← Back to the home page

Privacy Policy

This is a translation for your convenience. The German version is legally binding. German original: Datenschutzerklärung.

With this statement I inform you, in accordance with Articles 13 and 14 of the General Data Protection Regulation (GDPR), which personal data I process when you visit this website, when you send an inquiry and when we work together, for what purposes, on what legal basis and for how long. The German Federal Data Protection Act (BDSG) and the German Telecommunications Digital Services Data Protection Act (TDDDG) apply in addition.

Contents

1. Controller

The controller within the meaning of the GDPR is:

Marcel Gautsche
Rotweg 43
70437 Stuttgart
Germany
Email: info@marcelgautsche.de

No data protection officer has been appointed. For all questions about data protection, you can reach me at the postal address or email address above.

2. Hosting and access data (Netlify)

This website is hosted by Netlify, Inc. (San Francisco, California, USA). When you open a page, your browser automatically sends information to Netlify's servers. In particular, the following is processed:

  • IP address of the requesting device
  • date and time of access
  • name and URL of the file retrieved
  • the website from which the access is made (referrer URL), if your browser transmits it
  • the browser used and, where applicable, the operating system

These data are technically necessary to deliver the website and to ensure its security and stability, for example to fend off attacks. The legal basis is Art. 6(1)(f) GDPR; my legitimate interest lies in the secure and functional operation of the website. I do not combine these data with other data sources and do not create user profiles.

From these access data, Netlify compiles aggregated reach statistics for me (Netlify Web Analytics), such as the number of page views, the most visited pages, referring websites and approximate countries of origin. No code is executed in your browser for this purpose, no cookies are set and no information is read from your device. I only see aggregated figures, no individual visits and no IP addresses. The legal basis is Art. 6(1)(f) GDPR; my legitimate interest lies in recognizing which content is used and through which channels the website is found. You can object to this processing under Art. 21 GDPR (section 13).

Netlify acts as my processor. Netlify's data processing agreement (Data Processing Agreement) forms part of Netlify's terms of use. Under this agreement (version of June 9, 2026, Exhibit II), log data of Netlify's systems are retained online for 90 days and offline for one year.

Netlify also processes data in the USA and uses its own sub-processors, predominantly based in the USA. The transfer is based on the European Commission's adequacy decision on the EU-U.S. Data Privacy Framework (Art. 45 GDPR), under which Netlify, Inc. is certified; should this framework cease to apply, the agreement provides for EU Standard Contractual Clauses as a fallback (Art. 46(2)(c) GDPR). Further information: Netlify privacy policy, Netlify Trust Center (sub-processors).

3. Contact form

If you use the contact form, I process your details in order to handle and answer your inquiry. Mandatory fields are name, email address, topic and message. Optional are your phone number, how you became aware of me and, where applicable, the search term through which you found me. Confirming that you have read this privacy policy is not consent; the processing is based on the following legal bases.

The English contact form (form name “kontakt-en”) transmits the same fields, plus the hidden field “sprache” (language), which records that the inquiry was sent via the English pages.

The legal basis is Art. 6(1)(b) GDPR insofar as your inquiry is aimed at a contract or its initiation, and otherwise Art. 6(1)(f) GDPR (my legitimate interest in answering inquiries). I use the optional information on how you found me only in aggregated form, to recognize through which channels I am found (Art. 6(1)(f) GDPR). For this purpose, I transfer topic and source, without names, into a tally sheet and then delete the submission as described.

The form is technically provided via Netlify Forms. Your details are transmitted to Netlify's servers, stored there and made available to me for processing, in the Netlify account or as an email notification; for emails, section 4 applies in addition. For Netlify, the information in section 2 applies (processing on my behalf, transfer to the USA). I delete the submissions in the Netlify account as soon as the inquiry has been completed; for the email notification, sections 4 and 11 apply. If an engagement results, section 5 applies.

To protect against spam, the form contains a hidden field (“honeypot”). In addition, Netlify automatically checks incoming submissions for spam and, according to its own information, uses the Akismet service of Automattic, Inc. (USA) as a sub-processor for this purpose. In the process, the form data and technical connection data may be transmitted to Automattic. Automattic is a sub-processor of Netlify; Netlify must impose data protection obligations on it that are at least equivalent (Netlify DPA, section 6.1). For the transfer to the USA, the information in section 2 applies. The legal basis is Art. 6(1)(f) GDPR; my legitimate interest is protection against abusive and automated submissions. I do not create profiles.

4. Contact by email (IONOS and forwarding to Google)

My email mailbox is hosted by IONOS SE (Montabaur, Germany). When you write to me, your message, your email address and the other information in the email are received and stored there. IONOS processes the data on my behalf; the data processing agreement (Art. 28 GDPR) forms part of IONOS's contract terms. Under it, processing takes place in the EU or the European Economic Area, unless a transfer to a third country is required for the service; in that case, IONOS ensures that the requirements of Art. 44 et seq. GDPR are met.

