Privacy policy

Technical connection data

When you access this website, the connection data required to deliver it is processed. This includes, in particular, your IP address, the date and time of access, the requested address including any URL parameters transmitted, the HTTP status, the volume of data transferred, and browser and device information. Where your browser transmits this information, the operating system and the previously visited page, known as the referrer URL, may also be recorded.

This processing serves to provide the website, detect and resolve faults, and protect against misuse and attacks. I do not use this data to create advertising profiles or to analyse your browsing behaviour on a personally identifiable basis.

The legal basis is Article 6(1)(f) GDPR. My legitimate interest is in providing a secure, reliable and functional website.

Hetzner

The website is operated on a server provided by Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany. The server used is located in Nuremberg, Germany. Hetzner provides the server infrastructure and may process technical data as part of this service. A data processing agreement pursuant to Article 28 GDPR is in place with Hetzner.

Further information: Hetzner's privacy policy.

Ploi

I use Ploi, Amperestraat 16J, 3861 NC Nijkerk, the Netherlands, to set up, administer and maintain the server. Technical operational data and logs may be processed as part of server administration. Where necessary for the agreed administration or support services, this may also involve access to personal data on the managed server. A data processing agreement pursuant to Article 28 GDPR is in place with Ploi.

Ploi is used as an administration service; merely visiting my website does not embed any Ploi content in your browser.

Further information: Ploi's privacy policy.

IONOS as domain and DNS service provider

The domain and its DNS records are managed by IONOS SE, Elgendorfer Str. 57, 56410 Montabaur, Germany. DNS resolves the domain name to the server address required to establish a connection. Depending on the DNS service used and its caching, IONOS may process technical DNS query data. This domain administration does not give IONOS access to the content of my contact forms.

The legal basis for the technical provision I arrange is Article 6(1)(f) GDPR. My legitimate interest is in making the website accessible under its domain. A data processing agreement pursuant to Article 28 GDPR is in place with IONOS.

Further information: IONOS's privacy policy.

Storage of server logs

The web server keeps access and error logs for the operational and security purposes mentioned. These may contain, in particular, the connection data described above.

Daily rotation is configured for the NGINX logs. Up to 52 archived log files are retained in addition to the current file; the oldest archives are removed during subsequent rotations. Empty files are not rotated. With regular operation and daily rotations, this corresponds to approximately 52 days of archived logs plus the current file. However, retention depends on the rotations that actually take place and is not a fixed maximum period of 52 calendar days.

Where individual data is necessary to investigate a specific security incident or to establish, exercise or defend legal claims, it may be retained separately for that purpose. The legal basis is Article 6(1)(f) GDPR; my legitimate interest is in investigating the incident and protecting my rights. Such data is deleted as soon as this purpose no longer applies and no statutory retention obligation prevents deletion.

Handling your enquiry

If you send me an enquiry using the contact form, by email or by telephone, I process the details it contains to review and respond to your request and, where appropriate, prepare a proposal or collaboration.

The contact form requires you to select the nature of your enquiry and provide your email address and message. Depending on the selected enquiry, you can additionally provide your name, organisation, a project URL, details of your starting situation and the desired timeframe. Technical form information about the selected language and protection against automated submissions is also processed.

The form is processed on my own server. The enquiry is delivered to me as an email; the form contents are not additionally stored permanently in a website database.

For email, I process in particular your email address, your name where provided, the message content, attachments and technical transmission data. For a telephone call, your telephone number, the information you provide and necessary call notes may be processed. I do not record telephone calls.

If your enquiry serves to enter into or perform a contract with you as a natural person, Article 6(1)(b) GDPR is the legal basis. For enquiries from a company's contact persons and other enquiries, processing is based on Article 6(1)(f) GDPR. My legitimate interest is in handling and responding to enquiries and in business communication.

Contacting me is voluntary. Without a suitable way to reply and the information required to handle your enquiry, I may be unable to respond. Details not marked as required in the form are voluntary.

Email service provider IONOS

I use IONOS SE, Elgendorfer Str. 57, 56410 Montabaur, Germany, to send, receive and store my business correspondence at kontakt@pascalpausch.com and other "@pascalpausch.com" email addresses. In particular, IONOS processes email addresses, messages, attachments and technical delivery data for this purpose. A data processing agreement pursuant to Article 28 GDPR is in place with IONOS.

Further information: IONOS's privacy policy.

Calendly is additionally used for appointment confirmations and reminders from Calendly bookings; section 6 applies to this.

Protecting the contact form

To protect against spam, automated requests and immediate duplicate submissions, the frequency and technical characteristics of submissions are checked. For this purpose, the IP address determined on the server is used in hashed form. A hash is also generated from technical association data and the form content to detect immediately repeated submissions. These hashes are pseudonymised protection data, not anonymous data.

