Privacy Policy

Data Protection

The operators of this website take the protection of your personal data very seriously. We treat your personal data confidentially and in accordance with the statutory data protection regulations and this privacy policy.

We would like to point out that data transmission over the Internet (e.g., when communicating by email) may have security gaps. Complete protection of data against access by third parties is not possible.

Data Controller

Hueskotech Consulting GbR

Authorized representatives: Lukas Hügle & Armin Skollik

Herzogstraße 105, 80796 Munich, Germany

Phone: +49 174 302 8495

Email: info@hueskotech.de

The data controller is the natural or legal person who, alone or jointly with others, decides on the purposes and means of processing personal data.

Storage Duration

Unless a more specific storage period has been stated within this privacy policy, your personal data will remain with us until the purpose for data processing no longer applies. If you assert a legitimate request for deletion or revoke consent to data processing, your data will be deleted, unless we have other legally permissible reasons for storing your personal data (e.g., tax or commercial law retention periods).

General Information on the Legal Basis

If you have consented to data processing, we process your personal data on the basis of Art. 6 para. 1 lit. a GDPR. If you have consented to the storage of cookies or access to information on your device, data processing is additionally carried out on the basis of § 25 para. 1 TDDDG. Consent can be revoked at any time.

If your data is required for the fulfillment of a contract or for the implementation of pre-contractual measures, we process your data on the basis of Art. 6 para. 1 lit. b GDPR. Furthermore, we process your data if this is necessary to fulfill a legal obligation on the basis of Art. 6 para. 1 lit. c GDPR. Data processing may also be carried out on the basis of our legitimate interest pursuant to Art. 6 para. 1 lit. f GDPR.

Recipients of Personal Data

In the course of our business activities, we work with various external parties. We only pass on personal data to external parties if this is necessary for the fulfillment of a contract, if we are legally obliged to do so, if we have a legitimate interest, or if another legal basis permits the transfer of data. When using processors, we only pass on personal data on the basis of a valid data processing agreement.

Revocation of Your Consent to Data Processing

Many data processing operations are only possible with your express consent. You can revoke consent you have already given at any time. The legality of the data processing carried out until the revocation remains unaffected by the revocation.

Right to Lodge a Complaint with the Supervisory Authority

In the event of violations of the GDPR, data subjects have a right of complaint to a supervisory authority, in particular in the Member State of their habitual residence, their place of work or the place of the alleged violation.

Competent supervisory authority: Bavarian State Office for Data Protection Supervision (BayLDA), Promenade 18, 91522 Ansbach, Germany.

Right to Data Portability

You have the right to have data that we process automatically on the basis of your consent or in fulfillment of a contract handed over to you or to a third party in a common, machine-readable format. If you request the direct transfer of the data to another controller, this will only be done insofar as it is technically feasible.

Information, Correction and Deletion

Within the framework of the applicable legal provisions, you have the right at any time to free information about your stored personal data, its origin and recipient and the purpose of data processing and, if applicable, a right to correction or deletion of this data.

Right to Restriction of Processing

You have the right to request the restriction of the processing of your personal data. The right to restriction of processing exists in the following cases:

• If you dispute the accuracy of your data, for the duration of the verification
• If the processing is unlawful and you request restriction instead of deletion
• If we no longer need the data, but you need it to assert legal claims
• If you have lodged an objection, as long as it has not yet been determined whose interests prevail

SSL/TLS Encryption

This site uses SSL or TLS encryption for security reasons and to protect the transmission of confidential content. You can recognize an encrypted connection by the fact that the address line of the browser changes from "http://" to "https://" and by the lock symbol in your browser line. When SSL or TLS encryption is activated, the data you transmit to us cannot be read by third parties.

Server Log Files

When visiting our website, information is automatically recorded in server log files:

• IP address of the accessing computer
• Date and time of access

This data is collected to ensure trouble-free operation and to defend against attacks. IP addresses are deleted or anonymized after a maximum of 7 days.

The legal basis is Art. 6 para. 1 lit. f GDPR (legitimate interest in the security and stability of the website).

Inquiry by Email or Phone

If you contact us by email or phone, your inquiry including all personal data arising from it (name, inquiry) will be stored and processed by us for the purpose of processing your request. We do not share this data without your consent.

The processing of this data is based on Art. 6 para. 1 lit. b GDPR (contract initiation) or Art. 6 para. 1 lit. f GDPR (legitimate interest in the effective processing of inquiries).

