Privacy notice
This notice explains how we process personal data when you visit this website or contact us. Our services are offered exclusively to businesses.
1. Controller
Heidemann Consulting GmbH
Goethestr. 44
74243 Langenbrettach
Germany
Managing director: Richard Heidemann
Phone: +49 176 32470211
E-Mail: info@heidemann-consulting.com
Please contact us directly with privacy questions or to exercise your rights.
2. Website access and hosting
We use Microsoft Azure Static Web Apps. Static content is delivered through a globally distributed network. The managed server function for the contact form runs in the Azure region West Europe (EU).
To deliver and protect the website, the hosting service processes technical connection data. This may include your IP address, time of access, requested address, browser and operating system information, referring page, and status and error data. The purposes are service delivery, troubleshooting and protection against abuse. The legal basis is Article 6(1)(f) GDPR; our legitimate interest is the secure and reliable operation of the website.
Connection data is needed to handle your request. Where it becomes part of operational or security logs, further retention depends on the diagnostic or security purpose, particularly investigating errors or abuse. Section 3 gives the specific retention periods for our Application Insights logs. These periods do not apply universally to all internal operational data held by the hosting provider.
3. Technical monitoring
We use Azure Application Insights with a Log Analytics workspace, both in West Europe (EU), to monitor server-side functions. Data may include requested endpoints, timestamps, response times, status codes, error messages, technical request information and, where applicable, IP addresses. Our application does not deliberately write the content of contact enquiries to diagnostic logs.
The website does not include a client-side Application Insights script. We do not use advertising trackers or tools to analyse your clicking or reading behaviour. The reading progress indicator and scroll animations run locally in your browser.
Retention: Request and diagnostic logs (AppRequests, AppTraces), application metrics, performance counters and the technical usage overview (Usage) have a total retention period of 90 days. The other configured tables (Alert, AppCenterError, ComputerGroup, InsightsMetrics and Operation) have a total retention period of 30 days. The 30-day interactive retention period is included in these totals. For tables configured with a 30-day period, Azure may technically retain data for up to 31 days.
The legal basis is Article 6(1)(f) GDPR. Our legitimate interest is to detect and resolve technical errors, outages and abuse.
4. Contact form, email and telephone
When you contact us, we process your contact details and the content of your enquiry to handle your request and answer follow-up questions. The form requires your name, company, email address and message; your position, telephone number and area of interest are optional. You cannot submit the form without the required information. There is no legal obligation to provide it. Alternatively, you can contact us by email or telephone.
The legal basis is Article 6(1)(b) GDPR where the enquiry relates to a contract with you as an individual or pre-contractual steps you request. For enquiries on behalf of a company, particularly by its employees or representatives, and other business enquiries, we rely on Article 6(1)(f) GDPR. Our legitimate interest is handling business matters and communicating with prospective customers and business partners. We do not require consent to this privacy notice for these purposes.
Delivery through Azure Communication Services
The server function passes form data to Azure Communication Services Email to deliver the enquiry to our business mailbox. The Communication and Email resources, including their sender domains, are configured with the data geography Europe. Email open and click tracking (User Engagement Tracking) is disabled. The selected data geography does not mean every transmission step takes place exclusively within Europe.
Business mailbox in Microsoft 365
We handle incoming emails and contact form enquiries using Exchange Online in Microsoft 365 Business Premium. Germany is shown as both the current and committed data geography for stored mailbox content. Exchange Online Protection provides spam and malware protection; its current geography is Germany and its committed geography is EU/EFTA. These statements concern the respective storage commitments and do not guarantee that every processing operation takes place exclusively in Germany.
How long do we retain enquiries?
We retain enquiries and related correspondence for as long as necessary to handle the matter and maintain the associated business contact. Once an enquiry is completed and no further business use is needed, we delete the data unless retention obligations or legitimate grounds require continued storage.
Commercial and tax law may require longer retention of certain business records; the legal basis is then Article 6(1)(c) GDPR. Where data is necessary to establish, exercise or defend legal claims, we retain it under Article 6(1)(f) GDPR until that purpose ceases, taking account of applicable limitation periods. In these cases, use is restricted to the retention purpose.
