1. Controller

No data protection officer has been appointed.

2. Provision of the website and server log files

When this website is accessed, our hosting provider processes technically necessary connection data. This includes, in particular, the IP address, date and time of access, the page or file requested, HTTP status code, volume of data transferred, referrer URL, and browser and operating-system information.

The processing serves to deliver the website, maintain its stability and security, and detect and defend against attacks. The legal basis is Article 6(1)(f) GDPR. Our legitimate interest is the secure and uninterrupted operation of the website.

Processor: STRATO GmbH, Otto-Ostrowski-Straße 7, 10249 Berlin, Germany. A data-processing agreement pursuant to Article 28 GDPR is in place with STRATO. Processing takes place in data centres in Germany. According to STRATO, the IP addresses of website visitors are stored for attack detection for no more than seven days and are then anonymised.

3. Contact by email or telephone

If you contact us by email or telephone, we process your contact details and the information you provide in order to deal with your enquiry. For contract negotiations or ongoing engagements, the legal basis is Article 6(1)(b) GDPR. Other business enquiries are processed pursuant to Article 6(1)(f) GDPR; our legitimate interest is the appropriate handling and documentation of the communication.

Recipients may include our hosting and email provider STRATO and persons whose involvement is necessary to deal with the enquiry.

Retention period: Enquiries that do not result in a project or any further business relationship are deleted no later than six months after the last contact. If an enquiry results in a project or engagement, it becomes part of the project documentation and is subject to the periods stated in section 8. Statutory retention obligations and legitimate interests in safeguarding legal claims remain unaffected.

4. Contact form

We use Contact Form 7 for the contact form. When you submit it, we process the selected enquiry category, your name, email address and message and, where provided voluntarily, your company, telephone number and subject. Enquiry category, name, email address and message are mandatory because otherwise we cannot reliably classify and answer the enquiry.

The information is transmitted exclusively to the info@profab-l.de mailbox hosted by STRATO. The form message is not additionally stored in the WordPress database and is not transmitted to external spam, CAPTCHA or SMTP services.

The legal bases and retention period are the same as for the contact processing described in section 3. Providing the information is voluntary; the form cannot be submitted without the fields marked as mandatory.

5. Protection of the contact form against automated submissions

To protect the form against automatically submitted advertising messages, we use our own locally operated procedure. It consists of an additional field that is invisible to people and a signed timestamp generated when the form is opened. If the invisible field is completed or the form is submitted unusually quickly, the submission is classified as unwanted and is not delivered.

No cookies are set, no IP addresses are evaluated and no data are transmitted to external services. The legal basis is Article 6(1)(f) GDPR; our legitimate interest is preventing misuse of the form.

6. Manually used AI email assistant

To assist with handling individual emails, we may use the optional AI email assistant within STRATO Webmail. The function does not analyse incoming messages automatically. It is invoked deliberately for a selected message only, for example to create a draft, summary, reformulation or translation.

The content of the selected email and supplementary work instructions may be processed. STRATO states that the service is based on ChatGPT language processing. STRATO processes the data under the existing data-processing agreement and may use contractually bound technical sub-processors for this purpose.

The processing serves the efficient and linguistically appropriate handling of business correspondence. The legal basis is Article 6(1)(b) GDPR for contract-related messages and Article 6(1)(f) GDPR for other business communications. Our legitimate interest is the efficient handling of enquiries. AI results are reviewed by a person before use; no solely automated decision-making or profiling within the meaning of Article 22 GDPR takes place.

7. Internal search

When the internal website search is used, the search term entered is transmitted to the web server and may appear in the server log files. The processing serves to provide the requested search results and to operate the website securely. The legal basis is Article 6(1)(f) GDPR. The retention period stated in section 2 applies to log data.

8. Prospect, client and project data

When initiating and carrying out engagements, we process data relating to our clients and the contact persons they designate. This typically includes names, roles, business contact details, information from enquiries and quotations, contractual and project documents, correspondence and billing data.

