Legal notice

Data controller

You can also use these contact details for privacy enquiries and to exercise your rights.

Hosting and server logs

We host this website on our own server at our company premises (in-house hosting). When you visit, our server and reverse proxy infrastructure processes technical connection data and creates access and error logs. These include your IP address, date and time, requested address, HTTP method, response status, amount of data transferred and processing time. Error logs may also contain technical details about the error.

Logs are used to operate the website, diagnose faults and detect and investigate abuse and security incidents. The legal basis is Article 6(1)(f) GDPR; our interest is the availability and security of our website. We do not use these data for advertising or to create usage profiles.

During normal operation, server and reverse proxy logs are retained for up to seven days and deleted automatically by daily log rotation. Access is limited to people responsible for operations and IT security. This short retention period allows timely fault diagnosis and investigation of attempted attacks. Technical connection data must be transmitted so your browser can retrieve the website.

Contact form, email and telephone enquiries

When you contact us, we process your contact details and the content of your enquiry. The contact form collects your name, company, email address, subject and message. A form on a regional page also sends the associated location. Our web server emails the details to us; the website does not keep a separate message collection in its content database.

We use your information to handle and respond to your enquiry. Article 6(1)(b) GDPR applies when preparing or performing a contract with you. For other enquiries and communication with company contacts, Article 6(1)(f) GDPR applies; our interest is appropriate business communication. Providing information is voluntary. Without the required details, we cannot process the form and may be unable to answer your enquiry.

We use Microsoft Exchange Online (Microsoft 365) for email communication. Microsoft processes, in particular, sender and recipient addresses, message content and technical delivery data. According to Microsoft, even with European data storage, certain processing and access outside the European Economic Area, particularly in the USA, may occur. Microsoft describes the contractual safeguards, including EU Standard Contractual Clauses, in its Data Protection Addendum. The documents are linked below; further information about safeguards applicable to our processing is available through our privacy contact.

Correspondence is retained according to completion of the enquiry, any commercial or tax retention obligations, and the need to clarify legal claims. The short server-log retention period does not generally apply to messages or business records. Access is available to people handling your enquiry and service providers used for email processing.

• Microsoft: Products and Services Data Protection Addendum
• Microsoft: transfers outside the EU Data Boundary

Protecting the contact form with ALTCHA

We use a self-hosted ALTCHA security check to prevent automated submissions. Your browser solves a computational challenge and sends the result to our server for verification. The required software is loaded from our website. No data is sent to an external CAPTCHA service and no CAPTCHA cookies are set.

To prevent a solution being reused, we store a hash of the random challenge identifier with an expiry time. This record contains neither your message nor your email or IP address. Depending on the setting, validity is two to fifteen minutes; expired entries are removed at the next successful security check.

We also limit submission attempts. For this purpose, we process a hash of your email address and an in-memory counter in fifteen-minute windows. Counters reset on the next submission after the window expires or when the application process restarts. This also prevents abuse under Article 6(1)(f) GDPR. Processing of technical access data is described in the server logs section.

Cookies, fonts and audience measurement

Our website’s fonts, images and software are served by our server. In particular, loading fonts does not connect to Google Fonts. Google Analytics is an optional service loaded only after your consent; details are provided in the following section.

We use the self-hosted CookieConsent software for your cookie choices. The necessary cookie mxm_consent stores your selection, its time, the notice version and a random consent identifier for 180 days. Your choice is not sent to the CookieConsent provider. It implements your decision under Section 25(2), No. 2 TDDDG and Article 6(1)(c) GDPR in conjunction with consent requirements. You can change your choice at any time through “Cookie settings” in the footer.

The protected administration area uses technically necessary authentication cookies for signed-in administrators. These support login and access control, rather than tracking public website visits. Where access to a device is strictly necessary for an explicitly requested feature, it is based on Section 25(2), No. 2 TDDDG.

When you first open the homepage, we use the language preferences your browser sends to our server. If you choose a language in the language picker, the mxm_locale cookie stores only the language code de, en or pl for 180 days. This remembers your choice for later visits. This cookie is not used for analytics or advertising. You can change your selection at any time or delete the cookie in your browser.

Google Analytics 4 – only with your consent

We use Google Analytics 4 from Google Ireland Limited to analyse website usage statistically. Your browser loads Google’s software only after you agree to the “Statistics” category. Without consent or after rejection, we do not load it or send analytics requests to Google. The legal bases are Section 25(1) TDDDG and Article 6(1)(a) GDPR.