Forwarding to Google: Emails to info@marcelgautsche.de and to other addresses of this domain are additionally forwarded automatically to an email account with Google (Gmail), through which I read and answer messages. I send my replies via the IONOS mail server; a copy is stored in the Google account. The provider of the account is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Google also processes the messages under its own terms as an independent controller, among other things to protect against spam and malware; there is no data processing agreement with Google for this account. Details can be found in Google's privacy policy. A transfer to the USA by Google is possible; Google LLC is certified under the EU-U.S. Data Privacy Framework (adequacy decision, Art. 45 GDPR).

The legal basis for processing emails is Art. 6(1)(b) GDPR insofar as a contract or its initiation is concerned, and otherwise Art. 6(1)(f) GDPR. My legitimate interest lies in answering inquiries and in handling my business correspondence centrally and also while on the road. If you do not want your message to be processed via Google, please write to me by post at the address above. You can object to the processing under Art. 21 GDPR (section 13).

Please note: An ordinary email is not end-to-end encrypted. Please therefore send particularly confidential documents only after prior agreement and via a suitable channel.

5. Prospective clients, clients and participants

For intro calls, quotes, carrying out engagements (consulting, development, training, workshops, coaching), invoicing and bookkeeping, I process in particular: name, address, where applicable company and position, contact details, contents of quotes, contracts and correspondence, appointments, invoice and payment data (for example bank details for transfers) and, for training sessions, the names of participants and, where necessary, their email addresses for invitations, materials and confirmations of attendance.

  • Initiation and performance of contracts: Art. 6(1)(b) GDPR
  • Statutory retention and documentation obligations, in particular under the German Fiscal Code (Abgabenordnung, AO) and the German VAT Act (Umsatzsteuergesetz, UStG): Art. 6(1)(c) GDPR
  • Establishment, exercise or defense of legal claims: Art. 6(1)(f) GDPR
  • Participants whom a company registers for a training session: I receive the data from the registering company. I process them in order to organize and run the training session (Art. 6(1)(f) GDPR; legitimate interest in performing the contract with the company).

Where necessary, I transmit these data to tax authorities and to advisors bound by professional secrecy, for example in tax advisory, and to credit institutions for processing payments. For online meetings and online training sessions, a video conferencing service is used, often the client's. Which service is used is stated in the respective invitation; the privacy notices of the provider or of the inviting company apply in addition.

If, with your agreement, I involve partners from my network in a project, they receive the contact and project data necessary for their task (Art. 6(1)(b) GDPR). If they process data on my behalf, I conclude an agreement with them under Art. 28 GDPR beforehand.

If you engage me as a private individual for personal or household purposes and I process personal data in the course of this, for example in your systems or documents, I am the controller for this processing myself. The legal basis is Art. 6(1)(b) GDPR, and for data of other persons Art. 6(1)(f) GDPR (my legitimate interest in carrying out the engagement). I process these data only for the engagement.

6. Processing on behalf of business clients

If, as part of an engagement, I process personal data on behalf of a company, for example in AI automations involving customer data, when operating such workflows or during support and remote maintenance, the company is the controller and I am the processor. For this, we conclude a data processing agreement under Art. 28 GDPR in advance; you can find the template under data processing agreement (AVV, German). For these data, the privacy notices of the respective company apply. Data subjects should please address their requests to the company; requests that reach me are forwarded to the company.

7. Protected partner area

Accounts: For clients and partners for whom I set up access to the /partner/ area, I store name, username, a verification value of the password (no plain text) and the date of setup and of the last login. This serves exclusively to manage and secure the accounts (Art. 6(1)(b) GDPR). The data are stored in Netlify's “Blobs” data store; for Netlify, the information in section 2 applies. I delete them as soon as the access ends. The figures shown in the area do not contain any personal data of visitors.

Technology: For login, checking the accounts and providing the figures, I use Netlify functions (Edge Functions, Functions and Blobs). As with every page view, technical connection data are processed in the process. The cookies of this area are described in section 8.

8. Storage in the browser, cookies

This website does not set any tracking or advertising cookies. In your browser's storage (local storage), it only stores entries for functions that you use yourself: the acknowledgment of the privacy notice, your reading list of Insights and best scores of the interactive calculators and games. These entries remain in your browser, are not transmitted to me or to third parties and can be deleted at any time via the browser settings.

Cookies are only set in the protected partner area. Anyone who logs in there with username and password receives the technically necessary cookie “mg_partner”. It contains the username, an expiry time and a signature and is valid for 30 days or until logout. For my management of the accounts, the technically necessary cookie “mg_partner_admin” is additionally set in the /partner/verwaltung area; it is valid until logout, for a maximum of eight hours; visitors do not receive it.

The legal basis for storing and accessing this information on your device is § 25(2) no. 2 TDDDG, because it is strictly necessary to provide the functions you have expressly requested. The associated processing of personal data is based on Art. 6(1)(b) GDPR (partner access) or Art. 6(1)(f) GDPR (convenience functions of the website).

