Privacy policy
This English version is provided for convenience. Only the German version is legally binding.
1. Controller
Andreas Hafner, Vertical Consulting. For the address, see the legal notice. Email: contact@vertical.consulting
2. Hosting and server logs
This website and the "Vertical Estimate" application are operated via Google Firebase (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland). When you access the site, Google processes technically necessary data (including IP address, time, files accessed and browser information) to deliver the site and keep it secure. The database and functions run in the Frankfurt region (europe-west3). Legal basis: Art. 6(1)(f) GDPR. A transfer to the USA cannot be ruled out; Google LLC is certified under the EU-US Data Privacy Framework.
For an anonymous visitor count, the access logs of this website (IP address, time, requested address, browser information, referring page) are stored in Google Cloud Logging in Frankfurt and deleted automatically after 7 days. Every hour, a function counts the page views per day and the number of visitors (distinct combinations of IP address and browser). Only these totals are stored, without IP address and without identifier; nothing is stored in or read from your browser for this. Legal basis: Art. 6(1)(f) GDPR; my legitimate interest is knowing the reach of my website.
3. Storage in your browser
This website does not set advertising cookies and does not embed third-party analytics services. Only settings are stored in your browser: the selected language, the selected CV variant and your decision on visitor statistics, and when you switch languages, briefly your reading position so that the other language version opens at the same place; it is deleted right afterwards (technically necessary, Section 25(2) TDDDG). Only if you agree to the visitor statistics is a random visitor identifier added (see section 4). On your first visit, the language is preselected based on your browser's language setting; no data is transmitted for this.
4. Visitor statistics (only with your consent)
If you choose "Accept" in the notice on visitor statistics, I record which pages of this website are viewed. For each page view, the following is stored: time, page, language, device type (mobile or desktop), the website you came from (domain name only), country, region and city, and two random identifiers: one for the browser tab and a visitor identifier that shows me whether the same browser returns on other days. The visitor identifier is kept in your browser's storage, renewed after 12 months and deleted when you withdraw your consent; it does not reveal who you are. The location is determined by a function in Frankfurt from your IP address using a local database (IP geolocation by DB-IP.com); if you use iCloud Private Relay, the approximate location comes from the list Apple publishes for this purpose. Your IP address is neither stored nor passed on to third parties; to prevent misuse, only a shortened, non-reversible hash is stored briefly. The data is kept in Google Firebase (Frankfurt) and deleted automatically after 12 months.
The legal basis is your consent (Art. 6(1)(a) GDPR, Section 25(1) TDDDG). You can withdraw it at any time with effect for the future via "Privacy settings" at the bottom of every page.
5. Contact form
If you write to me via the form, I process your details (name, email, company if provided, message) to handle your inquiry. The message is stored in Google Firebase (Frankfurt) and delivered to me by email via Microsoft 365 (Microsoft Ireland Operations Ltd.). To prevent misuse, a shortened, non-reversible hash of your IP address is stored briefly. Legal basis: Art. 6(1)(b) and (f) GDPR. The data is deleted once the inquiry has been handled and no retention obligations apply.
6. Booking a call
To book a call, available times are retrieved from my Microsoft 365 calendar (only "free/busy", no appointment content). When you submit the form, the time is reserved for you, your details (name, email, company if provided and topic) are stored in Google Firebase (Frankfurt) and you receive an email with a confirmation link via Microsoft 365. Only after you confirm are the details entered in my calendar; you then receive a calendar invitation from my email address, with a link to the video call if applicable. Without confirmation, the reservation expires; its details are deleted automatically after 12 months. To prevent misuse, shortened hashes of your IP address and your email address (not the addresses themselves) are stored briefly. Legal basis: Art. 6(1)(b) and (f) GDPR.
7. Spam protection (Cloudflare Turnstile)
The form and booking can be protected against automated requests by Cloudflare Turnstile (Cloudflare, Inc., USA). Technical characteristics of your browser and your IP address are transmitted to Cloudflare. Legal basis: Art. 6(1)(f) GDPR (prevention of misuse). Cloudflare is certified under the EU-US Data Privacy Framework.
8. Vertical Estimate (customer accounts)
For customer accounts in "Vertical Estimate", the email address, name, permissions and time of last activity are stored (Firebase Authentication and Firestore, Frankfurt). Passwords are stored only as hashes. Legal basis: Art. 6(1)(b) GDPR.
9. Your rights
You have the right to access, rectification, erasure, restriction of processing, data portability and to object to processing based on Art. 6(1)(f) GDPR. You can withdraw any consent you have given at any time. You also have the right to lodge a complaint with a data protection supervisory authority, e.g. the State Commissioner for Data Protection of Baden-Württemberg.
Last updated: October 2026