Privacy Policy

Last updated: April 2026

1. Data Controller

Windschatten IT GmbH
represented by managing director Fabian Ullmann
Stubenrauchstraße 10
85101 Lenting
Germany
Email: fabian@windschatten.it

Where this policy uses the first-person plural form ("we"/"us"), it refers to Windschatten IT GmbH as the controller.

2. Data Protection Officer

Appointing a data protection officer is not legally required in our case. The contact point for all data protection matters is the management: fabian@windschatten.it.

3. General Information on Data Processing

The protection of your personal data is important to us. We process personal data exclusively in compliance with the General Data Protection Regulation (GDPR) and the German Federal Data Protection Act (BDSG).

4. Hosting and Server Log Files

This website is hosted by Hostinger International Ltd. The server is located in Germany (Frankfurt am Main). When visiting this website, technical information (IP address, browser type, operating system, time of access, requested URL, referrer) is automatically stored in server log files.

Legal basis: Art. 6(1)(f) GDPR. Our legitimate interest lies in the stable delivery of the website, the defence against attacks and the analysis of technical issues.

A data processing agreement pursuant to Art. 28 GDPR is in place with Hostinger. Log data is deleted or anonymised after no later than 14 days.

For its internal services (e.g. support, infrastructure monitoring, backup systems), Hostinger may engage its own sub-processors, some of which may be located in third countries. According to Hostinger's privacy policy, such transfers are safeguarded through standard contractual clauses pursuant to Art. 46(2)(c) GDPR.

5. Contact Form

When you use the contact form, we process the data you provide (name, email address, message) to respond to your enquiry and to prepare a possible collaboration.

Form data is processed exclusively on our own server and forwarded to us via email. No transfer to third parties takes place in this context.

Legal basis: Art. 6(1)(b) GDPR (pre-contractual measures) or Art. 6(1)(f) GDPR (legitimate interest in responding to general enquiries).

Providing this data is voluntary. Without your name and email address, we cannot answer your enquiry.

Retention period: until your enquiry has been fully handled; beyond that, in accordance with commercial and tax retention obligations for up to ten years.

6. Appointment Booking (Google Workspace and Google Meet)

Our contact page offers the option to book an initial consultation online. For scheduling and running the video call, we use Google Workspace provided by Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Ireland), together with its components Google Calendar and Google Meet.

When you book, we process your name, email address, requested time slot and any optional note. Google creates a calendar entry and a Google Meet room and sends calendar invitations to the email addresses provided. During use, additional technical connection data (e.g. IP address, connection metadata) may be processed by Google.

Legal basis: Art. 6(1)(b) GDPR (pre-contractual measures and performance of the consultation).

Using Google Workspace may result in personal data being transferred to Google LLC in the United States. The legal basis for this third-country transfer is the adequacy decision of the European Commission on the EU-US Data Privacy Framework of 10 July 2023; Google is certified under this framework. A data processing agreement pursuant to Art. 28 GDPR is additionally in place with Google.

Meetings are not recorded. Appointment data is retained until the meeting has taken place and subsequently in accordance with commercial and tax retention obligations.

For further information, please refer to Google's privacy policy at policies.google.com/privacy.

7. Web Analytics (Umami)

This website uses Umami, a privacy-friendly open-source analytics software. We self-host Umami on the same server in Germany (Hostinger, Frankfurt am Main).

No cookies are set, IP addresses are not stored and no identifying tokens are linked. Only aggregated data (page views, time on page, referrer, device type) is collected for anonymous reach measurement and website optimisation.

Legal basis: Art. 6(1)(f) GDPR. Our legitimate interest lies in the statistical, anonymous analysis of website usage in order to improve our service.

As no access to end devices within the meaning of § 25 TDDDG takes place (no cookies, no reading of local storage), consent is not required.

You can disable tracking at any time by executing localStorage.setItem("umami.disabled", 1) in your browser console.

8. Cookies and Local Storage

This website does not use tracking cookies. Your browser's localStorage only stores the colour mode setting (light or dark) you have chosen, so that it is preserved on your next visit. This information remains on your device, is not transmitted to us, and is exempt from consent under § 25(2) TDDDG.

9. Recipients and Processors

Personal data is shared with the following categories of recipients for the purposes described above:

  • Hostinger International Ltd. — web hosting, server operations (EU/DE)
  • Google Ireland Ltd. / Google LLC — calendar and video calls (only when you book an appointment)

Data processing agreements pursuant to Art. 28 GDPR are in place with all processors.

10. Transfers to Third Countries

Transfers outside the EU/EEA may occur in the following cases:

  • in the context of appointment booking via Google Workspace (see section 6); the legal basis is the European Commission's adequacy decision on the EU-US Data Privacy Framework;
  • in the context of internal infrastructure services of our hosting provider Hostinger (see section 4); the legal basis is standard contractual clauses pursuant to Art. 46(2)(c) GDPR.

11. Retention Period

Personal data is retained only for as long as necessary for the respective processing purpose or as required by statutory retention obligations. Specific periods are stated in the individual sections above.

12. Your Rights

Under the GDPR, you have the following rights:

  • Right of access (Art. 15 GDPR)
  • Right to rectification (Art. 16 GDPR)
  • Right to erasure (Art. 17 GDPR)
  • Right to restriction of processing (Art. 18 GDPR)
  • Right to data portability (Art. 20 GDPR)
  • Right to object to processing based on legitimate interests (Art. 21 GDPR)

To exercise your rights, please contact fabian@windschatten.it.

13. Automated Decision-Making

Automated decision-making, including profiling within the meaning of Art. 22 GDPR, does not take place.

14. Right to Lodge a Complaint

You have the right to lodge a complaint with a supervisory authority if you believe that the processing of your personal data violates the GDPR. The competent supervisory authority is the Bavarian Data Protection Authority (Bayerisches Landesamt für Datenschutzaufsicht, BayLDA), Promenade 18, 91522 Ansbach, Germany.

15. Changes

We reserve the right to update this privacy policy in order to reflect changes in the legal framework or in our service. The version currently published on this page applies.