Legal · Updated 28 September 2026

Privacy policy

1. Controller

klardenker GmbH, Olper Str. 33, 51491 Overath, Germany, represented by David Suermann. Email: [email protected]; phone: +49 221 96986525.

2. Hosting, Cloudflare and server logs

This website and its self-managed mailing application are hosted by Hetzner Online GmbH in Germany. When the website is accessed, technically necessary connection data may be processed, including IP address, time, requested address, referrer, browser and operating system. Processing is based on Art. 6(1)(f) GDPR to provide the website securely and reliably. Logs are deleted when no longer required unless legal retention or security reasons apply. We have concluded a data processing agreement with Hetzner.

In front of the Hetzner server we use services of the Cloudflare group for DNS, encrypted transport, protection against abusive traffic and reliable delivery. Cloudflare processes technically necessary connection and log data such as the IP address, requested address, time and device information. Processing is based on Art. 6(1)(f) GDPR and our interests in security, availability and efficient delivery. Cloudflare may process data outside the EEA and identifies the EU-US Data Privacy Framework, Standard Contractual Clauses and supplementary measures as transfer safeguards. The applicable data processing terms form part of the Cloudflare contract.

3. Contact and business enquiries

When you use the contact form or contact us by email or phone, we process the details and content you provide, in particular name, email address, company, optional phone number, type and timing of the project, message, language and enquiry source. To prevent forms submitted abusively or under somebody else's address, we first send a time-limited confirmation link. The enquiry is forwarded to us only after that click. Unconfirmed form enquiries are automatically deleted after no more than two days. This does not start an automated sales sequence. If you selected the separate voluntary newsletter option, its own double-opt-in email is sent only after the enquiry has been confirmed. The legal basis is Art. 6(1)(b) GDPR for pre-contractual or contractual matters, Art. 6(1)(c) GDPR for legal duties and otherwise Art. 6(1)(f) GDPR, including our interest in protecting systems and communications from abuse.

The free system self-assessment can be used completely without personal details. If, after seeing the complete result, you voluntarily request a result email, we store your name, email address, optional company, score, answers and resulting focus decisions as an enquiry. We send the result once and notify ourselves internally. This does not subscribe you to a newsletter. The same legal bases and deletion principles apply as for other business enquiries.

We additionally protect public forms with Cloudflare Turnstile. Cloudflare uses technically necessary connection, device and interaction data, including IP address, browser information, time and the course of form use, to assess whether a request is likely to come from a human. The check runs in the background and becomes visible only when interaction is required. Its purpose is to prevent automated abuse, spam and confirmation emails being triggered to uninvolved third parties. Processing is based on Art. 6(1)(f) GDPR and our legitimate interests in secure and economic forms. The Cloudflare and international-transfer information in section 2 also applies. Turnstile data is not used for our audience measurement or advertising.

4. Free email series and editorial emails

If you subscribe, we process your email address, selected language, source of subscription, subscription and confirmation times, delivery status, current sequence step and unsubscribe status. We use double opt-in: the series starts only after you confirm the link sent to your address. The legal basis is your consent under Art. 6(1)(a) GDPR. You may withdraw it at any time through the unsubscribe link in every email or by contacting us.

List management and automation run in a self-managed application on our Hetzner web hosting. Emails are sent through our configured Hetzner mail server. After unsubscribing, your address and withdrawal status may remain on a suppression list where necessary to prevent further marketing and document compliance.

5. Optional open and click measurement

Separately from subscribing, you may voluntarily consent to individual email measurement. Only then does the HTML email contain a small image loaded from our own domain and selected links redirect through that domain. We record the assignment to your email address, message or campaign, the type and time of the event and, for clicks, the destination URL. We attempt to mark obvious automated requests by email software or security systems separately. Raw IP addresses are not stored for this purpose in our mailing database.

We use these signals to evaluate topics and formats and make future content more relevant to apparent interests. Opens are approximate: email software may preload or block images, while security systems may automatically inspect links. We do not make solely automated decisions with legal or similarly significant effects.

The legal basis is your separate consent under Art. 6(1)(a) GDPR in conjunction with section 25(1) TDDDG. Measurement is not required to receive the emails. You can withdraw it at any time through “Tracking preferences” in every email without unsubscribing. We then stop measuring and delete the open and click events previously assigned to you. Without withdrawal, individual events are deleted after no more than 24 months.

6. Cookies and website measurement

We measure use of this website with a self-hosted, cookieless system on our Hetzner hosting. It records pages viewed, selected navigation and action clicks, form starts and submissions, downloads and outbound clicks, referring domain, voluntarily transmitted UTM campaign parameters, language, broad device category and the country code supplied by Cloudflare. Form contents, field values and raw IP addresses are not stored in the analytics database.

To estimate daily visitors and sessions and to limit abusive automated requests, short-lived hashes are derived from the IP address, browser identifier and a secret key. The visitor value changes daily and the session value at least every 30 minutes; it is not intended to recognise anyone over longer periods or across websites. The IP address itself is not retained. Browser characteristics also help separate obvious search engines, AI crawlers, social previews and suspected automation. This classification is approximate and does not establish identity. Event-level data is deleted after no more than 90 days.

The sole purposes are to understand and improve this website's content, navigation and enquiry paths and to distinguish human-like use from recognisably automated traffic. Processing is based on Art. 6(1)(f) GDPR and our legitimate interests in a useful, economic and secure website. Global Privacy Control and Do Not Track signals are respected, in which case no measurement event is stored. The system uses no cookies or local storage, creates no advertising profile and does not join anonymous usage with named enquiries.

Google Analytics and advertising pixels from LinkedIn, Meta or other advertising networks are not embedded. No general consent banner is therefore shown. Separate consent for individual email measurement concerns emails only. The protected administration uses a technically necessary session cookie after sign-in. Cloudflare Turnstile and other enabled Cloudflare security functions may set technically necessary cookies or comparable short-lived security features solely for abuse detection, not for advertising or profiling. If consent-based services are added later, they will remain blocked until prior consent and this policy will be updated.

7. Recipients and retention

Data is available only to authorised persons and processors who need it for the purposes stated, in particular Hetzner for website, database and email hosting and Cloudflare for DNS, security and delivery services. No data is sold. Pending, unconfirmed newsletter registrations are deleted after 30 days. Other data is deleted when no longer necessary, subject to legal duties and legitimate interests.

8. Your rights

Subject to the statutory conditions, you have rights of access, rectification, erasure, restriction, data portability and objection. Consent may be withdrawn for the future at any time. You may also complain to a supervisory authority, in particular the State Commissioner for Data Protection and Freedom of Information North Rhine-Westphalia, www.ldi.nrw.de.

9. Security and updates

We use HTTPS and appropriate technical and organisational measures. This policy will be updated when services, processing activities or legal requirements change.