Cookies

This website does not use cookies for advertising or tracking purposes, and it does not embed third-party analytics services such as Google Analytics. We only use technically necessary cookies insofar as they are required for the operation of the website.

For audience measurement we use Umami, a self-hosted software. It works entirely without cookies and stores nothing on your device. It reads exactly one value from your browser: the objection marker that you set yourself using the switch in the following section. Please see the following section for details.

The legal basis for technically necessary cookies is Art. 6 para. 1 lit. f GDPR (legitimate interest) and § 25 para. 2 no. 2 TDDDG (no consent required for technically necessary cookies).

Audience Measurement with Umami (Self-Hosted)

We use Umami, an open-source audience measurement software. Umami is not obtained as a service from an external provider; it runs on infrastructure we operate ourselves in Germany (IONOS SE, Berlin data centre). Measurement data is collected via the endpoint umami.venedy.io. The data is not passed on to the maker of Umami or to any other third parties. No transfer to a third country takes place.

The operator of the analytics instance, and therefore the recipient of the data, is Venedy GmbH, Herzogstraße 105, 80796 Munich, Germany. Venedy GmbH is a legally separate company and thus a different legal entity from Hueskotech Consulting GbR. Both companies are run by the same founders (Lukas Hügle and Armin Skollik) and use jointly operated infrastructure. Venedy GmbH operates the analytics instance exclusively on our behalf and on our instructions; Venedy GmbH does not use your data for its own purposes.

When you open a page, the measurement script only evaluates information that your browser transmits with every page request anyway:

• the address requested (URL) — from its query string we transmit campaign parameters only (utm_*, gclid, msclkid, fbclid); every other parameter is removed before anything is sent
• the previously visited page (referrer); here too we transmit only the campaign parameters named above from its query string, all others are removed
• the page title
• the hostname of the website

The measurement code we serve does not even read screen resolution or language settings from your browser. The measurement therefore neither accesses information on your device nor stores anything there. This is precisely why § 25 para. 1 TDDDG does not apply and no consent is required for it. The only read access the script performs concerns the objection marker umami.disabled; it exists only if you have objected, and reading it is strictly necessary in order to honour your objection (§ 25 para. 2 no. 2 TDDDG).

From the information your browser sends anyway, we additionally derive on the server side:

• browser, operating system and device type (from the user agent)
• country, region and city (from the IP address, using a local MaxMind database inside our own container — no request is made to any external service). No location is derived beyond city level; no coordinates are collected

The IP address itself is never stored. It is evaluated in memory for this lookup only and then discarded.

The visitor identifier is an irreversible hash derived from IP address, user agent, website identifier and a secret salt that rotates daily. The IP address itself is not stored in the analytics database — there is no column for IP addresses there. Because the salt rotates daily, recognition beyond the same day is impossible.

In particular, the following does not take place:

• no session replay and no heatmaps
• no profiling, no scoring and no automated decision-making within the meaning of Art. 22 GDPR
• no merging of data across devices or across providers
• no integration of advertising networks

Our Umami instance also does not establish any outbound connections (it runs in private mode; telemetry and update checks are disabled).

Retention period: the raw audience measurement data is deleted automatically after 12 months (via a deletion job that runs daily).

The legal basis is Art. 6 para. 1 lit. f GDPR. Our legitimate interest consists specifically in

• evaluating visitor numbers and page views statistically,
• detecting technical errors and dead links,
• designing the content of our website to meet actual demand,
• planning the capacity requirements of our infrastructure,
• understanding where our audience is located (country, region and city level), and
• measuring the success of our own campaigns — that is, which ad or newsletter brings visitors to us.

Server Log Files of the Measurement Infrastructure

Separately from the audience measurement itself, the web server providing the measurement endpoint writes access logs. The IP addresses they contain are stored in truncated form only (the last octet is set to 0).

These logs are deleted after 7 days. The purpose is IT security and operational stability; the legal basis is Art. 6 para. 1 lit. f GDPR (legitimate interest in secure and trouble-free operation).

These are to be distinguished from the server log files of our hosting provider described above, which are generated when the website itself is accessed.

LinkedIn

Our website contains links to our company presence on LinkedIn. When you click on these links, you will be redirected to the LinkedIn platform. In doing so, data such as your IP address is transmitted to LinkedIn. Information on data processing by LinkedIn can be found in LinkedIn's privacy policy: https://www.linkedin.com/legal/privacy-policy