After consent, the data processed includes pages visited, pseudonymous cookie identifiers, session and usage information, and technical browser and device data. Google also receives your IP address when connecting. Our page views do not transmit URL query parameters or fragments. Our integration does not send contact form content or login data to Google Analytics. Advertising personalisation, Google Signals and a custom user ID are not enabled.

If you use the web terminal, after consent we also record opening and closing, completion of startup, known command names, result categories, argument counts, discovered features, and use of history, completion, input cancellation and window-size selection. Unknown commands are counted only as “unknown”. On closing, we may send the duration and command count observed since permitted measurement began. Free text, full command lines, argument content and terminal output are not transmitted. Earlier interactions are not sent retroactively after later consent. The terminal works without statistics consent.

The _ga and _ga_* cookies distinguish visits and sessions and are set for at most 180 days. Our configuration does not extend their lifetime on every page view. User and event data retention in Google Analytics is set to 14 months, without extension on new activity. Aggregated statistical reports may remain beyond this period.

Google processes data on our behalf. Google LLC and other subprocessors may also process data outside the European Economic Area, particularly in the United States. Information about recipients and transfer safeguards, especially Standard Contractual Clauses, is provided in the linked data processing terms below. Further information about safeguards applicable to our processing is available through our privacy contact.

Consent is voluntary. You can withdraw it for the future at any time through “Cookie settings” in the footer. We then stop further analytics and delete analytics cookies accessible to our integration. Withdrawal does not affect the lawfulness of processing already performed. You can use the entire website without analytics.

• Google: privacy and data use in Google Analytics
• Google: data processing terms
• Google Privacy Policy

Google reviews

If the reviews section and automatic retrieval are enabled, our server loads reviews of our business through the Google Places API. We may display the overall rating, review count and publicly available names, profile images, review text, stars and links to original reviews. Google Maps is the source. We present this information about customer experiences on the basis of our legitimate interest under Article 6(1)(f) GDPR.

Retrieval and profile image loading take place on the server. Your IP address, browser cookies and contact form data are not forwarded to Google. Your browser receives the reviews through our website; we do not keep a permanent review archive. Your browser connects to the relevant provider only when you open a link to Google or a review profile. Google’s linked privacy policy applies to its processing.

• Google Privacy Policy

AnyDesk downloads and external links

Our AnyDesk menu offers company-specific installers for the enabled operating systems. To highlight a suitable option, it evaluates the operating-system identifier supplied by the browser locally. The recommendation is neither stored on our server nor sent to AnyDesk. A download starts only when you select a download link.

The installers currently offered are provided through my.anydesk.com. Clicking a link connects your browser to AnyDesk Software GmbH, Türlenstraße 2, 70191 Stuttgart. The provider receives, in particular, your IP address and technical download-request data. Visiting our website or downloading a file does not start a remote support session. Subsequent use of the remote support software is a separate process.

Links to social networks, Google and other external websites are also ordinary links. Opening them takes you outside our website; the destination providers process the resulting data under their own privacy policies.

• AnyDesk Privacy Policy

Your rights

Subject to the legal conditions, you have the following rights. Please contact the data controller identified above to exercise them.

• Access to your personal data (Article 15 GDPR).
• Rectification of inaccurate data (Article 16 GDPR).
• Erasure or restriction of processing (Articles 17 and 18 GDPR).
• Data portability for data covered by that right (Article 20 GDPR).
• Withdrawal of consent, if given, for the future without affecting the lawfulness of previous processing.

Right to object: you may object to processing based on Article 6(1)(f) GDPR for reasons relating to your particular situation (Article 21 GDPR). We will stop the processing unless there are overriding compelling legitimate grounds or grounds for establishing, exercising or defending legal claims.

Complaints to a supervisory authority

Under Article 77 GDPR, you may complain to a data protection supervisory authority, particularly where you normally live, work or where the alleged infringement occurred. For businesses based in Schleswig-Holstein, the responsible authority is the Independent Centre for Data Protection Schleswig-Holstein (ULD), Holstenstraße 98, 24103 Kiel.

This website does not carry out automated decision-making, including profiling, within the meaning of Article 22 GDPR.

• Independent Centre for Data Protection Schleswig-Holstein