Privacy Policy

This is a translation for convenience. The German version is legally authoritative.

This privacy policy describes only the processing activities actually carried out on this website – not planned or precautionarily listed services.

Controller

The controller within the meaning of the GDPR is:

Witnity – Dr. Samuel Reeb Wilsdruffer Straße 22 01067 Dresden, Germany Email: kontakt@witnity.de

“Witnity” is the brand name under which Dr. Samuel Reeb operates as a sole proprietor – not a separate legal entity.

Hosting and server log files

This website runs on a virtual server that the controller manages themselves and that is hosted by IONOS SE, Elgendorfer Straße 57, 56410 Montabaur, Germany, in a data centre in Germany. IONOS acts as a processor for the server infrastructure (Art. 28 GDPR).

When you visit this website, the web server automatically collects technically necessary information (server log files), such as IP address, date and time of the request, page requested, HTTP status code, amount of data transferred, browser type and referrer URL. This data is required for the technical delivery of the website and to defend against attacks, and is not combined with other data sources. The legal basis is Art. 6(1)(f) GDPR (legitimate interest in secure, functional operation of the website). Log files are deleted by automatic rotation after no more than 14 days.

Encryption

This website is delivered encrypted via TLS/HTTPS to protect the transmission of your data against unauthorised third-party access. The certificate used for this is issued via Let’s Encrypt (Internet Security Research Group); no visitor data is transmitted in the process.

Fonts

For display, the typeface Inter is delivered locally by this website. No connection is made to external font providers, in particular not to Google Fonts – no data is transmitted to third parties as a result.

Contact form

If you contact me via the contact form, the data you provide (name, company, email address, phone number, message, and the technical entry context of the contact request) is stored to process your enquiry and for any follow-up questions. The legal basis is Art. 6(1)(b) GDPR (pre-contractual measures) or Art. 6(1)(f) GDPR (responding to enquiries).

Transmission takes place technically via a server-side endpoint on the server named above. This endpoint validates your input, applies a technical abuse limit (a spam field invisible to you and a limit on request frequency per IP address) and passes the validated details for delivery to the transactional email service Brevo (Sendinblue GmbH, Cologne, Germany). Brevo acts as a processor within the meaning of Art. 28 GDPR; a corresponding data processing agreement is in place. According to its own statements, Brevo processes the data passed to it for delivery within the European Union and retains it only for the period required for delivery and technical traceability. Your details are used exclusively to process your enquiry and are not shared with any further third parties beyond this.

The technical entry context is a purely technical metadata value from a closed, predefined list (e.g. “services overview”, “check”) and contains no analytics ID, no browsing profile, and no inference about you beyond what you provide yourself.

Email contact

If you contact me by email, the details you provide (email address, and any further data contained in the message) are stored to process your enquiry. The legal basis is Art. 6(1)(b) or (f) GDPR, following the same principles as the “Contact form” section.

Business communication and retention

Incoming business communication (e.g. contact enquiries, emails) is currently stored locally on an encrypted storage medium. No external cloud storage is used. If a mandate is later initiated or carried out, the applicable German tax and commercial retention periods (Section 147 of the German Fiscal Code, Section 257 of the German Commercial Code) additionally apply to records subject to a retention obligation.

Cookies and similar technologies

This website uses only technically necessary storage (your consent decision, see “Consent management”) and, optionally and only with your consent, storage by Google Analytics 4 (see “Web analytics”). No marketing or tracking cookies are used.

For your consent to the optional analytics category, a dedicated, technically independent solution is used – no third-party consent tool. On your first visit, a notice appears with the equally prominent options “Accept all”, “Decline” and “Settings”. Via “Settings” you can specifically enable or disable the “Analytics” category; the “Technically necessary” category (storage of your consent decision itself) cannot be turned off.

Your decision, the time of the decision, and the version of the underlying consent text are stored exclusively in your browser (local storage), not on our servers. Your consent is valid for six months; after that you will be asked again. If the consent text or the underlying processing changes materially, you will be asked again regardless of this period.

You can change or withdraw your choice at any time via “Cookie settings” in the website footer; withdrawal is just as easy as giving consent and applies going forward.

