Privacy policy

This is a courtesy translation. Only the German version is legally binding.

1. Controller

The controller within the meaning of the General Data Protection Regulation (GDPR) is:

Konrad Gondek IT-Automatisierung
Owner: Konrad Gondek (sole proprietor)
Eckertstr. 2a
10249 Berlin
Email: impressum (at) konradgondek.de

2. General information on data processing

Protecting your personal data matters to me. I process personal data exclusively within the limits of the applicable law (GDPR, BDSG, TDDDG). This policy explains what data is collected when you visit this website and how I use it.

3. Hosting and processors

This website runs on the Cloudflare Workers platform. The provider is Cloudflare, Inc., 101 Townsend St, San Francisco, CA 94107, USA, represented in the European Union by Cloudflare Germany GmbH, Rosental 7, 80331 Munich. A data processing agreement under Article 28 GDPR is in place with Cloudflare. Delivery runs over Cloudflare's global server network; for visitors from Europe, generally via locations within the EU. Where personal data is transferred to the USA in the process, this takes place on the basis of the EU standard contractual clauses; Cloudflare is additionally certified under the EU-US Data Privacy Framework.

When you access the website, the host automatically collects information in what are known as server log files, which your browser transmits automatically:

Browser type and version
Operating system used
Referrer URL
Host name of the accessing device
Time of the server request
IP address (shortened or pseudonymised where possible)

This data is not merged with other data sources. Processing takes place on the basis of Article 6 (1) (f) GDPR (legitimate interest in the technically correct presentation and security of the website). Log files are deleted after 14 days at the latest, unless security-relevant incidents require longer retention.

For my business email I use Google Workspace. The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. A data processing agreement under Article 28 GDPR is in place with Google (Cloud Data Processing Addendum). Any message you send me, and any message I send you in response to an enquiry, is processed and stored there. Where personal data is transferred to Google LLC in the USA, this takes place on the basis of the EU standard contractual clauses; Google is also certified under the EU-US Data Privacy Framework.

4. Contact form and contact by email

If you send me an enquiry via the contact form (“Free 30min call”), I process the data you provide:

Name (required)
Email address (required)
Phone number (optional)

Processing takes place in order to handle your enquiry and to carry out pre-contractual measures (Article 6 (1) (b) GDPR) or on the basis of my legitimate interest in responding to enquiries (Article 6 (1) (f) GDPR). Beyond the processors named in section 3, your data is not passed on. It is deleted as soon as it is no longer required to handle your enquiry and no statutory retention obligations apply.

Your enquiry is stored in a database at Cloudflare (see section 3) and additionally sent to my mailbox hosted at Google Workspace (also section 3). Technically recorded alongside it are the user agent transmitted by your browser and the time of the enquiry; both serve to prevent automated spam. For the same purpose, the number of requests per IP address is counted for one hour, without the IP address being stored permanently.

Your enquiry is also recorded together with the channel you arrived through: the domain of the referring site (for example linkedin.com) or any campaign parameters in the address you opened. If you entered the address directly, or navigated within this site before submitting, only direkt or intern is recorded. The legal basis is my legitimate interest in understanding which channels lead to enquiries (Art. 6(1)(f) GDPR). The value is transmitted when you submit your enquiry and is not passed on to any third party. The only exception: if you consent to Google Analytics in the cookie banner, Google also receives this channel (see section 7).

So that this channel survives navigation between pages, the first value detected is stored in your browser's session storage. It is a single text value with no timestamp, no identifier and no profiling; no cookie is set. Your browser deletes session storage automatically as soon as you close the tab, so no recognition across separate visits takes place. The value leaves your browser only together with an enquiry you submit yourself, or after you consent to Google Analytics. You can prevent this storage by blocking session storage for this site in your browser; the site remains fully usable either way.

5. Appointment booking

For arranging the free introductory call I link to a booking page provided by Google Calendar (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland). That page is only loaded once you actively click the link; no data is transmitted to Google from this website itself.

On the booking page, Google processes the data you enter there (typically name, email address and the slot chosen) as well as technical connection data. Google's own privacy policy applies to that processing (policies.google.com/privacy). I process the appointment data transmitted to me in order to hold the call, on the basis of Article 6 (1) (b) GDPR. If you would rather not use this service, you can equally reach me through the contact form or by email.

6. Automation Check

The “Automation Check” offered on this website consists of two parts:

The two key figures (person-days tied up and unused software budget) are calculated exclusively in your browser. That calculation does not leave your device.
For the individual roadmap, your answers – including any free text you enter – are transmitted to my server and from there, via the intermediary service OpenRouter (OpenRouter, Inc., Delaware, USA), to the AI model Gemini 3.8 Flash provided by Google (Google LLC, Mountain View, USA), which generates the evaluation. OpenRouter forwards the request technically without evaluating the content itself.

The legal basis for this transfer is your consent, given by submitting the check (Article 6 (1) (a) GDPR), together with my legitimate interest in producing a meaningful evaluation (Article 6 (1) (f) GDPR). A data processing agreement is in place with OpenRouter; Google acts as a sub-processor. Transfer to the USA takes place on the basis of the EU standard contractual clauses. Requests are routed exclusively to providers who are contractually bound neither to store the transmitted content nor to use it for training AI models.

Neither OpenRouter nor Google stores your answers; both are contractually bound not to. Even so, please do not enter personal data about third parties or trade secrets in the free text fields.

