Privacy policy

At a glance

Personal data is any information that relates to you as a person, such as your name, your email address or your IP address. On this website, it is processed in three situations:

• Whenever you open a page, your browser transmits technically necessary data such as your IP address. The website runs on a server at Hetzner in Germany, with Cloudflare placed in front of it as a delivery and protection service.
• When you use the contact or support form, your details are sent via my server as an email to my mailbox at Microsoft 365. To protect against spam, the form loads Cloudflare Turnstile as soon as you start using it.
• When you write to me or call me, and when this leads to a quotation or an order.

I use no analytics, tracking or marketing services, no social media plugins, no embedded maps or videos and no fonts from third-party providers. The website delivers fonts, images and scripts from its own address; the only exception is the spam protection on the two form pages. The website itself sets no cookies and stores nothing in your browser’s storage. Your rights are set out in the section Your rights.

This privacy policy covers this website and contact made through it. My stand-alone products such as Treuli and Repp have their own privacy notices, and client projects in which I process data on a client’s behalf are governed by the respective agreements.

Controller

The controller responsible for data processing on this website within the meaning of the General Data Protection Regulation (GDPR) is:

Gläser IT-Solutions is my sole proprietorship. For any questions about data protection and to exercise your rights, you can contact me directly using these details.

Hosting at Hetzner

The website runs as a container on a server that I rent from Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany. The server is located in a Hetzner data centre in Germany. This is where the application runs that delivers the pages and processes the input from the forms.

Hetzner provides the server, network and data centre and processes the data on my behalf. I have concluded a data processing agreement with Hetzner under Art. 28 GDPR. The legal basis is my legitimate interest in providing the website securely and reliably (Art. 6(1)(f) GDPR).

Cloudflare: DNS, delivery and protection

For my domain I use services provided by Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107, USA (Cloudflare). Cloudflare resolves the domain name (DNS) and acts as a reverse proxy in front of my server: every request to this website, including form submissions, first passes through Cloudflare’s data centre network and is forwarded from there to my server. In the process, Cloudflare delivers cached files such as images and fends off attacks, for example denial-of-service attacks (DDoS) and malicious requests (web application firewall).

For this purpose, Cloudflare processes the data listed in the section Access data and server log files, in particular your IP address. Because Cloudflare receives your browser’s encrypted connection, your form input also passes through Cloudflare.

Depending on the security settings, Cloudflare may set technically necessary cookies, for example ‘__cf_bm’ to detect automated access (bots), which expires after 30 minutes of inactivity, ‘cf_clearance’ after a security check has been passed, or ‘_cfuvid’ so that a rate limit can tell apart visitors who share an IP address. According to Cloudflare, these cookies are strictly necessary for the respective security functions; ‘__cf_bm’ is generated separately for each website and is not used to track you across websites. I rely on § 25(2) no. 2 TDDDG (German Telecommunications Digital Services Data Protection Act) for setting and reading these cookies.

The legal basis for the processing is my legitimate interest in a secure, fast and available website (Art. 6(1)(f) GDPR). Without this processing, the website cannot be accessed. You can object to it under Art. 21 GDPR (see Right to object).

Cloudflare processes this data as a processor on my behalf, on the basis of Cloudflare’s Data Processing Addendum, which forms part of my contract with Cloudflare. How long Cloudflare keeps log data is governed by Cloudflare’s rules for the service I use. Cloudflare operates a worldwide network of data centres; data may therefore also be processed in the USA and in other countries outside the EU (see Transfers to third countries).

Access data and server log files

Whenever something is requested from this website, technically necessary access data is processed by Cloudflare and, where Cloudflare forwards the request, on my server:

• IP address
• date and time of the request
• requested address (URL) and status code of the response
• amount of data transferred
• referrer URL, i.e. the page visited before, where your browser sends it
• browser type and version and operating system (user agent)

This data is needed to deliver the pages to you, to keep the website stable and secure and to find errors. The legal basis is my legitimate interest in these purposes (Art. 6(1)(f) GDPR). I do not combine this data with other data sources, nor do I analyse it for statistical or marketing purposes.

