Strategy and implementation, end to end
Processes that run themselves. Time you get back.
For startups and mid-sized companies from 20 to 200 employees: I turn recurring manual work into automated workflows – GDPR-compliant, documented, and without tying up your team.
Does any of this sound familiar?
Four symptoms I know from six years in IT operations.
The same manual work, week after week
Copying data from A to B, maintaining lists, chasing status updates – the tasks nobody enjoys and everybody has to do again next week.
Shadow IT and GDPR exposure
Your people are already using ChatGPT and friends – just privately, unmonitored, and quite possibly with company data.
Pressure to “do something with AI”
Investors and management expect efficiency gains – but nobody has the time to set the topic up properly and safely.
IT is somebody's side job
There is no dedicated IT function: founders, HR or DevOps handle on- and offboarding, tools and support on the side – every hire and every leaver means clicking through a dozen systems by hand. Nothing is left for automation.
No compromises
Four principles you can rely on in every project.
From manual work to processes that run themselves.
First the diagnosis. Then you decide: your team implements, or I do.
My services are aimed at startups, scale-ups and mid-sized companies from 20 to 200 employees.
Discovery & Consulting
An unvarnished diagnosis of your IT landscape – with a finished architecture roadmap.
Up to six interviews, an inventory at category level – not a full security audit.
- Clarity on which processes eat the most time day to day – established in conversation with your team leads
- An overview of what can be automated – and what should deliberately stay manual
- Quantified time savings per process – and which ones give you the biggest lever
- Which accounts and licences are still registered to people who left long ago – a by-product of the inventory, not a security audit
- A finished architecture roadmap with prioritised next steps, including a management presentation
The roadmap is yours, whether or not we carry on. And if the diagnosis finds no process whose automation pays off for you, you get half your money back.
AI & automation rollout
Building your GDPR-compliant automation infrastructure – secure, documented, ready to hand over.
Predictable as a fixed monthly retainer – month-to-month, cancel anytime.
- Automated workflows for onboarding and offboarding, customer support, financial reporting and content marketing
- The right platform for your case – n8n, Make, or directly inside the tools you already run
- Secure company-wide rollout of enterprise AI (e.g. Gemini, Copilot)
- Wired into your identity and device management (e.g. Okta, Jamf, SentinelOne) – rights are granted inside the process and withdrawn with it
- Covers the AI-literacy obligation under Art. 4 of the EU AI Act
- Handover, documentation and training included
The concrete scope comes out of the roadmap – you get the proposal at the end of the diagnosis.
Why not simply hire someone?
You can. The form rarely fits the job, though: the effort sits in the build. Once the systems are built, documented and handed over, what you need is upkeep – not a full-time role. Hiring permanently for that buys something ongoing that is needed once.
Then there is time: a role has to be advertised, filled and brought up to speed – and the problem runs on until it is. I need no recruiting process – and once the systems run, you cancel at the end of the month. Documentation and training are done by then, so your team carries on without me.
Separately, I offer software cost reduction – the hands-on trimming of your software stack, paid for out of the savings it produces.
Why Konrad Gondek?
The alternatives – and what works differently with me.
Typical agencies
- Build isolated workflows without looking at the architecture.
- Ignore data protection: personal data ends up in third-party AI tools.
- Leave maintenance and support with your internal team.
- Deliver without documentation – when it breaks, nobody understands it.
System integrators & MSPs
- Live on operating contracts – a solution you run yourself works against their model.
- Bill by ticket. An automated process stops generating them.
- Are built for operations, not process analysis.
- Tie you to their tooling and their access.
With Konrad Gondek
- The whole picture: I automate along the full architecture, not island solutions.
- Trusted with permissions: I owned access control, MFA and device management under SOC2 Type II audit – and I build to the same standards.
- Strategy and implementation, end to end: one contact from analysis to running workflow.
- Built to hand over: documented and taught – your team keeps it running without me.
- Capacity, not a project promise: four reserved days a month – month-to-month, cancel anytime.
Client references to follow
Having just gone independent as a consultant, what you find here instead of invented testimonials are the concrete results from six years at Doodle.
cut from annual licence costs, with no loss of functionality
replaced by six n8n workflows that used to be done by hand
SOC2 Type II passed first time – Okta, Jamf, MFA, offboarding
given access to enterprise AI: Gemini, Cursor, Copilot
FAQ
What does working together cost?
