Privacy Policy

1. Data Controller

The controller responsible for the processing of personal data on this website (Art. 4(7) GDPR) is:

Daniel Böhm
VERNETZT.DIGITAL
Peter-Michels-Str. 51
50827 Cologne

Phone: +49 221 25968301
Email: contact@vernetzt.digital

2. Data Protection Officer

No Data Protection Officer has been appointed. The requirements for mandatory appointment under Art. 37 GDPR and Section 38 of the BDSG are not met. For all questions regarding data protection, please use the contact information provided above.

3. Overview of Legal Bases

Personal data is processed only if one of the following legal bases applies. The specific legal basis applicable to each processing activity is specified in Section 4.

• Consent – Art. 6(1)(a) GDPR
• Contract or pre-contractual measures in response to your request – Art. 6(1)(b) GDPR
• Legal obligation – Art. 6(1)(c) GDPR
• Legitimate Interests – Art. 6(1)(f) GDPR; the specific interests are specified in the context of the processing.

Section 25 of the TDDDG also applies to the storage of information on your device or access to information stored there: This is permitted only with your consent (Section 25(1) TDDDG), unless it is strictly necessary to provide a service you have expressly requested (Section 25(2)(2) TDDDG).

4. Specific Processing Activities

4.1 Hosting and Server Log Files

This website is hosted by STRATO GmbH, Otto-Ostrowski-Straße 7, 10249 Berlin (hereinafter “Strato”). When any page is accessed, the server processes technically necessary access data: IP address, date and time, URL accessed, amount of data transferred, referrer URL, browser type and version, and operating system. The purpose is to deliver the website, ensure its stability, and defend against attacks. The legal basis is Art. 6(1)(f) GDPR; the legitimate interest lies in the secure and error-free operation of the website. This data is not combined with other data. Strato stores this access data for a maximum of 7 days and deletes it thereafter. A contract for data processing has been entered into with Strato in accordance with Art. 28 GDPR. Further information: strato.de/datenschutz.

4.2 Encrypted Transmission

The website is accessible exclusively via an SSL/TLS-encrypted connection (https). Data that you submit via forms cannot be read by third parties during transmission.

4.3 Storage in the Browser (No Cookies)

This website does not set any cookies for visitors. The following information is stored in your browser’s memory (local storage or session storage); it is not transmitted to the server:

• vd-theme – Your choice between light and dark mode; stored until you delete it in your browser.
• vd-consent – Your selection in the “Cookies and Statistics” notification window, including version and time; this selection remains valid for 12 months, after which you will be asked again.
• vd-prefill – only after the IT pre-check: name, company, email address, and phone number for transfer to the contact form; deleted after transfer, at the latest when the tab is closed.

This storage is absolutely necessary for the functions you have requested (Section 25(2)(2) TDDDG). The legal basis for the associated processing is Art. 6(1)(f) GDPR; the legitimate interest lies in the provision of these functions.

4.4 Consent Request and Proof

Upon your first visit, a pop-up window asks whether you consent to anonymous audience measurement (4.5). To document your choice, the website’s database stores the time, version of the notice, and your selection—without your IP address and without any identifier that would allow you to be personally identified. The legal basis is Art. 6(1)(c) GDPR in conjunction with Art. 7(1) GDPR (record of consent). These records are automatically deleted three full calendar years after the selection’s validity expires.

You can change or revoke your selection at any time: Open cookie settings (also available in the footer of every page).

4.5 Anonymous Audience Measurement

Only if you have consented in the notification window will your browser send the following information to this website’s server when you visit:

• that a page was accessed and which one,
• which links and buttons were clicked—only the destination (e.g., a page address, “Email,” “Phone,” or the name of an external website) or the button label is stored,
• how many seconds a section of the page was at least half visible,
• for the IT Pre-Check, the result category achieved.

On the server, this information is stored exclusively as hourly totals. No cookies are set, no IP addresses are stored, and no user identifiers are created; it is not possible to link this data to specific individuals. No data is transferred to third parties. The purpose is to improve the website’s content. The legal basis is your consent (Art. 6(1)(a) GDPR, § 25(1) TDDDG). You may revoke your consent at any time via the cookie settings; tracking will then cease immediately. The totals are automatically deleted after 25 months.

4.6 Contact via Email or Phone

If you contact VERNETZT.DIGITAL via email or phone, your information (e.g., name, contact details, content of the inquiry) will be processed to handle your request. The legal basis is Art. 6(1)(b) GDPR if your inquiry relates to a contract; otherwise, it is Art. 6(1)(f) GDPR (legitimate interest in responding to inquiries). The data will be deleted once the inquiry has been fully processed and provided that no statutory retention requirements apply.

4.7 Contact Form and Spam Protection

The contact form processes your name, company, email address, phone number (optional), subject, message, a report ID (if applicable), as well as the time and page of the inquiry. Before submitting the form, you must check a required checkbox to confirm that you have read and understood the notice regarding the processing of your information and this Privacy Policy. The information is stored in the website’s database and forwarded via email to contact@vernetzt.digital. The legal basis is Art. 6(1)(b) GDPR; in all other cases, Art. 6(1)(f) GDPR (legitimate interest in responding to inquiries). Entries are automatically deleted after 12 months.

