Applies to all pages under thomasmartin-pmp.de, including this English-language version. The German-language version is the legally authoritative version. / Diese englische Fassung dient nur der Information; rechtlich maßgeblich ist die deutsche Datenschutzerklärung.
The data controller within the meaning of the General Data Protection Regulation (GDPR) and other national data protection laws of the member states, as well as other data-protection-related provisions, is:
This website is the online presence of a sole proprietor. Only the data technically necessary to operate the website is processed, together with any data voluntarily submitted through email contact. Personal data is not sold or otherwise transferred to third parties for their own purposes. The specific legal basis and purpose for each processing activity is stated separately below.
This website is hosted by Hetzner Online GmbH, on servers located in Germany. Every time this website is accessed, the server automatically collects so-called server log files transmitted by your browser. These include: IP address, date and time of the request, page requested, amount of data transferred, browser type and version, operating system used, and the previously visited page (referrer URL). This data is not combined with any other data source.
The purpose of this processing is to ensure reliable operation of the website, to detect and defend against attacks, and for technical troubleshooting. The legal basis is Art. 6(1)(f) GDPR (legitimate interest in a secure and functioning website). Log files are retained for a limited period for security reasons and are then deleted or anonymized.
This website uses Umami, a self-hosted, open-source web analytics tool. The analytics server runs exclusively on infrastructure I control; no usage data is transferred to third parties or to providers outside the EU. In the standard configuration used here, Umami does not set cookies and does not store any persistently identifiable marker on your device. To distinguish returning visits within a single day, a hashed value is used, derived from IP address, user agent, and a randomly rotating daily component, from which the original IP address cannot be reconstructed. The data collected consists of pages visited, time on page, coarse geographic origin (country/region), referrer, and device/browser type — all aggregated, not compiled into individual visitor profiles.
The purpose of this processing is anonymous traffic measurement, to develop the site's content in line with actual usage. The legal basis is Art. 6(1)(f) GDPR (legitimate interest in privacy-conscious analysis of website usage). Under Art. 21 GDPR you have the right to object to this processing at any time; please use the contact details above to do so. For clarity: whether the rotating hash described above qualifies, under data protection law, as fully anonymous or merely pseudonymous is not conclusively settled in legal commentary. This policy therefore proceeds on the cautious assumption that the data is personal data, and grounds the processing in its own legal basis rather than claiming a full anonymity that cannot be reliably established.
The contact and inquiry forms on this website (including "Request case study", "Skeleton-in-the-Closet Audit request", "Stakeholder Radar request", "Data Workflow Audit request", "Discuss the result" on the HAL Test, and the open contact form) submit your details over an encrypted connection directly to a self-hosted CRM system (EspoCRM) on my own server at Hetzner Online GmbH, located in Germany. There, the details are recorded as a lead and used by me personally to handle your inquiry. No transfer to third parties outside this system takes place, with the exception of Hetzner Online GmbH as the hosting provider (data processing agreement under Art. 28 GDPR).
Depending on the form, the data processed includes name, email address, optionally phone number or location/role, and any message text you voluntarily provide. Please only include information in the free-text field that is necessary to handle your inquiry — in particular, no sensitive data about third parties that is not required for the inquiry. The legal basis is Art. 6(1)(b) GDPR where the inquiry relates to entering into or performing a contract, or otherwise Art. 6(1)(f) GDPR (legitimate interest in responding to inquiries). One form (case study request) additionally uses a double opt-in procedure; the legal basis there is Art. 6(1)(a) GDPR (consent). The data is deleted once it is no longer required to handle the inquiry, subject to any statutory retention periods.
Alternatively, you can still contact me directly by email; in that case the above applies accordingly, except that no data is transferred to the CRM system — the inquiry is handled directly from my email inbox instead.
Subject to applicable legal requirements, you have the following rights with respect to your personal data vis-à-vis the controller:
Without prejudice to any other administrative or judicial remedy, you have the right to lodge a complaint with a data protection supervisory authority. Given the business's registered address in Bavaria, the competent authority is:
For security reasons, this website uses SSL/TLS encryption for the transmission of confidential content. You can recognize an encrypted connection by the "https://" prefix and the padlock icon in your browser's address bar.
Under § 38 BDSG (German Federal Data Protection Act), a data protection officer must generally be appointed only once at least 20 people are regularly engaged in the automated processing of personal data, unless a core activity involving large-scale processing of special categories of data, or a required data protection impact assessment, triggers the obligation regardless of headcount. Neither applies here: the controller is a sole proprietor with no employees, and processing is limited to the low-risk activities described above. A data protection officer has therefore not been appointed.
This privacy policy will be updated as needed, for example following changes to the website or to applicable law. The version currently published on this page always applies.