This is a translation for convenience. The German version of this privacy policy is the binding one.
This privacy policy tells you which personal data is processed when you visit this website and when you get in touch. The website deliberately does without cookies, without recognising individual visitors and without embedded third-party services as far as that is technically possible.
1. Controller
Franz Korbjuhn
Brandstwiete 4
20457 Hamburg, Germany
Phone: +49 40 88192642
Email: [email protected]
A data protection officer is not required by law and none has been appointed. Please contact me directly with any questions about data protection.
2. Hosting
This website runs on a server operated by Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany. When the website is accessed, the server processes technically necessary data in log files: IP address, date and time of access, page requested, volume of data transferred, browser type and operating system, and the previously visited page (referrer). This data serves to keep the site running, to analyse faults and to defend against attacks. The log files are rotated daily and deleted automatically after seven days.
The legal basis is Art. 6(1)(f) GDPR (legitimate interest in secure and stable operation of the website). A data processing agreement pursuant to Art. 28 GDPR is in place with the provider.
3. Content delivery network and protection against attacks (Cloudflare)
The website is delivered through the network of Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107, USA. Cloudflare acts as an upstream proxy: all requests to the website pass through Cloudflare’s servers, which cache content, encrypt the connection and fend off attacks such as attempts to overload the site. In doing so, Cloudflare processes technically necessary connection data, in particular the IP address and the address requested.
The legal basis is Art. 6(1)(f) GDPR (legitimate interest in the security, availability and speed of the website). Cloudflare is certified under the EU-U.S. Data Privacy Framework; in addition, the European Commission’s standard contractual clauses are in place. Further information: https://www.cloudflare.com/privacypolicy/
4. Contact form, email and telephone
If you use the contact form, I process the data you enter (name, company, email address, message) solely in order to deal with your enquiry and any follow-up questions. The data is sent to me by email and is not stored on the web server. To protect against automated submissions, the form uses Cloudflare Turnstile (provider as in section 3). Turnstile uses technical characteristics of the browser to check whether a submission comes from a human, and processes the IP address and browser information for that purpose. No cookies are set for advertising or analytics purposes. The legal basis is Art. 6(1)(f) GDPR (legitimate interest in protecting the form against misuse).
The same applies to enquiries by email or telephone.
The legal basis is Art. 6(1)(b) GDPR where your enquiry relates to a contract or pre-contractual measures, and otherwise Art. 6(1)(f) GDPR (legitimate interest in answering enquiries). Enquiries that do not lead to a contractual relationship are deleted at the latest six months after they have been dealt with. If a contract is concluded, the statutory retention periods under the German Commercial Code and Fiscal Code apply.
Free Microsoft 365 check
If you request the free check, I transmit your details (salutation, name, company, address, email address and, optionally, an IT contact and a referral code) in encrypted form to my audit portal and process them to carry out the check. The legal basis is Art. 6(1)(b) GDPR. Data from your Microsoft 365 tenant is covered by the data processing agreement that forms part of the short engagement. I delete all data from the check no later than 30 days after the short report and confirm this to you in writing. I then keep your name, email address and company for contact purposes until you object (Art. 6(1)(f) GDPR), and the signed short engagement with its audit trail as proof of the engagement for the statutory retention periods.
Referral programme
If you enter a referral code with your request, I store this code and assign your request to the referring company, so that I can issue it a referral voucher if you commission the full audit. The referring company only learns that a voucher has been issued, not your name or company. The legal basis is Art. 6(1)(f) GDPR (legitimate interest in running the referral programme). I keep this assignment for as long as your contact details are stored with me or a voucher resulting from it is valid.
If you pass on a referral code yourself, I store the vouchers issued for your code with their amount, validity and redemption (Art. 6(1)(b) GDPR). I count how often a referral link is opened per code and day without any personal reference: neither your IP address is stored nor are cookies set; to avoid counting the same visit twice, only a non-reversible check value that changes daily is kept for 30 minutes (Art. 6(1)(f) GDPR). If you open the website via a referral link, the code is added to the internal links while you browse, so that it is still filled in on the request form; nothing is stored on your device for this, and the code is gone once you close the window. The terms (in German) are available at Empfehlungsprogramm.
5. Cookies and external content
This website sets no cookies for analytics or marketing purposes. The audience measurement described in section 6 also works without cookies. Fonts are loaded from my own server; no content from Google, social networks or other third parties is embedded. No information is stored on your device and no information stored there is accessed. Consent under sec. 25 TDDDG is therefore not required, and there is no cookie banner.
If you log in to the administration area of the website, WordPress sets technically necessary cookies for session management. This affects administrators only.
6. Audience measurement
To understand which content on this website is being read, I use the Burst Statistics software. It runs on the same server as the website; the data collected is stored there only and is not passed on to the vendor or to any other third party.
When a page is viewed, the following is recorded: the page requested, the time and duration of the visit, how far the page was scrolled and how long each quarter of the page was in view, the previously visited page (referrer), browser, operating system and device type, and the country. The country comes from a value that the content delivery network named in section 3 attaches to the request; no IP database is consulted and nothing more precise than the country is stored.
To group page views belonging to the same visit, a check value is calculated: an irreversible hash is derived from the IP address, the browser identification and a random value, and only that hash is stored. Your IP address itself is never written to the statistics. The random value is regenerated and overwritten every day, so the same visitor cannot be recognised on a later day and no history across several days can be built. No cookie is set, no device is recognised by its technical characteristics, and no profile is created. If your browser sends the “Do Not Track” setting, no measurement takes place at all.
The legal basis is Art. 6(1)(f) GDPR. My legitimate interest is in being able to judge the reach and the clarity of my content; the processing is limited to what is necessary for that and allows no conclusions about you as a person. The data collected is deleted automatically after 24 months. You may object to this processing under Art. 21 GDPR; an informal message to the address given in section 1 is enough.
7. Encryption
All data transmitted between your browser and this website is encrypted using HTTPS (TLS).
8. Your rights
You have the following rights in respect of the personal data concerning you:
- access to the data stored and how it is processed (Art. 15 GDPR),
- rectification of inaccurate data (Art. 16 GDPR),
- erasure, unless statutory retention obligations prevent it (Art. 17 GDPR),
- restriction of processing (Art. 18 GDPR),
- data portability (Art. 20 GDPR),
- objection to processing based on legitimate interests (Art. 21 GDPR).
You also have the right to lodge a complaint with a data protection supervisory authority. The authority responsible for me is the Hamburg Commissioner for Data Protection and Freedom of Information, Ludwig-Erhard-Str. 22, 20459 Hamburg, datenschutz-hamburg.de.
9. Changes
I update this privacy policy when the website or the legal requirements change. The version published here at the time applies.
Last updated: September 2026