To protect against automated requests, the form uses a hidden field, a minimum completion time, and a limit on the number of requests per hour. For this limit, an encrypted hash value is generated from your IP address; this value cannot be traced back to the IP address and is deleted after one hour. No CAPTCHA or external service is used. The legal basis is Art. 6(1)(f) GDPR (legitimate interest in protecting against abuse).

4.8 IT Pre-Check

The IT Pre-Check asks six questions about your company’s IT. The answers are evaluated on the server and displayed as a result. Unless a report is requested, no data that could be linked to an individual is stored; with consent to audience measurement, only the result category is counted anonymously (4.5).

4.9 Requesting the Results Report

When you request the IT Pre-Check report, your name, company, email address, phone number (optional), your answers, the result, and a report ID are stored. You will first receive an email with a confirmation link (double opt-in). This ensures that the email address was not entered by a third party without your knowledge. The report will be sent only after you click this link. If you do not confirm the address, the request will be automatically deleted after 7 days, and you will not receive any further messages. After confirmation, the report is generated as a PDF on the website’s own server and sent to you via email; a copy is sent to contact@vernetzt.digital. You can access your results again via a personal link with a random key; this page is blocked from search engines. The legal basis is Art. 6(1)(b) GDPR (pre-contractual measure in response to your request). The entry and link are automatically deleted after 12 months.

4.10 Consent to Promotional Emails and Reminders

In the contact form, you may voluntarily consent—in addition to submitting your inquiry—to allow VERNETZT.DIGITAL to contact you via email regarding services, offers, and news; your inquiry will be answered even without this consent. When requesting the free results report, your consent allowing VERNETZT.DIGITAL to contact you via email regarding your results as well as services, offers, and news is a prerequisite for submitting the request. This consent does not take effect until you confirm it via the link in a confirmation email (double opt-in); When requesting a report, the same link confirms both your email address and your consent. The time of consent, the time of confirmation, and a verification value for the confirmation key are stored. Only with confirmed consent will you receive reminder emails 14 days and 3 months after requesting a report. The legal basis is your consent (Art. 6(1)(a) GDPR). You may revoke your consent at any time with future effect—via the unsubscribe link in every email, via the unsubscribe function in your email program, or by sending an informal request to contact@vernetzt.digital.

While it is technically possible to track whether and when emails are opened or links within them are clicked, VERNETZT.DIGITAL does not currently perform such tracking. Consent-related data will be deleted upon revocation or together with the corresponding entry.

4.11 Contact Management

To process inquiries, the name, email address, status, and attributes (e.g., “Contact Request,” “Pre-Check,” “Consent Confirmed”) are stored in a contact management system (FluentCRM); for report requests, this occurs only after the email address has been confirmed. FluentCRM is an extension hosted on this website’s web space; the data is stored there. VERNETZT.DIGITAL does not disclose this data to the manufacturer of FluentCRM or to any other third parties. When updating the software, VERNETZT.DIGITAL follows the manufacturer’s instructions; if this results in any changes to data processing, this Privacy Policy will be updated accordingly. The legal basis is Art. 6(1)(b) GDPR; otherwise, Art. 6(1)(f) GDPR (proper processing of inquiries). The information is deleted along with the corresponding entry.

4.12 Sending Emails

Emails generated by the forms (acknowledgment of receipt, reports, confirmation, and reminder emails) are sent via Strato’s mail server (4.1). Strato stores the resulting log data from the mail server for a maximum of 6 months.

4.13 Deletion Log

To ensure that deletions can be verified, the following information is recorded for each deletion of form entries: time, type, form, a truncated email address (e.g., m***@…), a checksum of the email address, and the reason. The legal basis is Art. 6(1)(c) GDPR in conjunction with Art. 5(2) GDPR (accountability). The log is deleted after 36 months.

4.14 Login Protection for the Administrative Area

In the event of failed login attempts to the website’s administrative area, the IP address and time are stored to prevent attacks. This does not apply to visits to the website. The legal basis is Art. 6(1)(f) GDPR (protection of the website).

4.15 No Third-Party Content

Fonts, icons, and the video in the header are hosted on the website’s own web space. When this website is accessed, no content is loaded from third-party servers; no maps, video platforms, chat windows, analytics services, or social media elements are integrated.

4.16 WhatsApp

The website contains links to WhatsApp. WhatsApp opens only when you click on such a link; no data is transmitted to WhatsApp when the website loads. If you send a message via WhatsApp, the provider WhatsApp Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland, processes your data in accordance with its own terms and conditions. Your message will be processed to handle your inquiry; the legal basis is Art. 6(1)(b) GDPR, and otherwise Art. 6(1)(f) GDPR (communication via the method you have chosen). Please do not send any passwords or confidential data via WhatsApp.

