Privacy policy

This is a courtesy translation. Only the German version is legally binding.

1. Controller

The controller within the meaning of the General Data Protection Regulation (GDPR) is:

Konrad Gondek (sole proprietor)
IT Automation Consultant & Implementer
Eckertstr. 2a
10249 Berlin
Email: kontakt@konradgondek.de

2. General information on data processing

Protecting your personal data matters to me. I process personal data exclusively within the limits of the applicable law (GDPR, BDSG, TDDDG). This policy explains what data is collected when you visit this website and how I use it.

3. Hosting and processors

This website runs on the Cloudflare Workers platform. The provider is Cloudflare, Inc., 101 Townsend St, San Francisco, CA 94107, USA, represented in the European Union by Cloudflare Germany GmbH, Rosental 7, 80331 Munich. A data processing agreement under Article 28 GDPR is in place with Cloudflare. Delivery runs over Cloudflare's global server network; for visitors from Europe, generally via locations within the EU. Where personal data is transferred to the USA in the process, this takes place on the basis of the EU standard contractual clauses; Cloudflare is additionally certified under the EU-US Data Privacy Framework.

When you access the website, the host automatically collects information in what are known as server log files, which your browser transmits automatically:

Browser type and version
Operating system used
Referrer URL
Host name of the accessing device
Time of the server request
IP address (shortened or pseudonymised where possible)

This data is not merged with other data sources. Processing takes place on the basis of Article 6 (1) (f) GDPR (legitimate interest in the technically correct presentation and security of the website). Log files are deleted after 14 days at the latest, unless security-relevant incidents require longer retention.

For my business email I use Google Workspace. The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. A data processing agreement under Article 28 GDPR is in place with Google (Cloud Data Processing Addendum). Any message you send me, and any message I send you in response to an enquiry, is processed and stored there. Where personal data is transferred to Google LLC in the USA, this takes place on the basis of the EU standard contractual clauses; Google is also certified under the EU-US Data Privacy Framework.

4. Contact form and contact by email

If you send me an enquiry via the contact form (“Free 30min call”), I process the data you provide:

Name (required)
Email address (required)
Phone number (optional)

Processing takes place in order to handle your enquiry and to carry out pre-contractual measures (Article 6 (1) (b) GDPR) or on the basis of my legitimate interest in responding to enquiries (Article 6 (1) (f) GDPR). Beyond the processors named in section 3, your data is not passed on. It is deleted as soon as it is no longer required to handle your enquiry and no statutory retention obligations apply.

Your enquiry is stored in a database at Cloudflare (see section 3) and additionally sent to my mailbox hosted at Google Workspace (also section 3). Technically recorded alongside it are the user agent transmitted by your browser and the time of the enquiry; both serve to prevent automated spam. For the same purpose, the number of requests per IP address is counted for one hour, without the IP address being stored permanently.

Your enquiry is also recorded together with the channel you arrived through: the domain of the referring site (for example linkedin.com) or any campaign parameters in the address you opened. If you entered the address directly, or navigated within this site before submitting, only direkt or intern is recorded. The legal basis is my legitimate interest in understanding which channels lead to enquiries (Art. 6(1)(f) GDPR). The value is transmitted only when you submit your enquiry and is not passed on to any third party.

So that this channel survives navigation between pages, the first value detected is stored in your browser's session storage. It is a single text value with no timestamp, no identifier and no profiling; no cookie is set. Your browser deletes session storage automatically as soon as you close the tab — no recognition across separate visits takes place. The value leaves your browser only together with an enquiry you submit yourself. You can prevent this storage by blocking session storage for this site in your browser; the site remains fully usable either way.

5. Appointment booking

For arranging the free introductory call I link to a booking page provided by Google Calendar (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland). That page is only loaded once you actively click the link; no data is transmitted to Google from this website itself.

On the booking page, Google processes the data you enter there (typically name, email address and the slot chosen) as well as technical connection data. Google's own privacy policy applies to that processing (policies.google.com/privacy). I process the appointment data transmitted to me in order to hold the call, on the basis of Article 6 (1) (b) GDPR. If you would rather not use this service, you can equally reach me through the contact form or by email.

6. AI & automation check

The “AI & automation check” offered on this website consists of two parts:

The two key figures (person-days tied up and unused software budget) are calculated exclusively in your browser. That calculation does not leave your device.
For the individual roadmap, your answers – including any free text you enter – are transmitted to my server and from there, via the intermediary service OpenRouter (OpenRouter, Inc., Delaware, USA), to the AI model Gemini 3.8 Flash provided by Google (Google LLC, Mountain View, USA), which generates the evaluation. OpenRouter forwards the request technically without evaluating the content itself.