The website application on my server does not keep a log of individual page requests. It logs errors, which may include the requested address, and form events such as ‘delivered’ or ‘limit reached’, in each case without the IP address and without form content. These server log files are rotated by size: once the set maximum size is reached, the oldest entries are deleted automatically. How long an entry is kept therefore depends on how much is logged, not on a fixed number of days. If the web server in front of the application on my server logs requests, these logs contain the access data listed above, including the IP address; they are also rotated by size and not analysed.

I only keep individual entries for longer if a specific security incident requires it, and only until it has been resolved.

Cookies and browser storage

The website itself sets no cookies and stores nothing in your browser’s storage, such as local storage or session storage. The language version follows from the address you open, and animations follow your operating system’s reduced motion setting. None of this needs to be stored.

Cookies or similar technologies can only be added by Cloudflare: technically necessary security cookies (see Cloudflare) and, on the form pages only, the Turnstile spam protection (see Spam protection). I do not ask for consent for these. I rely on § 25(2) no. 2 TDDDG, because in both cases access to your device is strictly necessary for me to provide the website you have opened and the forms you use securely.

Contact and support forms

You can send me a request via the contact and support pages. Required fields are marked in the form. I process the following details:

Contact form

• name, email address and company
• phone number, if you provide it
• topic and message
• for requests about email archiving or endpoint management, optional details about your environment, such as the number of mailboxes or devices, the systems in use and your interests

Support form

• name, email address and company, and phone number if you provide it
• your confirmation that you are contacting me as a business, self-employed professional or public body
• whether a maintenance contract is in place, type of support, area and urgency
• without a maintenance contract, your confirmation that support is billed by time spent
• subject and description of the issue
• file attachments, if you add any: no more than three files totalling no more than 3 MB (images, PDF, text, CSV, JSON or ZIP)

Each request also includes the date and time of receipt and the language version of the page, and support requests a reference number. Please only send data that your request requires. Attachments such as screenshots or logs may contain data about other people; please redact it where possible.

How the data travels

Your browser sends the details over an encrypted connection to Cloudflare, which passes them on to my server. There, the application checks the input and the spam protection and then passes the request as an email via the Microsoft Graph interface to my mailbox at Microsoft 365 (see Email with Microsoft 365). A copy is kept in the ‘Sent Items’ folder of the mailbox the forms send from. The request is not stored on the web server itself.

You will not receive an automatic confirmation by email. I reply personally, usually by email to the address you provided. I handle support requests by email and phone; I do not currently use a ticket system. I do not pass your details on to any other service.

To limit misuse, the server counts how many requests arrive per IP address within an hour. For this, it holds the IP address in working memory only. An automatic clean-up every ten minutes deletes it at the latest about 70 minutes after the last request, as does any restart of the server; it is never stored permanently.

Purpose and legal basis

I process the details to answer your request and, for support requests, to deal with your issue and, where applicable, bill it by time spent. If your request is aimed at a contract or concerns an existing contract, the legal basis is Art. 6(1)(b) GDPR. For all other requests, I rely on my legitimate interest in answering enquiries addressed to me (Art. 6(1)(f) GDPR). The input checks, the count per IP address and the spam protection are based on my legitimate interest in protecting the forms against misuse (Art. 6(1)(f) GDPR).

Below each form there is a notice referring to this privacy policy. I do not ask for consent, because the processing is not based on consent. You are not required by law or contract to provide your data. Without the required details, however, I cannot handle your request; instead of using the form, you can also write to me directly or call me.

Retention

I delete requests as soon as they are no longer needed, which is usually once your matter has been fully resolved and no further questions are expected. If the request leads to an order or I have to keep it as business correspondence, I keep it until the statutory retention period ends (see Retention periods).

Spam protection with Cloudflare Turnstile

Cloudflare Turnstile protects both forms against automated requests (spam). The provider is Cloudflare (see above). Turnstile is only loaded on the contact and support pages, in both language versions, and only once you start using the form, i.e. as soon as you click or tap a field or move to it with the keyboard. Until then, the page makes no connection to Turnstile.

According to Cloudflare, Turnstile processes signals from your browser and your connection, including your IP address, a fingerprint of the encrypted connection (TLS), the user agent, the site key and the origin of the page. To do this, a script from Cloudflare runs small checks in your browser that query properties of your browser and solve computational tasks. Cloudflare states that Turnstile does not access the content of your input. The result is a single-use token that is sent to my server with the form. My server has it confirmed by Cloudflare, transmitting only the token and its secret key, not your IP address.