The first call is free and non-binding. After that you get transparent prices rather than open-ended day rates: the diagnosis costs €2,800 as a fixed price. The AI and automation rollout runs as a monthly retainer at €4,800 with 4 reserved working days – month-to-month, cancellable with 14 days' notice to the end of the month. All prices are plus VAT. The separately bookable software cost reduction has its own pricing model.
How does the collaboration work in practice?
In three phases. Phase 1 – diagnosis: I interview up to six department and function leads, inventory the software in use at category level and identify the processes eating your time. The result is a roadmap with prioritised measures. Duration: three days.
Phase 2 – implementation: we start with a pilot for one core process, typically one to two retainer months. Once that runs, we extend step by step to further processes and departments. Every pilot includes involving the affected department, training and documentation.
What you contribute: the necessary system access, the server infrastructure to run the automation environment, and participation in the interviews. The underlying security infrastructure and long-term administration stay with your internal IT – there I advise, but I do not take over.
How quickly do we see results?
A first workflow is typically running in production after a few weeks. The full path from analysis to rollout is designed for three to six months depending on company size – with every finished workflow saving time from day one.
Are you replacing our internal IT?
No – quite the opposite. I see myself as reinforcement for a period and work closely with your existing team. Every solution is documented and handed over so your IT can run it safely without me. The goal is to take load off your team, not to replace it. And if you have no dedicated IT at all – common at this size – I build structures your team can run safely without an IT hire.
Is all of this GDPR-compliant?
Yes, and concretely so: the automation runs on EU servers or directly on your own (n8n on your infrastructure, for instance). There is a data processing agreement with every provider involved, and each workflow carries only the fields it actually needs – not the whole record because that would be easier.
How is it handled on your side?
Where I access personal data during implementation projects, I am a processor under Article 28 GDPR. A data processing agreement is ready to sign, as is a record of processing activities and the documentation of my technical and organisational measures. I sign NDAs as a matter of course.
Anyone selling GDPR-compliant architectures should be able to show their own compliance – your procurement or legal team gets the documents on request up front, not only at contract signature.
Does the EU AI Act already apply to us?
Very likely yes. The AI literacy obligation under Article 4 has applied since February 2025 to every company using AI – regardless of size or sector. The transparency obligations under Article 50 have applied since August 2026.
I am not a lawyer and I do not replace legal advice. What I deliver: automation and AI rollouts that do not undercut these requirements – with documented data flows, clear access rules and staff training as a fixed part of the work.
Which tools do you work with?
Preferably n8n (self-hosted), alongside Zapier, Make and enterprise AI models. What matters is not the tool but the architecture behind it: I sell no licences, I am vendor-independent, and I only recommend what fits the IT landscape you already have.
Do you also do IT security?
Not as a separate product. I sell no security audits and no pen tests – there are specialists for that. Security sits in how things are built: at Doodle I owned access control, MFA, single sign-on, device management and offboarding, audited under SOC2 Type II. Automations that grant or revoke permissions are built to the same standards.
If something surfaces during the diagnosis – live accounts belonging to former staff, unpatched devices, missing encryption – it goes into the report. As an observation, not as a security audit.
What happens when the project ends?
You get full documentation, training for your team and, if you want it, a lightweight support agreement for updates and further development. My standard: you are independent after the project – not permanently dependent on me.
Konrad Gondek
IT Automation Consultant & Implementer
I have worked in IT since 2012 – first as a working student in IT operations, Android development and voice app projects on AWS, alongside studying business informatics and media informatics at HTW Berlin.
Then six years at Doodle: from IT operations engineer to senior engineer to team lead, the last three years with line management responsibility. There I negotiated CHF 80,000 off annual licence costs, established n8n together with DevOps as a company-wide automation backbone, ran the AI rollout (Gemini, Copilot and a support bot I built myself).
The other half of the job was security: access control and MFA through Okta, single sign-on and passwordless authentication, zero-touch deployment through Okta and Jamf, asset inventory, offboarding processes, backup routines, full-disk encryption and update management – audited as part of the SOC2 Type II certification.
That is why I do not treat automation and security as two disciplines. An automated offboarding process is both in the same motion. The split exists in the vocabulary, not in the work.
Today I work at exactly the intersection of commercial efficiency (CFO) and technical security (CTO).
2019–2026 · from engineer to IT operations team lead