The legal basis for this transfer is your consent, given by submitting the check (Article 6 (1) (a) GDPR), together with my legitimate interest in producing a meaningful evaluation (Article 6 (1) (f) GDPR). A data processing agreement is in place with OpenRouter; Google acts as a sub-processor. Transfer to the USA takes place on the basis of the EU standard contractual clauses. Requests are routed exclusively to providers who are contractually bound neither to store the transmitted content nor to use it for training AI models.

Neither OpenRouter nor Google stores your answers; both are contractually bound not to. Even so, please do not enter personal data about third parties or trade secrets in the free text fields.

On my side, your answers and the evaluation produced from them are stored, together with the time of the run. The purpose is to develop the check and my services further: I want to see which processes cost time repeatedly, and at which company size. The legal basis is Article 6 (1) (f) GDPR; my legitimate interest lies in that analysis.

Expressly not stored are your IP address, your browser identifier (user agent) and any form of session or recognition identifier. The stored runs cannot be linked to one another or to your person as long as you do not provide an email address. Storage takes place in a database at Cloudflare in the Eastern Europe region, i.e. within the EU (see section 3). Runs are deleted after 90 days.

You may object to this storage under Article 21 GDPR. Since the runs are not assigned to a person, please tell me the approximate time of your run in an informal email – I will then delete the entry concerned.

Only if you voluntarily enter your email address at the end and request the evaluation are your email address, your answers and the result transmitted to me and processed for the purpose of sending it (Article 6 (1) (a) and (b) GDPR). You can withdraw your consent at any time without formality; the data will then be deleted unless statutory retention obligations apply.

7. Cookies, local storage and analytics

This website sets no cookies – neither technically necessary ones nor those for tracking or marketing. One single piece of information is stored in your browser's local storage: your choice between light and dark presentation, so that it is retained on your next visit. This entry does not leave your device and cannot be linked to a person. The legal basis is § 25 (2) no. 2 TDDDG (functionality expressly requested). You can delete it at any time via your browser settings.

For audience measurement I use Cloudflare Web Analytics (provider as in section 3). The service works without cookies, without local storage and without recognition identifiers: nothing is stored on or read from your device, which is why no consent under § 25 TDDDG is required. Recorded are the page visited, the referring page, the approximate country of origin, device type and load times. No profiles are created, and no recognition across multiple visits takes place.

Your IP address is processed for delivery; Cloudflare uses it exclusively to derive the country and does not store it. The legal basis is Article 6 (1) (f) GDPR. My legitimate interest is in understanding which content on my website is actually used. You can object to this collection by enabling “Do Not Track” in your browser or by blocking scripts from static.cloudflareinsights.com; the website works unchanged either way.

8. Fonts

For consistent presentation this website uses fonts stored locally on my own server (self-hosting). No connection to third-party servers (e.g. Google Fonts) takes place when the site is accessed, and no personal data is transmitted to third parties in this context.

9. SSL / TLS encryption

For security reasons and to protect the transmission of confidential content, this site uses SSL / TLS encryption. You can recognise an encrypted connection by the browser address bar switching from “http://” to “https://” and by the padlock symbol in your browser bar.

10. Your rights as a data subject

Within the scope of the applicable law you have the right at any time to:

Information about your stored personal data (Article 15 GDPR)
Rectification of inaccurate data (Article 16 GDPR)
Erasure of your data (Article 17 GDPR)
Restriction of processing (Article 18 GDPR)
Data portability (Article 20 GDPR)
Objection to processing (Article 21 GDPR)
Withdrawal of consent given, with effect for the future (Article 7 (3) GDPR)

An informal email to kontakt@konradgondek.de is sufficient to exercise your rights.

11. Right to lodge a complaint with a supervisory authority

In the event of breaches of data protection law you have the right to lodge a complaint with a supervisory authority (Article 77 GDPR). The authority responsible for me is:

Berliner Beauftragte für Datenschutz und Informationsfreiheit
Alt-Moabit 59-61
10555 Berlin
www.datenschutz-berlin.de

12. Currency of this privacy policy

I reserve the right to adapt this privacy policy so that it always meets current legal requirements or to reflect changes to my services.

Last updated: August 2026