In providing Turnstile, Cloudflare acts as a processor on my behalf. Where Cloudflare also uses the signals to improve Turnstile’s bot detection, Cloudflare states that it is a controller in its own right for this purpose and relies on legitimate interests. You can direct questions about this to Cloudflare’s data protection officer by email at dpo@cloudflare.com.

The legal basis is my legitimate interest in protecting the forms and my mailbox against spam and misuse (Art. 6(1)(f) GDPR). Because Turnstile reads information from your browser for this, I rely on § 25(2) no. 2 TDDDG for this access: according to Cloudflare, the signals collected are strictly necessary to detect and block bots, and without this protection I cannot securely offer the form submission you have requested.

If you do not want to use Turnstile, or the check does not load, for example because of an ad blocker, you can reach me by email or phone (see Controller). For transfers to the USA, see Transfers to third countries.

Contact by email or phone

If you email or call me, I process your details, such as your name, contact details and request, in order to deal with your enquiry. Emails arrive in my mailbox at Microsoft 365 (see Email with Microsoft 365).

If your request is aimed at a contract or concerns an existing contract, the legal basis is Art. 6(1)(b) GDPR; otherwise it is my legitimate interest in answering enquiries addressed to me (Art. 6(1)(f) GDPR). Retention is the same as for the forms (see Retention periods).

Email with Microsoft 365

My business mailbox is hosted on Microsoft 365 (Exchange Online). Your emails to me and the requests from the forms arrive there, and my replies are kept there. My contracting party is Microsoft Ireland Operations Limited, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, Ireland. Microsoft processes the data as a processor on my behalf, on the basis of the Microsoft Product Terms together with the Microsoft Products and Services Data Protection Addendum.

For Microsoft 365, Microsoft has committed under its EU Data Boundary to store and process customer data in data centres in the EU and EFTA. In limited cases described by Microsoft, for example remote access for operations and maintenance or protection against security threats, data may also be processed outside this area, in particular in the USA (see Transfers to third countries).

Depending on the request, the legal basis for its use is Art. 6(1)(b) GDPR or my legitimate interest in reliable and secure email communication (Art. 6(1)(f) GDPR).

Quotations and invoices with sevDesk

I create and send quotations and invoices with the accounting software sevDesk of sevDesk GmbH, Im Unteren Angel 1, 77652 Offenburg, Germany. If you request a quotation or place an order with me, I process the following there:

• name, company and address
• email address and, where applicable, phone number
• quotation, invoice and payment data
• descriptions of the services agreed and provided

sevDesk processes the data as a processor on my behalf; a data processing agreement under Art. 28 GDPR is in place with sevDesk. According to sevDesk, the data is stored on servers in Germany. The legal bases are the preparation and performance of the contract (Art. 6(1)(b) GDPR) and my obligations under commercial and tax law (Art. 6(1)(c) GDPR). Retention follows the statutory retention periods (see Retention periods).

Recipients of your data

I only pass on your data where this is necessary for the purposes described, where I am legally obliged to do so or where you have consented. Recipients may be:

• my processors: Hetzner (hosting), Cloudflare (DNS, delivery, protection and spam protection), Microsoft (email) and sevDesk (quotations and invoices)
• Cloudflare as a controller in its own right, where it uses Turnstile signals to improve bot detection
• tax advisers and bookkeepers, where necessary for my accounting and tax obligations
• lawyers and courts, where I have to assert or defend legal claims
• my professional indemnity insurer (Hiscox SA) in the event of a claim, to examine and settle it
• authorities and public bodies, where I am legally obliged to disclose data, for example the tax office

Depending on the case, the legal basis for disclosure is Art. 6(1)(b) GDPR (contract), Art. 6(1)(c) GDPR (legal obligation) or Art. 6(1)(f) GDPR (legitimate interest, in particular in establishing, exercising or defending legal claims). I do not sell data and do not pass it on for advertising purposes.

Transfers to third countries

Cloudflare and Microsoft belong to groups of companies headquartered in the USA. When their services are used, personal data may be transferred to the USA or to other countries outside the EU and the European Economic Area.