The protection data is held exclusively in the memory of the running website process. The frequency check uses assessment windows of one minute and 15 minutes; identical submissions are detected within 60 seconds. Expired entries are cleared during subsequent form requests or discarded when the process ends. This protection data is not permanently stored in a database or a dedicated log file.

For form handling, the application logs only technical events, statuses and error categories. Message text, email addresses and IP addresses are not written to the application log. The separate web server logs are described in section 2.

The legal basis is Article 6(1)(f) GDPR. My legitimate interest is in keeping the contact function available, preventing misuse and avoiding unintended multiple deliveries.

Retention of contact enquiries

Contact enquiries and the associated correspondence are retained for as long as necessary to handle them and any subsequent collaboration. I review completed enquiries regularly. Non-binding enquiries and associated messages that are no longer needed are deleted, unless statutory retention obligations or specific reasons for protecting legal claims prevent this.

Business records subject to retention obligations are governed by the rules described in section 10. Merely making contact does not mean that every message is stored for the duration of a statutory retention period.

Voluntary activation of the appointment view

For online appointment scheduling, I use Calendly LLC, USA. The postal address published by Calendly for privacy enquiries is: 115 E Main St., Ste A1B, Buford, GA 30518, USA.

The embedded appointment view is only loaded when you expressly activate the designated button. Before that, this embed makes no connections to Calendly. Alternatively, you can reach me using the contact form, by email or by telephone.

When the appointment view is loaded, Calendly receives in particular your IP address, browser and device information, the time of access and, where applicable, information about the referring page. The activation I arrange is based on your consent pursuant to Article 6(1)(a) GDPR.

Your activation on my website is not stored permanently in a cookie or in browser storage. You can end the embed by reloading the page. After reloading, you must activate it again. This does not delete any data already transmitted to Calendly or revoke a cookie preference stored by Calendly. You can also withdraw your consent at any time by contacting kontakt@pascalpausch.com.

Calendly cookies and other technologies

Calendly may use technically necessary cookies and similar technologies for the appointment booking you expressly request.

According to its notices, Calendly may use technologies for purposes including analytics, personalisation and marketing. This may also include recording clicks, mouse movements and interactions within the booking view. By activating the appointment view on my website, you accept this.

Booking details and notifications

When booking, you are asked for your first name, last name, email address and the selected date and time. This also includes technically necessary appointment details such as the time zone, and information about bookings, changes and, where applicable, cancellations. I use this data to arrange, organise and conduct the appointment.

Calendly sends appointment confirmations and email reminders. In particular, your email address and the associated appointment details are processed for this purpose. I do not use SMS reminders.

Article 6(1)(b) GDPR applies to appointment handling where it involves entering into or performing a contract with you as a natural person. For appointments with a company's contact persons or other conversations, Article 6(1)(f) GDPR applies. My legitimate interest is in reliable appointment organisation and business communication.

Use of online booking is voluntary. Without the required contact and appointment details, Calendly cannot complete the booking. Appointments can alternatively be arranged using the contact methods stated above.

Appointment confirmation on this website

After a booking, Calendly may redirect you to a confirmation page on this website. Your first name, appointment type and start time are transmitted as URL parameters and processed on my server for the personal confirmation. The website does not store its own booking record for this purpose. The requested address may be contained in your browser history and in the server logs described in section 2. The legal basis is Article 6(1)(b) or (f) GDPR, subject to the conditions for appointment handling described above.

Responsibilities, calendar integration and retention period

Calendly acts as a processor for the booking data processing I arrange. A data processing agreement is in place with Calendly for this purpose. For certain processing it performs for its own purposes, particularly data from cookies and similar technologies in embedded services, Calendly acts as an independent controller under its terms. For this data, Calendly's terms describe separate responsibilities for Calendly and the website operator.

My Google Calendar is connected to Calendly. When a booking is made, contact and appointment details are therefore already transmitted to Google for calendar management and to create the Google Meet appointment. Calendly accesses calendar data within the permissions I have granted to determine availability and create appointments. According to its own information, Calendly also uses limited calendar information to personalise its setup and feature suggestions. Further information about the use of Google is provided in section 7.

I regularly review completed and cancelled bookings and arrange for personal booking and contact data that is no longer needed to be deleted. Contractually required records and statutory retention obligations remain unaffected. According to Calendly, it implements requested deletions within seven days. This is not an automatic deletion period of seven days after the appointment. Calendar copies and email messages are reviewed separately for their continued necessity and deleted where appropriate. Processing carried out by Calendly under its own responsibility is subject to its privacy notices.

Calendly processes data in the USA and potentially in other countries outside the European Economic Area. The bases for transfers are explained in section 9.

Further information:

• Calendly's privacy policy.
• Calendly's data processing terms.
• Calendly's use of calendar data.
• Deleting personal data at Calendly.