On my side, your answers and the evaluation produced from them are stored, together with the time of the run and the channel through which you reached this site (see section 4). For a personally shared link, only the fact that it was a referral is recorded, not who shared it. The purpose is to develop the check and my services further: I want to see which processes cost time repeatedly, and at which company size. The legal basis is Article 6 (1) (f) GDPR; my legitimate interest lies in that analysis.

Expressly not stored are your IP address, your browser identifier (user agent) and any form of session or recognition identifier. The stored runs cannot be linked to one another or to your person as long as you do not provide an email address. Storage takes place in a database at Cloudflare in the Eastern Europe region, i.e. within the EU (see section 3). Runs are deleted after 90 days.

You may object to this storage under Article 21 GDPR. Since the runs are not assigned to a person, please tell me the approximate time of your run in an informal email – I will then delete the entry concerned.

Only if you voluntarily enter your email address at the end and request the evaluation are your email address, your answers and the result transmitted to me and processed for the purpose of sending it (Article 6 (1) (a) and (b) GDPR). You can withdraw your consent at any time without formality; the data will then be deleted unless statutory retention obligations apply.

7. Cookies, local storage and analytics

Without your consent this website sets no cookies. At most two pieces of information are stored in your browser's local storage: your choice between light and dark presentation and your decision in the cookie banner, so that both are retained on your next visit. These entries do not leave your device and cannot be linked to a person. The legal basis is § 25 (2) no. 2 TDDDG (strictly necessary for a functionality you expressly requested). You can delete them at any time via your browser settings.

For audience measurement I use Cloudflare Web Analytics (provider as in section 3). The service works without cookies, without local storage and without recognition identifiers: nothing is stored on or read from your device, which is why no consent under § 25 TDDDG is required. Recorded are the page visited, the referring page, the approximate country of origin, device type and load times. No profiles are created, and no recognition across multiple visits takes place.

Your IP address is processed for delivery; Cloudflare uses it exclusively to derive the country and does not store it. The legal basis is Article 6 (1) (f) GDPR. My legitimate interest is in understanding which content on my website is actually used. You can object to this collection by enabling “Do Not Track” in your browser or by blocking scripts from static.cloudflareinsights.com; the website works unchanged either way.

In addition, my server counts page views itself: a counter for the current date and the page requested is increased by one. If you arrive through a link with campaign parameters, for example from one of my LinkedIn posts, a counter for the name of the campaign is increased as well. Neither your IP address nor your browser's user agent nor any other detail that could be linked to a single visit is stored. The count is based on what your browser transmits anyway when it requests the page: the address of the page and of the referring page. Of the referring page, only whether the request came from outside this website is recorded. Nothing is stored on or read from your device for the count. Your browser's user agent is checked only at the moment of the request, to leave automated requests out of the count. The legal basis is Article 6 (1) (f) GDPR; my legitimate interest is in understanding which content is used and which publications bring visitors to the website. The counts are deleted after 400 days.

Only if you agree in the cookie banner do I additionally use Google Analytics 4. The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. No connection to Google is made before you consent. Google Analytics sets the cookies _ga and _ga_<ID>, which contain a random identifier and are kept for up to two years. They make it possible to recognise whether you have visited the website before. Recorded are the pages visited, the referring page, time on page, device, browser and approximate location. It is also recorded whether you submitted an enquiry, completed the automation check or opened the booking link. What you entered is not sent to Google. Google uses your IP address only to derive the location and does not store it. Google Signals and all advertising features are switched off; the data is not linked to a Google account. The collected data is deleted after two months.

I have concluded a data processing agreement with Google. Google may transfer data to Google LLC in the USA. Google LLC is certified under the EU-US Data Privacy Framework, for which the European Commission has adopted an adequacy decision; the EU standard contractual clauses apply in addition. The legal basis is your consent under § 25 (1) TDDDG and Article 6 (1) (a) GDPR. You can withdraw it at any time with effect for the future via the “Cookie settings” link at the bottom of every page. The cookies are deleted when you do.

8. Fonts

For consistent presentation this website uses fonts stored locally on my own server (self-hosting). No connection to third-party servers (e.g. Google Fonts) takes place when the site is accessed, and no personal data is transmitted to third parties in this context.

9. SSL / TLS encryption

For security reasons and to protect the transmission of confidential content, this site uses SSL / TLS encryption. You can recognise an encrypted connection by the browser address bar switching from “http://” to “https://” and by the padlock symbol in your browser bar.

10. Your rights as a data subject

Within the scope of the applicable law you have the right at any time to:

Information about your stored personal data (Article 15 GDPR)
Rectification of inaccurate data (Article 16 GDPR)
Erasure of your data (Article 17 GDPR)
Restriction of processing (Article 18 GDPR)
Data portability (Article 20 GDPR)
Objection to processing (Article 21 GDPR)
Withdrawal of consent given, with effect for the future (Article 7 (3) GDPR)

An informal email to impressum (at) konradgondek.de is sufficient to exercise your rights.

11. Right to lodge a complaint with a supervisory authority

In the event of breaches of data protection law you have the right to lodge a complaint with a supervisory authority (Article 77 GDPR). The authority responsible for me is:

Berliner Beauftragte für Datenschutz und Informationsfreiheit
Alt-Moabit 59-61
10555 Berlin
www.datenschutz-berlin.de

12. Currency of this privacy policy

I reserve the right to adapt this privacy policy so that it always meets current legal requirements or to reflect changes to my services.

Last updated: October 2026