Privacy Policy

Introduction

IdEinstein is a solo engineering practice (Einzelunternehmen) based in Germany. This Privacy Policy explains what personal data we collect through this website, why we collect it, who processes it on our behalf, and the rights you have under the EU General Data Protection Regulation (GDPR/DSGVO). We operate no customer database and no user accounts — the personal data we handle is limited to what you actively send us via the contact form or the newsletter sign-up, plus consent-gated analytics.

Effective Date: December 28, 2024
Last Updated: July 27, 2026
Review Schedule: Reviewed periodically and whenever our data-processing practices change

1. Data Controller & Contact

As a solo practice based in Germany, IdEinstein is the controller for the personal data processed through this website within the meaning of Art. 4(7) GDPR. We have not appointed a Data Protection Officer, as we are not legally required to do so at our scale; privacy enquiries are handled directly by the practice owner using the contact details below.

2. Personal Data We Collect

2.1 Information You Provide Directly

• Contact form: Name, email address, and — if you choose to provide them — phone number, company name, and the service you are interested in, plus the content of your message.
• Newsletter sign-up: Email address and, optionally, your name.

2.2 Information Collected Automatically

• Server logs: Standard web-server request data (including IP address, browser type, and timestamp) is processed by our hosting provider under its own retention policy to deliver and secure the site.
• Essential cookies: Session and preference cookies needed for the site to function and to remember your consent choice.
• Analytics (consent-gated): Website usage, page views, and interaction metrics via Google Analytics 4 — collected only after you grant consent. IP addresses are processed in Google Analytics with IP anonymisation.
• Marketing (consent-gated): Campaign and engagement metrics — collected only with your explicit consent.

2.3 Special Categories of Data

We do not intentionally collect special categories of personal data (e.g. health information, political opinions, or biometric data). If such data is inadvertently provided, we will delete it promptly upon discovery.

3. Legal Basis for Processing (GDPR Art. 6)

We process your personal data on the following legal grounds:

• Consent (Art. 6(1)(a)): Newsletter subscription, non-essential cookies, and analytics/marketing tracking.
• Pre-contractual / contract steps (Art. 6(1)(b)): Responding to contact-form enquiries and consultation requests you initiate.
• Legitimate interests (Art. 6(1)(f)): Operating and securing the website, and preventing abuse of the contact and newsletter forms.
• Legal obligations (Art. 6(1)(c)): Retaining business correspondence where tax or commercial law requires it.

4. How We Use Your Personal Data

4.1 Responding to Enquiries

• Reply to your contact-form message
• Discuss and scope potential engineering work
• Send you the information you requested

4.2 Operating the Website

• Deliver and secure the website
• Understand aggregate usage (only with analytics consent)
• Prevent spam and abuse of our forms
• Comply with legal and record-keeping obligations

4.3 Newsletter (With Consent)

• Send occasional updates about our services and relevant technical content
• You can unsubscribe at any time via the link in every email

5. Your Privacy Rights

5.1 GDPR Rights (EU Residents)

• Right of Access (Art. 15): Request a copy of the personal data we hold about you
• Right to Rectification (Art. 16): Correct inaccurate or incomplete data
• Right to Erasure (Art. 17): Request deletion of your data ("right to be forgotten")
• Right to Restrict Processing (Art. 18): Limit how we process your data
• Right to Data Portability (Art. 20): Receive your data in a structured, machine-readable format
• Right to Object (Art. 21): Object to processing based on legitimate interests or for marketing
• Right to Withdraw Consent (Art. 7(3)): Withdraw consent at any time, without affecting prior lawful processing
• Right to Lodge a Complaint (Art. 77): Complain to a supervisory authority — for us, Der Hessische Beauftragte für Datenschutz und Informationsfreiheit

5.2 How to Exercise Your Rights

Because we operate no self-service account system, we fulfil requests manually: on request, we locate and export or delete your data from our email inbox and mailing-list system. Contact us using the details below.

6. Data Security Measures

We use technical and organisational measures appropriate to a solo practice with a small data footprint:

6.1 Technical Measures

• Encryption in transit: The whole site is served over HTTPS with HSTS; all form submissions travel over TLS/SSL.
• No persistent database: We run no application database. Contact-form submissions are delivered to us by email and are not stored in a customer datastore.
• Secure email delivery: Contact messages are sent over an SSL-encrypted SMTP connection (port 465) to our email provider (IONOS, Germany).
• Processor-side storage: Newsletter data is stored and secured by our email-marketing processor (Mailchimp) under its own security controls.
• Security headers & patching: The site sends a strict Content-Security-Policy, HSTS, and related security headers, and dependencies are kept up to date.

6.2 Organisational Measures

• Privacy by design & default: Data protection is considered when building each feature; only essential data is collected.
• Data minimisation: No accounts, no payment processing, and no tracking without consent.
• Access limitation: Enquiry emails are accessible only to the practice owner via a password-protected mailbox.
• Vetted processors: Third parties that process data on our behalf are bound by data-processing agreements (Art. 28 GDPR).
• Breach response: In the event of a personal-data breach, we will notify the competent supervisory authority and affected individuals as required by Art. 33/34 GDPR.

7. Third-Party Processors & Recipients

We use the following processors to operate this website. Each processes personal data only on our instructions under a data-processing agreement (Art. 28 GDPR):

• Hosting — Vercel Inc. (USA): Hosts and delivers the website; processes server request data including IP addresses.
• Email delivery — IONOS SE (Germany): Delivers contact-form messages to our mailbox via SMTP. Data stays within the EU.
• Newsletter — Intuit Mailchimp (USA): Stores newsletter subscriber name and email and sends the double opt-in confirmation and campaigns.
• Analytics — Google Ireland Ltd / Google LLC (USA): Provides Google Analytics 4 and Google Tag Manager. Loaded only with your consent (Consent Mode default: denied).
• Appointment booking, quote forms & file uploads — Microsoft Ireland Operations Ltd (Microsoft 365): Provides the embedded booking calendar (Microsoft Bookings) and quote questionnaire (Microsoft Forms) on our booking and quote pages, and the secure file-upload facility (OneDrive file request) for project documents. When you book an appointment, submit the questionnaire or upload files, the data you provide (such as name, email, appointment details and uploaded documents) is processed by Microsoft on our behalf. Microsoft stores our organisation's Microsoft 365 data within the EU Data Boundary.

8. International Data Transfers

Some of our processors (Vercel, Mailchimp, Google, Microsoft) are established in or transfer data to the United States. Where personal data is transferred outside the EU/EEA, the transfer is safeguarded under the EU–U.S. Data Privacy Framework (to which these providers self-certify) and/or the European Commission's Standard Contractual Clauses, in accordance with Art. 44–49 GDPR. Data handled by IONOS (email delivery) remains within the EU, and Microsoft 365 customer data is stored within Microsoft's EU Data Boundary.

9. Data Retention

Contact-form emails are kept only as long as needed to handle your enquiry and to meet any legal retention obligations, then deleted. Newsletter data is kept until you unsubscribe or ask us to delete it. Consent records and server logs are retained per our processors' standard retention periods.

10. Contact