Privacy Policy

Last updated: June 2026

1. Data Controller

Windschatten IT GmbH
represented by managing director Fabian Ullmann
Stubenrauchstraße 10
85101 Lenting
Germany
Email: fabian@windschatten.it

Where this policy uses the first-person plural form ("we"/"us"), it refers to Windschatten IT GmbH as the controller.

2. Data Protection Officer

Appointing a data protection officer is not legally required in our case. The contact point for all data protection matters is the management: fabian@windschatten.it.

3. General Information on Data Processing

The protection of your personal data is important to us. We process personal data exclusively in compliance with the General Data Protection Regulation (GDPR) and the German Federal Data Protection Act (BDSG).

4. Hosting and Server Log Files

This website is hosted by Hostinger International Ltd. The server is located in Germany (Frankfurt am Main). When visiting this website, technical information (IP address, browser type, operating system, time of access, requested URL, referrer) is automatically stored in server log files.

Legal basis: Art. 6(1)(f) GDPR. Our legitimate interest lies in the stable delivery of the website, the defence against attacks and the analysis of technical issues.

A data processing agreement pursuant to Art. 28 GDPR is in place with Hostinger. Log data is deleted or anonymised after no later than 14 days.

For its internal services (e.g. support, infrastructure monitoring, backup systems), Hostinger may engage its own sub-processors, some of which may be located in third countries. According to Hostinger's privacy policy, such transfers are safeguarded through standard contractual clauses pursuant to Art. 46(2)(c) GDPR.

5. Contact Form

When you use the contact form, we process the data you provide (name, email address, message) to respond to your enquiry and to prepare a possible collaboration.

Form data is processed exclusively on our own server and forwarded to us via email. No transfer to third parties takes place in this context.

Legal basis: Art. 6(1)(b) GDPR (pre-contractual measures) or Art. 6(1)(f) GDPR (legitimate interest in responding to general enquiries).

Providing this data is voluntary. Without your name and email address, we cannot answer your enquiry.

Retention period: until your enquiry has been fully handled; beyond that, in accordance with commercial and tax retention obligations for up to ten years.

6. Appointment Booking (Google Workspace and Google Meet)

Our contact page offers the option to book an initial consultation online. For scheduling and running the video call, we use Google Workspace provided by Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Ireland), together with its components Google Calendar and Google Meet.

When you book, we process your name, email address, requested time slot and any optional note. Google creates a calendar entry and a Google Meet room and sends calendar invitations to the email addresses provided. During use, additional technical connection data (e.g. IP address, connection metadata) may be processed by Google.

Legal basis: Art. 6(1)(b) GDPR (pre-contractual measures and performance of the consultation).

Using Google Workspace may result in personal data being transferred to Google LLC in the United States. The legal basis for this third-country transfer is the adequacy decision of the European Commission on the EU-US Data Privacy Framework of 10 July 2023; Google is certified under this framework. A data processing agreement pursuant to Art. 28 GDPR is additionally in place with Google.

Meetings are not recorded. Appointment data is retained until the meeting has taken place and subsequently in accordance with commercial and tax retention obligations.

For further information, please refer to Google's privacy policy at policies.google.com/privacy.

7. Contact via WhatsApp

Our website and Google Business Profile offer the option to contact us via WhatsApp. If you use this option, the chat is handled through the WhatsApp platform of Meta Platforms Ireland Ltd. (4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland).

In the course of the chat, we process your mobile phone number, the profile name you have transmitted and the content of your message. Message contents are, according to Meta, end-to-end encrypted. Meta nevertheless receives metadata (phone number, timestamps, device information, connection data) required for operating the platform.

Legal basis: Art. 6(1)(b) GDPR where your enquiry is aimed at initiating a contractual relationship, otherwise Art. 6(1)(f) GDPR; our legitimate interest lies in providing a low-threshold option for initial contact.