The purposes are preparing quotations, carrying out and documenting projects, billing and meeting statutory obligations. The legal bases are Article 6(1)(b) GDPR for contract-related processing, Article 6(1)(c) GDPR for statutory retention and documentation obligations, and Article 6(1)(f) GDPR for documentation and safeguarding legal claims.

Storage location: These documents are processed and stored locally on the controller’s devices. They are not stored in cloud services.

Retention period: We retain project documentation for the duration of the project and thereafter for as long as necessary to comply with statutory retention obligations or to establish, exercise or defend legal claims. Statutory retention periods of six or ten years apply to documents relevant under tax and commercial law; each period begins at the end of the calendar year in which the relevant matter was completed.

9. Accounting and tax obligations

For accounting and tax returns, we process the master, contractual and billing data required for those purposes. Processing is carried out independently using locally installed tax software; no external tax adviser is involved for this purpose.

Recipients are the competent tax authorities as part of statutory declaration and cooperation obligations and, for payment transactions, the financial institutions involved. The legal bases are Article 6(1)(c) GDPR in conjunction with tax and commercial-law provisions and Article 6(1)(b) GDPR.

10. Work in our clients’ systems and premises

When carrying out projects, we sometimes work in our clients’ systems, networks or premises. Where personal data are viewed or processed in this context, this takes place exclusively on the client’s instructions and within the client’s sphere of responsibility. The client determines the purpose, scope and duration of such processing; in this respect, the client is the controller under data-protection law and fulfils the information obligations towards the data subjects.

Where a data-processing agreement pursuant to Article 28 GDPR or a confidentiality agreement is required for such work, we enter into it with the client. Please direct data-subject enquiries concerning this processing to the relevant client; otherwise, we will forward them there without undue delay.

11. Backups

To protect against data loss and technical faults, we create backups of this website, including its database. The backups are generated using software operated locally within the WordPress installation and stored on web space hosted by STRATO; individual backups are also kept locally. No data are transmitted to external backup services.

Backups may contain personal data included on the website. They are used exclusively for restoration and are overwritten or deleted at regular intervals. The legal basis is Article 6(1)(f) GDPR; our legitimate interest is the availability and recoverability of the website.

12. Cookies, audience measurement and external content

We do not use analytics, marketing or other non-essential cookies for anonymous website visitors. No audience measurement takes place. The previously used WP SlimStat statistics software and the former cookie-banner solution have been deactivated.

The website does not automatically load web fonts, analytics software, maps, videos or social-media plugins from third parties. External websites—for example a linked profile on an industry portal—are accessed only when you deliberately select the relevant link; from that point onwards, the privacy provisions of the relevant provider apply. Technically necessary storage may be used in the non-public administration area; it does not affect normal anonymous visits to the website.

13. Recipients and third-country processing

Personal data are received only by the service providers and persons who require them for the purposes described in each case. Where STRATO uses technical sub-processors for individual functions, their involvement, including any international data transfers, is governed by the data-protection and data-processing terms agreed with STRATO and by the statutory requirements of Articles 44 et seq. GDPR.

14. Your rights

Subject to the statutory requirements, you have, in particular, the right of access (Article 15 GDPR), rectification (Article 16 GDPR), erasure (Article 17 GDPR), restriction of processing (Article 18 GDPR), data portability (Article 20 GDPR), objection to processing based on legitimate interests (Article 21 GDPR), and withdrawal of consent with effect for the future (Article 7(3) GDPR).

You also have the right to lodge a complaint with a data-protection supervisory authority. The authority expected to be competent for us is:

15. Objection pursuant to Article 21 GDPR

Where we process personal data on the basis of Article 6(1)(f) GDPR, you may object at any time on grounds relating to your particular situation. We will then no longer process the data concerned unless we can demonstrate compelling legitimate grounds or the processing serves to establish, exercise or defend legal claims.

16. Currency of this policy

We amend this privacy policy when the services used, processing operations or legal requirements change.