Web analytics (Google Analytics 4)

Subject to your consent, this website uses Google Analytics 4, a web analytics service provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Google Analytics is only loaded and activated after your explicit consent; without your consent, no corresponding script is loaded into the browser. The legal basis is Art. 6(1)(a) GDPR.

Google Consent Mode is additionally used: before your decision, data collection is disabled by default (“denied”), and only enabled (“granted”) after consent has been given.

Data collected includes page views, a broad device category, and – only upon a successfully completed contact form submission – a technical event (“generate_lead”) with the technical entry context already mentioned as a category value. Form content (name, email address, phone number, company, message) is never transmitted to Google Analytics. Automatic collection of form interactions and Google Analytics’ automatic scroll event are disabled; instead, four fixed scroll-depth thresholds (25/50/75/90%) are recorded once per page view, without continuous recording of your scroll position.

According to Google, IP addresses are not logged or stored in Google Analytics 4; an approximate location is derived before the IP address is discarded. No User-ID feature is used. In the Google Analytics admin area, Google Signals and ad personalization are disabled, there is no link to Google Ads, and the retention period for user- and event-level data (for exploration/funnel reports; standard reports are not affected) is set to 14 months – a deliberate benefit/privacy trade-off, not a legal requirement.

Use of Google Analytics 4 is based on a data processing arrangement pursuant to Art. 28 GDPR (Google Ads Data Processing Terms, which also cover Google Analytics); these terms are confirmed in the Google Analytics admin area. A transfer of data to the USA cannot be ruled out as part of this processing; according to Google, it takes place on the basis of the EU-US Data Privacy Framework, additionally safeguarded by Standard Contractual Clauses.

IONOS WebAnalytics

This website runs on a self-managed virtual server, not on an IONOS web hosting plan. The “IONOS WebAnalytics” add-on tool available there is not used here; no processing by this tool takes place.

Other external services

Beyond the services named in this policy, no further external services (e.g. video embeds, map services, social media plugins) are used.

Spam protection

The contact form includes a technical anti-spam measure (a field that is invisible to you) that does not rely on additional third parties and does not allow any conclusions about your identity. No visible CAPTCHA is used.

Booking a conversation

Online booking for the initial conversation is not currently active. No data is therefore currently transmitted to a booking tool. Once online booking is activated, this section will be updated to describe the data then processed, the provider used, and the applicable legal basis.

Recipients and international transfers

Depending on the feature of this website you use, the following recipients may receive your data:

  • IONOS SE as operator of the server infrastructure (server log files),
  • the email provider of the kontakt@witnity.de mailbox,
  • when using the contact form: Brevo as the transactional email service (see “Contact form”),
  • with your consent: Google Ireland Limited (Google Analytics 4, see “Web analytics”).

A transfer to third countries (in particular the USA) may occur as part of the processing by Google (web analytics) and – according to its own processing documentation – by Brevo (contact form). In both cases, recognised transfer mechanisms are used according to the providers (in particular Standard Contractual Clauses, and for Google additionally the EU-US Data Privacy Framework).

Retention periods

  • Server log files: automatic deletion after no more than 14 days.
  • Contact enquiries without a mandate: as long as necessary to process the enquiry and for follow-up questions, then deleted.
  • Records under an actual mandate: in accordance with statutory retention periods (Section 147 AO, Section 257 HGB), where applicable.
  • Consent decision: six months, after which consent is requested again (see “Consent management”).
  • Google Analytics data: 14 months for user- and event-level data (see “Web analytics”).

Your rights

You have the right to access the data stored about you, to rectification, erasure, restriction of processing, and data portability, as well as the right to object to processing and to withdraw a given consent at any time with effect for the future. Please contact the email address given above informally.

Supervisory authority

You also have the right to lodge a complaint with a data protection supervisory authority. The competent authority is the Saxon Data Protection and Transparency Commissioner (datenschutz.sachsen.de).

Changes to this policy

This privacy policy will be updated as the tools used or the legal situation change, in particular once online booking is activated or the analytics or email delivery provider changes.