you leave our website, and the privacy policy of the respective provider applies (WhatsApp Ireland Limited or LinkedIn Ireland Unlimited Company). If you contact us via WhatsApp, we process your message and phone number in order to answer your enquiry (Art. 6(1)(b) or (f) GDPR).

13. Your rights as a data subject

Within the applicable statutory provisions you have the right at any time to:

information about the personal data stored about you (Art. 15 GDPR), rectification of inaccurate data (Art. 16 GDPR), erasure (Art. 17 GDPR), restriction of processing (Art. 18 GDPR), data portability (Art. 20 GDPR) and objection to processing (Art. 21 GDPR).

You can withdraw consent you have given at any time with effect for the future (Art. 7 (3) GDPR). An informal message by email to kontakt@staffelseeconsulting.com is sufficient.

You also have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR). The authority responsible for us is the Bavarian Data Protection Authority (BayLDA), Promenade 18, 91522 Ansbach, Germany, www.lda.bayern.de.

14. Validity and amendment of this privacy policy

This privacy policy is currently valid and dated October 2026. As our website develops further, or as a result of changed legal requirements, it may become necessary to amend this privacy policy.