For the USA, the European Commission adopted an adequacy decision on the EU-US Data Privacy Framework on 10 July 2023 (Art. 45 GDPR). The decision currently applies; its validity is being challenged in court. Cloudflare, Inc. and Microsoft Corporation are certified under this framework. In addition, the contracts with both providers include the European Commission’s standard contractual clauses (Art. 46(2)(c) GDPR) for transfers not covered by the Data Privacy Framework.

Despite these safeguards, access to data by US authorities cannot be ruled out. I therefore only use these providers where I need them to operate, and I use locations in Germany and the EU where possible: the website runs at Hetzner in Germany, I use Microsoft 365 within the EU Data Boundary, and sevDesk stores data in Germany.

Retention periods

I only keep personal data for as long as the respective purpose requires; details are given in the sections above. Statutory retention obligations take precedence. Under § 147 of the German Fiscal Code (AO) and, where applicable, § 257 of the German Commercial Code (HGB), I keep:

• books, records and annual financial statements for ten years
• accounting vouchers, which include invoices, for eight years
• business correspondence received and sent, which may include emails and quotations, for six years

These periods begin at the end of the calendar year in which the document was created. Once they have expired, I delete the data, unless I still need it to establish, exercise or defend legal claims.

Your rights

You have the following rights with regard to personal data concerning you:

• access (Art. 15 GDPR): whether and which data I process about you, for what purposes, to whom I disclose it and how long I keep it
• rectification of inaccurate data and completion of incomplete data (Art. 16 GDPR)
• erasure (Art. 17 GDPR), unless a statutory retention obligation or another ground listed in Art. 17(3) GDPR prevents it
• restriction of processing (Art. 18 GDPR), for example while the accuracy of your data is being checked
• data portability (Art. 20 GDPR): to receive the data you have provided to me in a structured, commonly used and machine-readable format, where the processing is based on a contract or consent and carried out by automated means
• objection (Art. 21 GDPR) to processing based on legitimate interests, see Right to object
• withdrawal of consent with effect for the future (Art. 7(3) GDPR), if you have given me consent

An informal message to hi@glaeser-it.com or a letter to the address in the section Controller is sufficient to make a request.

Complaint to a supervisory authority

You also have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR), in particular in the member state of your habitual residence, place of work or the place of the alleged infringement. The authority responsible for me is the Saxon Data Protection and Transparency Commissioner:

Right to object under Art. 21 GDPR

Where I process your data on the basis of legitimate interests (Art. 6(1)(f) GDPR), you may object to this processing at any time on grounds relating to your particular situation. On this website, this applies above all to delivery via Cloudflare, access data and server log files, the spam protection and requests that are not aimed at a contract. Following an objection, I will no longer process this data unless I can demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms, or the processing serves to establish, exercise or defend legal claims.

Should I process your data for direct marketing, you may object to this at any time without giving reasons; I will then no longer use it for this purpose (Art. 21(2) and (3) GDPR).

An informal message to hi@glaeser-it.com is sufficient to object.

Encryption and security

For security reasons, this website uses an encrypted connection (TLS), including for transmitting your form input. You can recognise an encrypted connection by the padlock symbol in your browser’s address bar. As long as encryption is active, third parties cannot read the data on its way between your browser and Cloudflare.

I take technical and organisational measures to protect your data against loss, alteration and unauthorised access, and I keep them up to date with the state of the art. Nevertheless, nobody can guarantee completely secure transmission over the internet. This applies in particular to email: messages are usually encrypted in transit, but not end to end. Please do not send me particularly confidential content by email; ask me for a secure way of transmitting it instead.

No automated decision-making

I do not make decisions based solely on automated processing, including profiling, which produce legal effects concerning you or similarly significantly affect you (Art. 22 GDPR). The spam protection does decide automatically whether a form can be submitted; if it rejects a request, you can still reach me by email or phone.

Objection to advertising emails

I object to the use of the contact details published in the legal notice for sending advertising and information material that has not been expressly requested. I expressly reserve the right to take legal action in the event of unsolicited advertising, for example by spam email.

Changes to this privacy policy

I update this privacy policy when the website, the services used or the legal situation change. The version published here applies; the date at the top shows when it was last updated.

This privacy policy is available in German and English. In the event of any discrepancy between the language versions, the German version prevails.