Privacy Policy

Introduction

With the following privacy policy we inform you which types of your personal data (hereinafter also referred to as “data”) we process, for what purposes and to what extent. It applies to all processing of personal data carried out by us, both in the context of providing our services and on this website.

Status: 1 August 2026

This is a translation for your convenience. In case of discrepancies, the German version of this privacy policy prevails.

In brief

This website is built to be deliberately data-minimal:

  • We set no cookies. Neither strictly necessary nor statistics or marketing cookies. That is why there is no cookie banner here.
  • We embed no third-party content. No analytics, no tag manager, no advertising pixels, no embedded maps, no content delivery network.
  • Fonts are served locally. The typefaces used (Barlow and Barlow Condensed) are hosted on our own server. There is no connection to Google Fonts or any other external font service.
  • Simply visiting this website therefore causes no request from your browser to leave our server.

We process personal data in essentially two places: in our host’s server log files and, if you choose to use it, in the contact form.

Controller

Norbert Reiling Owner Lerchenweg 11 76761 Rülzheim / Germany

Authorised representative: Norbert Reiling

Email: n.reiling@reiling-consulting.com

Phone: +49 7272 9310989

Overview of processing

Types of data processed

  • Inventory data (e.g. names)
  • Contact data (e.g. email addresses, telephone numbers)
  • Content data (e.g. text entered in the contact form)
  • Meta/communication data (e.g. IP addresses, access times in server log files)
  • Contract data (e.g. subject matter, term) – within existing engagements
  • Payment data (e.g. bank details, invoices) – within existing engagements

Categories of data subjects

  • Business and contractual partners
  • Prospective clients
  • Communication partners
  • Users of this website

Purposes of processing

  • Provision of this website and its security
  • Contact enquiries and communication
  • Contractual services and support
  • Office and organisational procedures
  • Compliance with statutory retention obligations

Below we set out the legal bases of the General Data Protection Regulation (GDPR) on which we process personal data:

  • Performance of a contract and pre-contractual enquiries (Art. 6(1)(b) GDPR): processing is necessary for the performance of a contract or to take steps prior to entering into a contract.
  • Legitimate interests (Art. 6(1)(f) GDPR): processing is necessary to protect our legitimate interests, here: the secure and uninterrupted operation of the website, and answering enquiries that are not aimed at initiating a contract.
  • Legal obligation (Art. 6(1)(c) GDPR): processing is necessary for compliance with a legal obligation, in particular commercial and tax retention obligations.
  • Consent (Art. 6(1)(a) GDPR): we do not base the use of this website on consent, as we neither set cookies nor embed third-party services.

National data protection provisions in Germany: national provisions apply in addition, in particular the Federal Data Protection Act (BDSG) and § 25 TDDDG. As this website neither stores nor reads information on your device, consent under § 25(1) TDDDG is not required.

Security measures

We take appropriate technical and organisational measures to ensure a level of protection appropriate to the risk. These include serving the entire site over TLS encryption (HTTPS), a restrictive Content Security Policy, and the deliberate avoidance of third-party scripts.

Cookies and local storage

This website sets no cookies and stores no data in your browser’s local storage or session storage. A cookie banner is therefore deliberately omitted: there would be nothing for you to consent to.

Fonts

The typefaces used on this website, Barlow and Barlow Condensed, are served exclusively from our own server. No connection is established to Google Fonts or any other external provider. Your IP address is not transmitted to any third party for this purpose.

Provision of the online offering and web hosting

This website is hosted by IONOS SE, Elgendorfer Straße 57, 56410 Montabaur, Germany. The servers are located in the European Union. A data processing agreement pursuant to Art. 28 GDPR is in place with the provider.

Collection of access data and log files: when this website is accessed, access data is logged server-side in log files. This may include: IP address, date and time of the request, page requested, volume of data transferred, referrer URL, browser type and operating system.

  • Legal basis: legitimate interests (Art. 6(1)(f) GDPR), for operational security, error analysis and defence against abusive access.
  • Retention period: log files are deleted after no more than 7 days, unless they are required for longer to investigate a specific security incident.

Contacting us and the contact form

When you contact us (via the contact form, email or telephone), we process the details provided by the enquiring person to the extent necessary to respond.

  • Types of data processed: inventory data (first and last name), contact data (email address, optionally telephone number and company), content data (subject and message text), technical metadata (time of submission, originating page).
  • Legal bases: performance of a contract and pre-contractual enquiries (Art. 6(1)(b) GDPR) for business-related enquiries; legitimate interests (Art. 6(1)(f) GDPR) for other enquiries.
  • Spam protection: the form includes technical checks to block automated submissions (among others hidden fields, a timing check, and a limit on submissions per email address). No additional personal data is collected for this purpose and no third-party services are involved.

Processing on our behalf: Google Sheets / Google Apps Script

Data submitted via the contact form is stored, for the purpose of handling your enquiry, in a Google Sheet populated by a server-side Google Apps Script.

  • Service provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland.
  • Third-country transfer: processing by Google LLC in the USA cannot be ruled out. Google LLC is certified under the EU-US Data Privacy Framework; the transfer is based on the European Commission’s adequacy decision of 10 July 2023 (Art. 45 GDPR) and, additionally, on Standard Contractual Clauses (Art. 46(2)(c) GDPR).
  • Processing agreement: a data processing agreement pursuant to Art. 28 GDPR is in place (Google Cloud / Workspace Data Processing Addendum).
  • Provider’s privacy policy: https://policies.google.com/privacy

Retention and erasure of data

  • Server log files: deleted after no more than 7 days (see above).
  • Contact form submissions that do not lead to an engagement: deleted from the Google Sheet no later than 6 months after your enquiry has been finally dealt with.
  • Enquiries that result in an engagement: transferred into the engagement file; retained in accordance with commercial and tax law periods (generally 6 or 10 years under § 257 HGB, § 147 AO), then deleted.
  • Contract and billing data: retained for the statutory periods (generally 10 years), then deleted.

Rights of data subjects

Under the GDPR you have the following rights:

  • Right to object (Art. 21 GDPR): you have the right to object at any time, on grounds relating to your particular situation, to the processing of personal data concerning you which is based on Art. 6(1)(f) GDPR.
  • Right of access (Art. 15 GDPR)
  • Right to rectification (Art. 16 GDPR)
  • Right to erasure (Art. 17 GDPR)
  • Right to restriction of processing (Art. 18 GDPR)
  • Right to data portability (Art. 20 GDPR)
  • Right to lodge a complaint with a supervisory authority (Art. 77 GDPR): the competent authority is the State Commissioner for Data Protection and Freedom of Information of Rhineland-Palatinate, Hintere Bleiche 34, 55116 Mainz, Germany.

To exercise your rights, please contact: n.reiling@reiling-consulting.com

Changes to this privacy policy

We update this privacy policy whenever the processing operations described here change. The version published here, bearing the date given above, is the applicable one.