I use Google Calendar and Google Meet for calendar management and video calls.

The provider of Google services in the European Economic Area is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. The Google group includes, in particular, Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA. The Google Terms of Service and Google Privacy Policy apply to the consumer services used. Google also processes data under its own responsibility as a data controller, particularly to provide, secure and further develop its services.

Calendar management

For agreed appointments, Google Calendar processes in particular names, email addresses, dates, times and participation details, including the Meet link. For Calendly bookings, this transmission takes place during booking, regardless of whether you later participate in a video conference.

Processing serves to manage appointments, avoid overlaps and provide the agreed opportunity for a conversation. Article 6(1)(b) GDPR applies to my appointment organisation where it serves to enter into or perform a contract with you as a natural person. For appointments with a company's contact persons or other conversations, Article 6(1)(f) GDPR applies. My legitimate interest is in organising and conducting the agreed business appointments.

Appointment entries and invitations stored by me that are no longer required are deleted according to the criteria described in sections 6 and 10. Deleting a Calendly record does not replace the separate review of the calendar entry.

Video calls using Google Meet

When you open a Google Meet link or participate in a video call, Google processes the data required to establish the connection and conduct the call. This may include, in particular, the name you provide, Google account information where applicable, your IP address, device and browser information, the time and duration of participation, and technical connection data.

If you use your microphone, camera, screen sharing or chat, the corresponding audio, video, screen and chat content is processed and made available to the other participants. You can switch off your camera and microphone and decide for yourself which content to share.

I do not record conversations or use automatic transcription or AI-assisted recording and summarisation of conversations. The legal bases for appointment organisation stated above apply to the processing I arrange to conduct the conversation.

If you do not wish to use Google Calendar or Google Meet to arrange an appointment or conduct the conversation, please contact me directly by email or telephone. We can agree on an alternative contact method without using Calendly booking.

Google may also process data outside the European Economic Area, particularly in the USA. Information about the bases for transfers is provided in section 9. Retention periods for data processed by Google under its own responsibility depend on Google's privacy notices and the respective features and account settings.

Further information:

• Google's privacy policy.
• Google Terms of Service for Germany.
• Security and privacy in Google Meet.

Recipients

Access to personal data is granted only to parties that need it for the purposes described. These include, in particular, myself as controller and the service providers named in this policy for hosting, server administration, domain operation and email. Where these providers process data on my behalf, the necessary data processing agreements are in place.

When conducting a business relationship, payment service providers or banks may also receive the data required for payments. Further transfers take place where necessary to perform a contract, required by law or necessary to establish, exercise or defend legal claims, for example to competent authorities or, where specifically required, to legal or tax advisers. Depending on the purpose, the legal basis is Article 6(1)(b), (c) or (f) GDPR.

Transfers to third countries

Calendly and Google may process data outside the European Union and the European Economic Area, particularly in the USA. In addition to the legal bases for the respective processing, the requirements of Articles 44 et seq. GDPR apply to these transfers.

For data transfers to the USA, Calendly cites its certification under the EU-US Data Privacy Framework. Its data processing agreement provides for the European Commission's Standard Contractual Clauses if this framework ceases to be a valid basis for transfers. For cookie data from embedded services, the agreement contains separate provisions for transfers between independent controllers.

Google also cites the EU-US Data Privacy Framework and Google LLC's certification, as well as Standard Contractual Clauses, as transfer mechanisms for the data transfers described in its notices.

For transfers to an appropriately certified US recipient, the adequacy decision for the EU-US Data Privacy Framework under Article 45 GDPR may be relied upon. For other transfers, appropriate safeguards under Article 46 GDPR apply where required. You can review the safeguards described in the following provider information. You can also obtain further information through my data protection contact.

Further information:

• Calendly DPA and transfer provisions.
• Google's legal frameworks for data transfers.
• Data Privacy Framework information and certification list.

Withdrawing consent

You can withdraw consent you have given at any time with effect for the future pursuant to Article 7(3) GDPR. This does not affect the lawfulness of processing carried out before withdrawal. To withdraw consent, you can reach me using the contact details above. The options for ending the Calendly embed are additionally described in section 6.

Objecting to processing based on legitimate interests

If I process personal data on the basis of Article 6(1)(f) GDPR, you may object to the processing pursuant to Article 21 GDPR on grounds relating to your particular situation. I will then no longer process the data concerned unless I can demonstrate compelling legitimate grounds that override your interests, rights and freedoms, or the processing serves to establish, exercise or defend legal claims.

Lodging a complaint with a supervisory authority

Under Article 77 GDPR, you may lodge a complaint with a data protection supervisory authority, particularly in the Member State of your habitual residence, place of work or the place of the alleged infringement.

The following authority is generally responsible for my business in Bavaria:

Website and further contact options: Bavarian State Office for Data Protection Supervision.