Meta Platforms Ireland Ltd. is an independent controller for the data arising from the operation of WhatsApp; no data processing agreement pursuant to Art. 28 GDPR exists in this respect. Operating WhatsApp involves a transfer of data to Meta Platforms, Inc. in the United States. The legal basis for this third-country transfer is the adequacy decision of the European Commission on the EU-US Data Privacy Framework of 10 July 2023; Meta is certified under this framework.

For confidential project content we recommend contacting us by email at fabian@windschatten.it or via the contact form. We deliberately use WhatsApp only as a low-threshold channel for initial contact, not for the transmission of sensitive content.

Retention period: until your enquiry has been fully handled; beyond that, in accordance with commercial and tax retention obligations. For further information on data processing by Meta, please refer to whatsapp.com/legal/privacy-policy-eea.

8. Web Analytics (Umami)

This website uses Umami, a privacy-friendly open-source analytics software. We self-host Umami on the same server in Germany (Hostinger, Frankfurt am Main).

No cookies are set, IP addresses are not stored and no identifying tokens are linked. Only aggregated data (page views, time on page, referrer, device type) is collected for anonymous reach measurement and website optimisation.

Legal basis: Art. 6(1)(f) GDPR. Our legitimate interest lies in the statistical, anonymous analysis of website usage in order to improve our service.

As no access to end devices within the meaning of § 25 TDDDG takes place (no cookies, no reading of local storage), consent is not required.

You can disable tracking at any time by executing localStorage.setItem("umami.disabled", 1) in your browser console.

9. Cookies and Local Storage

This website does not use tracking cookies. Your browser's localStorage only stores the colour mode setting (light or dark) you have chosen, so that it is preserved on your next visit. This information remains on your device, is not transmitted to us, and is exempt from consent under § 25(2) TDDDG.

10. Recipients and Processors

Personal data is shared with the following categories of recipients for the purposes described above:

  • Hostinger International Ltd. - web hosting, server operations (EU/DE)
  • Google Ireland Ltd. / Google LLC - calendar and video calls (only when you book an appointment)
  • Meta Platforms Ireland Ltd. / Meta Platforms, Inc. - WhatsApp communication (only when you contact us via WhatsApp)

Data processing agreements pursuant to Art. 28 GDPR are in place with Hostinger and Google. Meta Platforms Ireland Ltd. is an independent controller for the data arising from WhatsApp usage; no processing relationship within the meaning of Art. 28 GDPR exists in this respect.

11. Transfers to Third Countries

Transfers outside the EU/EEA may occur in the following cases:

  • in the context of appointment booking via Google Workspace (see section 6); the legal basis is the European Commission's adequacy decision on the EU-US Data Privacy Framework;
  • in the context of contact via WhatsApp (see section 7); the legal basis is the European Commission's adequacy decision on the EU-US Data Privacy Framework;
  • in the context of internal infrastructure services of our hosting provider Hostinger (see section 4); the legal basis is standard contractual clauses pursuant to Art. 46(2)(c) GDPR.

12. Retention Period

Personal data is retained only for as long as necessary for the respective processing purpose or as required by statutory retention obligations. Specific periods are stated in the individual sections above.

13. Your Rights

Under the GDPR, you have the following rights:

  • Right of access (Art. 15 GDPR)
  • Right to rectification (Art. 16 GDPR)
  • Right to erasure (Art. 17 GDPR)
  • Right to restriction of processing (Art. 18 GDPR)
  • Right to data portability (Art. 20 GDPR)
  • Right to object to processing based on legitimate interests (Art. 21 GDPR)

To exercise your rights, please contact fabian@windschatten.it.

14. Automated Decision-Making

Automated decision-making, including profiling within the meaning of Art. 22 GDPR, does not take place.

15. Right to Lodge a Complaint

You have the right to lodge a complaint with a supervisory authority if you believe that the processing of your personal data violates the GDPR. The competent supervisory authority is the Bavarian Data Protection Authority (Bayerisches Landesamt für Datenschutzaufsicht, BayLDA), Promenade 18, 91522 Ansbach, Germany.

16. Changes

We reserve the right to update this privacy policy in order to reflect changes in the legal framework or in our service. The version currently published on this page applies.