Privacy notice

1. Controller and scope

The controller responsible for processing personal data in connection with this website and business contacts initiated through it is:

This notice applies to visits to insight-for-you.de and to contact by email or telephone. Participation in market research studies may require separate privacy information tailored to the individual project.

2. Hosting and technical access data

This website is hosted by Domainfactory GmbH, c/o WeWork, Neuturmstraße 5, 80331 Munich, Germany, under the Webhosting Deluxe Special plan. DomainFactory provides the technical infrastructure used to deliver the website and processes technical access data in doing so.

When web pages are accessed, the IP address and technical information transmitted with the request are processed in particular. This may include the time of access, the requested address, status messages, browser and operating system information, and the previously visited page, where transmitted by the browser.

This processing makes the website available and enables the detection and investigation of technical faults and unauthorised access. The legal basis is Article 6(1)(f) GDPR. My legitimate interest is the reliable and secure operation of my business website.

DomainFactory states a retention period of 14 days for Apache access logs in its cPanel web hosting products. Specific data may need to be retained for longer to investigate a particular security incident or meet a legal obligation; any such retention is limited to the relevant purpose and necessary duration.

Further provider information: Privacy at DomainFactory.

3. Server-side hosting statistics

In its cPanel hosting environment, DomainFactory automatically provides server-side statistics using AWStats and Webalizer. These may process IP addresses, referring pages, country information derived from IP addresses and browser information. This processing is separate from additional analytics tools such as Google Analytics.

The statistics provide a technical overview of the operation and use of the website. The legal basis is Article 6(1)(f) GDPR; the legitimate interest is technical monitoring of website operation. I do not combine these data with personal enquiries.

According to DomainFactory, the additional statistics files remain stored until deleted by the administrator. Automatic daily deletion has not currently been confirmed. No daily deletion period is therefore guaranteed for these files.

4. Contact by email or telephone

If you contact me, I process the contact details you provide, information about your business role and company, and the content and history of your enquiry. For emails, this also includes message metadata and any attachments. During telephone calls, information you provide may be recorded in written notes.

The data are used to respond to your enquiry and discuss a potential collaboration. Where you are personally the contracting party and the enquiry concerns pre-contractual steps or a contract, the legal basis is Article 6(1)(b) GDPR. For enquiries made as an employee or other company contact, processing is based on Article 6(1)(f) GDPR. My legitimate interest is appropriate business communication and handling your enquiry.

Providing your data is generally voluntary. Without a working contact address and the information needed to understand your enquiry, I may be unable to respond, or may only be able to respond to a limited extent.

5. Email provider and applications used

My email account is hosted by DomainFactory. I use the new Microsoft Outlook with a Microsoft 365 Personal/Family subscription and Spark with a Premium subscription in my own name, on Windows and mobile devices. Spark team features are not used. There is no automatic email forwarding to other mailbox providers.

In addition to displaying messages locally, these applications may process data on their providers’ servers for synchronisation, notifications and other functions. A mailbox hosted by DomainFactory therefore does not mean that all email data are processed exclusively there.

Microsoft is a technical service provider involved in the use of Microsoft Outlook. Spark is provided by Spark Mail Limited, Glandore Business Centres, 26–27 Fitzwilliam Place, Fitzwilliam Hall, Dublin 2, D02T292, Ireland. Depending on the function used, message content, contact details, metadata and attachments may be affected in particular.

Processing serves to handle and organise business communication. Where technical support is based on Article 6(1)(f) GDPR, the legitimate interest is efficient handling across devices. The legal bases for the individual enquiry remain as described in section 4.

Spark publishes a Data Processing Agreement, incorporated into its terms, which applies insofar as Spark processes personal data on the user’s behalf. Information about the technical processes: Microsoft: synchronisation with the Microsoft cloud and Spark app privacy information.

6. Assistance through ChatGPT

I also use OpenAI’s ChatGPT through a personal Plus account to access selected emails in Spark and Outlook. Such processing may involve sending sender and recipient details, message content, attachments, and resulting summaries or drafts to OpenAI for processing. Simply visiting this website does not transmit data to ChatGPT.

The use of my content for model improvement is disabled in my account settings. This does not mean that data are not processed or stored to provide and secure the service.

This assistance is used to search for and organise business information and prepare summaries and draft texts. Article 6(1)(f) GDPR may provide a legal basis where processing is necessary in the particular case and is not overridden by the interests or fundamental rights of the individuals concerned. The interest pursued is efficient handling of business correspondence. This notice does not constitute consent to the transmission of message content.

For users in the European Economic Area, OpenAI identifies OpenAI Ireland Limited, 1st Floor, The Liffey Trust Centre, 117–126 Sheriff Street Upper, Dublin 1, D01 YC43, Ireland, as the controller for the processing described in its privacy policy. Conversations stored in the ChatGPT account may remain until deleted. Following a deletion request, OpenAI generally states that removal takes place within 30 days; legal or security reasons in particular may require longer retention. Further information on recipients, retention and data subject rights is provided in OpenAI’s European privacy policy.

7. Project collaboration with Claudia Bevers

I work with Claudia Bevers of Bevers Consulting on qualitative projects. Where necessary for a collaboration agreed with you, I share the business contact details and project information needed for that purpose with her. Incoming enquiries are not routinely forwarded in their entirety.

Article 6(1)(b) GDPR may apply to necessary data concerning an individual who is personally the contracting party; Article 6(1)(f) GDPR may apply to a company’s business contacts. The legitimate interest is the coordination and delivery of the joint project. If consent is required, it is obtained separately. Data protection responsibilities and any additional project information depend on the particular collaboration.