9. Fonts, no tracking or advertising services, external links

The fonts Fraunces, Inter and JetBrains Mono are loaded entirely from this web server. No connection to Google or other third parties is established in the process. The website does not include any analytics, tracking or advertising services from third parties, does not use any scripts or cookies for such purposes and does not embed any social media plugins, videos or maps from third parties. The server-side reach statistics are described in section 2.

This website contains links to websites of other providers, for example to sources in articles. Only when you click such a link do you leave this website; the linked pages are subject to the privacy policies of the respective provider.

10. Recipients and transfers to third countries

Personal data are received by the following, in each case only to the extent described:

  • Netlify, Inc., USA: hosting, contact form, partner area; processor; transfer based on the EU-U.S. Data Privacy Framework, alternatively EU Standard Contractual Clauses (section 2)
  • Automattic, Inc. (Akismet), USA: spam check of the contact form as a sub-processor of Netlify; transfer under the Netlify DPA (sections 2 and 3)
  • IONOS SE, Germany: email mailbox; processor; processing generally in the EU or the EEA (section 4)
  • Google Ireland Limited, Ireland: forwarded emails; independent controller; possible transfer to the USA, Google LLC certified under the EU-U.S. Data Privacy Framework (section 4)
  • where necessary: tax authorities, advisors bound by professional secrecy and credit institutions (section 5)
  • partners from my network, if I involve them in a project with your agreement (section 5)

Beyond this, I only pass on personal data if I am legally obliged to do so or if you have consented. I do not sell data and do not pass them on for advertising purposes.

11. Retention period

I store personal data only for as long as this is necessary for the respective purpose or as statutory retention obligations exist. In detail:

  • Inquiries without a subsequent engagement: deletion as soon as the inquiry has been dealt with, unless the correspondence must be retained as a business letter.
  • Invoices and accounting records: 8 years (§ 14b(1) UStG, § 147(3) AO).
  • Books, records and financial statements: 10 years (§ 147(3) AO).
  • Business letters received and sent and other tax-relevant documents: 6 years (§ 147(3) AO).
  • Other contract data: until the limitation periods for claims under the contract have expired, as a rule three years from the end of the year in which the claim arose (§§ 195, 199 of the German Civil Code, BGB).
  • Reach statistics: aggregated figures only, available in the Netlify account for seven days; for the underlying log data, section 2 applies.
  • Partner accounts: until the end of the access; cookies and entries in the browser as described in section 8.

The retention periods begin at the end of the calendar year in which the document was created. They are extended insofar and for as long as the documents are relevant for taxes for which the assessment period has not yet expired (§ 147(3) sentence 5 AO). During retention, I restrict processing to this purpose.

12. Obligation to provide data, no automated decision-making

You are under no statutory or contractual obligation to provide me with personal data. Without the mandatory information in the contact form (name, email address, topic, message), however, I cannot process your inquiry. To conclude and perform a contract, I need the information required for this, for example for the quote and the invoice; without it, I cannot conclude the contract.

Automated decision-making, including profiling within the meaning of Art. 22 GDPR, does not take place. The automated spam check of the contact form serves only to filter out abusive submissions.

13. Your rights

Under the GDPR, you have the following rights with regard to the personal data concerning you:

  • Access (Art. 15 GDPR)
  • Rectification (Art. 16 GDPR)
  • Erasure (Art. 17 GDPR)
  • Restriction of processing (Art. 18 GDPR)
  • Data portability (Art. 20 GDPR)
  • Objection to processing (Art. 21 GDPR)
  • Withdrawal of consent with effect for the future (Art. 7(3) GDPR), insofar as I base processing on your consent; the lawfulness of the processing carried out until then remains unaffected. I currently do not obtain any consent on this website.

Right to object under Art. 21 GDPR: Insofar as I process your data on the basis of legitimate interests (Art. 6(1)(f) GDPR), you may object to this processing at any time on grounds relating to your particular situation. I will then no longer process the data, unless I can demonstrate compelling legitimate grounds that override your interests, rights and freedoms, or the processing serves the establishment, exercise or defense of legal claims. An informal message to info@marcelgautsche.de or by post is sufficient.

Right to lodge a complaint: You can lodge a complaint with a data protection supervisory authority (Art. 77 GDPR), in particular in the Member State of your habitual residence, your place of work or the place of the alleged infringement. The authority responsible for me is:

Der Landesbeauftragte für den Datenschutz und die Informationsfreiheit Baden-Württemberg (State Commissioner for Data Protection and Freedom of Information of Baden-Württemberg)
Heilbronner Straße 35, 70191 Stuttgart
Postal address: Postfach 10 29 32, 70025 Stuttgart
Online complaint to the LfDI Baden-Württemberg

14. Data security

This website is delivered exclusively in encrypted form via HTTPS (TLS). I store passwords for the partner area only as a verification value, not in plain text. In addition, I take technical and organizational measures to protect your data against loss, manipulation and unauthorized access, and adapt them as needed.

15. Changes and status

I adapt this privacy policy when the legal situation, the services used or my processes change. The version currently published here applies. As of: October 24, 2026.

Last updated: November 2026 (English translation of the German version dated October 24, 2026).