5. Recipients and international processing
Microsoft provides hosting, diagnostics, email delivery and mailbox services. Microsoft group companies, including Microsoft Corporation, One Microsoft Way, Redmond, WA 98052-6399, USA, and subprocessors used for these services may have access to data when delivering the services. Within our company, access is limited to authorised persons handling the matter. Other recipients may receive data where necessary to comply with legal obligations or establish or defend legal claims, such as competent authorities or appointed legal advisers.
Processing by Microsoft on our behalf is governed by the Microsoft Products and Services Data Protection Addendum (DPA) under Article 28 GDPR. It also regulates subprocessors and certain processing for Microsoft's own legitimate business operations; Microsoft therefore does not act solely on our instructions for every processing operation.
European storage locations do not rule out international transfers, for example during global content delivery, email transmission or support. Transfers outside the European Economic Area are subject to Articles 44 et seq. GDPR. Where no applicable adequacy decision exists, the Microsoft DPA provides, in particular, EU Standard Contractual Clauses as appropriate safeguards. The terms and safeguards are available in the Microsoft DPA. You may also request information and a copy of the safeguards relevant to our processing using the contact details above.
6. Cookies, fonts and browser functions
The website code we provide does not set cookies. When you select a language, we store only that choice (German or English) under “heidemann-language” in your browser’s Local Storage. It remains there until you change your selection or clear the website data in your browser. This preference is used only to retain your chosen language across pages and visits; it contains no user identifier and is not used for tracking. Without a saved choice, we use your preferred browser language if it is German or English, and otherwise German. If browser storage is blocked, a language parameter in links preserves your choice while navigating. We do not use tracking pixels or cross-device user profiles. The blog's copy feature writes the selected template text to your clipboard only when you press the copy button.
The language preference is stored and read to provide the language function you expressly request, under section 25(2), no. 2 of the German TDDDG. To the extent personal data is processed, the legal basis is Article 6(1)(f) GDPR; our legitimate interest is to provide your chosen language version.
Fonts are delivered with the website through our hosting service. No connection is made to an additional font provider such as Google Fonts. The hosting information in section 2 applies to these requests.
7. Security and automated decisions
The publicly served website uses HTTPS/TLS to protect transmission between your browser and the web service. This protects data in transit but does not guarantee protection against every risk on end devices or during subsequent email processing.
We do not make decisions based solely on automated processing that produce legal or similarly significant effects under Article 22 GDPR, or carry out related profiling, in connection with website visits or contact enquiries.
8. Your rights
Subject to the applicable legal conditions, you have the following rights:
- Access to your personal data (Article 15 GDPR);
- Rectification of inaccurate data and completion of incomplete data (Article 16 GDPR);
- Erasure (Article 17 GDPR) and restriction of processing (Article 18 GDPR);
- Data portability for automated processing based on consent or a contract (Article 20 GDPR);
- Withdrawal of consent with effect for the future (Article 7(3) GDPR), without affecting the lawfulness of processing before withdrawal.
Your right to object under Article 21 GDPR
You may object at any time, on grounds relating to your particular situation, to processing based on Article 6(1)(f) GDPR. We will then stop processing the data concerned unless we demonstrate compelling legitimate grounds overriding your interests, rights and freedoms, or the processing serves to establish, exercise or defend legal claims.
You may object to processing for direct marketing at any time without giving reasons. The data will then no longer be processed for that purpose. To object, simply contact info@heidemann-consulting.com.
Complaint to a supervisory authority
Under Article 77 GDPR, you may complain to a data protection supervisory authority, particularly in the place of your habitual residence, place of work or the alleged infringement. The authority responsible for our company is:
Der Landesbeauftragte für den Datenschutz und die Informationsfreiheit Baden-Württemberg (State Commissioner for Data Protection and Freedom of Information)
Heilbronner Straße 35
70191 Stuttgart, Germany
Phone: +49 711 615541-0
Email: poststelle@lfdi.bwl.de
Contact the supervisory authority