8. Own server, backups and deletion

Own Synology server

I also store quotations, invoices and project documents on my own Synology server at my premises. Only I have access to the relevant business area. These documents may contain personal data relating to business contacts, such as names, contact details, roles and related correspondence. Personal data relating to study participants are not stored on this server.

Storage serves to handle enquiries and orders, document projects and fulfil statutory retention obligations. Depending on the purpose, Article 6(1)(b), (c) or (f) GDPR applies as explained above. For company contacts, the legitimate interest is orderly documentation of the business relationship.

Remote access using QuickConnect

I use Synology QuickConnect for my own remote access. Synology processes technical connection and device information, particularly IP addresses, device identifiers and connection details. Depending on the connection, traffic may be routed through a Synology relay server. Remote access serves the legitimate interest in working with my business documents regardless of location, under Article 6(1)(f) GDPR.

Daily backup to Synology C2

The local drives are mirrored. In addition, an external backup is made daily via Hyper Backup to Synology C2, with Europe selected as the storage region. Backup copies of the relevant documents are transmitted to the C2 infrastructure. Synology Inc., 9F., No. 1, Yuandong Rd., Banqiao Dist., New Taipei City, Taiwan, is involved as the provider of C2 services. Synology provides a Data Processing Agreement for C2 as part of its service terms.

Backups enable recovery following data loss or technical failures. The legal basis is Article 6(1)(f) GDPR; the legitimate interest is protecting business documents and ensuring system recovery. Retention of working documents and storage of older backup versions are separate matters.

The backup retains 14 versions. Backups are performed daily. The period covered by those versions depends on actual backup runs and rotation; this does not establish a fixed deletion period of 14 calendar days. Data deleted from working documents may remain in older backup versions until those versions are removed through backup rotation.

Further information: Synology: information about the services used and Data processing at Synology C2.

Deletion and statutory retention

I delete enquiries that do not result in an engagement once the matter has been concluded and no further correspondence is expected, unless statutory retention obligations or purposes necessary for legal claims in an individual case require otherwise.

Where documents form part of a business relationship, retention depends on their type and the applicable obligations. Business correspondence subject to tax retention requirements must generally be kept for six years, accounting vouchers for eight years, and certain books and records for ten years. The start of these periods and any extensions are governed by statutory provisions. The legal basis for statutory retention is Article 6(1)(c) GDPR.

Where data are required to establish, exercise or defend legal claims, they are retained under Article 6(1)(f) GDPR for the necessary period. Once the relevant reason no longer applies, the data are deleted. Specific log and statistics retention periods are described in sections 2 and 3; technical copies held by email and AI services must be considered separately.

9. Transfers outside the European Economic Area

The email, AI and Synology services used may also process data outside the European Economic Area, particularly in the United States. Europe is selected as the Synology C2 storage region. Other processing by service providers, for example in connection with QuickConnect, is separate from this. Synology Inc. is based in Taiwan.

The providers describe different safeguards in their privacy and contractual information: Microsoft states that it participates in the EU-US Data Privacy Framework. Spark refers to adequacy decisions, including the recipient’s applicable participation in the Data Privacy Framework, and otherwise to EU Standard Contractual Clauses. OpenAI refers to adequacy decisions and EU Standard Contractual Clauses for other transfers. The C2 terms contain provisions on Standard Contractual Clauses for relevant transfers. These provider statements do not guarantee exclusively European processing.

An adequacy decision or the use of Standard Contractual Clauses does not replace the legal basis required for the respective processing. Information on the safeguards described by the providers and contact options for further enquiries is available from Microsoft, Spark, OpenAI and Synology C2. For information about or copies of its transfer safeguards, OpenAI provides the address privacy@openai.com. You may also contact me about this.

10. Website functions, cookies and external links

This website does not embed analytics or advertising scripts, social media plugins, externally loaded fonts, videos, maps, newsletter subscriptions or contact forms. Images and design assets are loaded from my own hosting space. The supplied page code does not set cookies or use local browser storage for tracking. Server-side processing is described in sections 2 and 3.

External websites such as LinkedIn and Bevers Consulting are included as ordinary links. Merely displaying these links does not load content from the linked provider. If you follow a link, the relevant provider’s privacy information applies to your subsequent visit.

When accessed via HTTPS, the connection to the website is encrypted in transit. The confidentiality of email communication also depends on the email services and transmission routes involved.

11. Your rights

Subject to the applicable legal conditions, you have the following rights:

• Access to your personal data under Article 15 GDPR;
• Rectification of inaccurate data and completion of incomplete data under Article 16 GDPR;
• Erasure under Article 17 GDPR;
• Restriction of processing under Article 18 GDPR;
• Data portability under Article 20 GDPR.

Where processing is based on your consent, you may withdraw it at any time with effect for the future. This does not affect the lawfulness of processing carried out before withdrawal.

To exercise your rights, please use the contact details in section 1.

Under Article 77 GDPR, you may lodge a complaint with a supervisory authority, particularly in the place of your habitual residence, place of work or the alleged infringement. The authority responsible for my business location is the State Commissioner for Data Protection and Freedom of Information of Rhineland-Palatinate (Landesbeauftragter für den Datenschutz und die Informationsfreiheit Rheinland-Pfalz): Postfach 30 40, 55020 Mainz, Germany; email: poststelle@datenschutz.rlp.de; website: datenschutz.rlp.de.

12. Automated decision-making

In the website and contact processing described here, I do not make decisions based solely on automated processing that produce legal or similarly significant effects within the meaning of Article 22 GDPR.