4.17 Online Meetings and Remote Support

Microsoft Teams is used for meetings with prospective clients and customers (Microsoft Ireland Operations Limited, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, Ireland). NinjaOne is used for remote maintenance and management of managed systems (NinjaOne GmbH, Alexanderstraße 1, 10178 Berlin, and NinjaOne, LLC, USA).

In this context, the following data may be processed: name, email address, device and connection data, IP address, video and audio data, shared screen content, as well as the time and duration of a session. These tools are not integrated into the website and are used only when you participate in a meeting or when support has been arranged. The legal basis is Art. 6(1)(b) GDPR; in all other cases, Art. 6(1)(f) GDPR (simple and secure communication and support). For transfers to third countries, see Section 6.

4.18 Digital Business Card

This Privacy Policy also applies to the digital business card at card.vernetzt.digital. It is also hosted by Strato, does not set cookies, and does not contain any forms. Your choice between light and dark mode is stored in your browser’s cache (Section 25(2)(2) TDDDG). When you access the page, the access data specified in Section 4.1 is processed.

5. Recipients

Personal data is disclosed only to the extent necessary for the stated purposes or where there is a legal obligation to do so. Recipients are:

• STRATO GmbH (hosting, email delivery) as a processor pursuant to Art. 28 GDPR,
• Microsoft Ireland Operations Limited (Teams) and NinjaOne (remote maintenance), to the extent that you use these services,
• WhatsApp Ireland Limited, if you contact VERNETZT.DIGITAL via WhatsApp,
• public authorities (e.g., tax authorities), if there is a legal obligation to do so.

6. Transfer to Third Countries

The website itself does not transfer any data to countries outside the European Union or the European Economic Area. In the case of Microsoft (Teams), NinjaOne, and WhatsApp (Meta), processing may take place in the United States. These companies or their U.S. parent companies rely on the EU-U.S. Data Privacy Framework, for which an adequacy decision by the European Commission exists pursuant to Art. 45(3) GDPR, as well as, supplementarily, on standard contractual clauses pursuant to Art. 46(2)(c) GDPR.

7. Overview of Retention Periods

• Access data (server log files) at Strato: no more than 7 days
• Mail server log data at Strato: up to 6 months
• Light/dark mode selection in the browser: until you delete it
• Selection in the notification window (browser): 12 months
• Proof of consent: three full calendar years after the selection expires
• Reach measurement (hourly totals, anonymous): 25 months
• Spam protection summary value: 1 hour
• Report Request Without a Verified Email Address: 7 days
• Contact form, results report, and personal link: 12 months
• Consent to promotional emails: until revoked or with the corresponding entry
• Deletion log: 36 months
• Inquiries via email and phone: until final resolution

Statutory retention requirements (particularly under commercial and tax law) remain unaffected; in this case, the data will be blocked for other purposes and deleted upon expiration of the retention period.

8. Your Rights

You have the following rights with respect to your personal data vis-à-vis the controller:

• Right of access (Art. 15 GDPR)
• Rectification (Art. 16 GDPR)
• Erasure (Art. 17 GDPR)
• Restriction of processing (Art. 18 GDPR)
• Data portability (Art. 20 GDPR)
• Withdrawal of consent with future effect (Art. 7(3) GDPR); the lawfulness of processing carried out prior to withdrawal remains unaffected.

To exercise these rights, simply send an informal message to contact@vernetzt.digital.

Right to object (Art. 21 GDPR)

To the extent that processing is based on Art. 6(1)(f) GDPR, you may object at any time on grounds relating to your particular situation (Art. 21(1) GDPR). The data will then no longer be processed, unless there are compelling legitimate grounds for the processing that override your interests, rights, and freedoms, or the processing is necessary for the establishment, exercise, or defense of legal claims.

If your data is processed for direct marketing purposes, you may object to this at any time (Art. 21(2) GDPR); the data will then no longer be processed for this purpose (Art. 21(3) GDPR).

Right to Lodge a Complaint (Art. 77 GDPR)

You have the right to lodge a complaint with a data protection supervisory authority, in particular in the Member State of your habitual residence, your place of work, or the location of the alleged infringement. The competent authority for VERNETZT.DIGITAL is:

State Commissioner for Data Protection and Freedom of Information, North Rhine-Westphalia
Kavalleriestraße 2–4
40213 Düsseldorf
www.ldi.nrw.de

9. Obligation to Provide Information

You are under no legal or contractual obligation to provide personal data. However, without the information marked as required fields, a request submitted via the contact form cannot be processed, and a results report cannot be sent. Confirmation of the privacy notice (4.7) is required to submit the contact form. To request the results report, you must provide consent in accordance with 4.10 and confirm your email address via the link sent to you. You may use the website and the IT Pre-Check without providing personal data and without receiving a report.

10. Automated Decision-Making

No automated decision-making, including profiling as defined in Art. 22 GDPR, takes place. The evaluation of the IT Pre-Check is a non-binding assessment of the information you have provided regarding your company’s IT; it has no legal effect and does not adversely affect you in any similar manner.

11. Changes

This Privacy Policy will be updated if the website or legal requirements change. The version currently published on this page is the valid one.