Home / Privacy Policy

Privacy Policy

Last updated: October 8, 2026

This English version is provided for convenience only. In case of any discrepancy, the German version shall prevail.

This privacy policy explains which personal data we process when you visit our website or contact us, for what purpose, on what legal basis and for how long. Personal data is any information that relates to you as a person, such as your name, email address or IP address.

1. Controller

The controller responsible for data processing on this website is:

Dennis Redder
eingenetzt
Bismarckstraße 54
44135 Dortmund
Germany

Phone: +49 231 13707678
Email: info@eingenetzt.net

We have not appointed a data protection officer, as we are not legally required to do so. For any questions about data protection, please contact us using the details above.

2. Legal bases at a glance

We process personal data only where one of the following legal bases of the General Data Protection Regulation (GDPR) permits it:

• Consent (Art. 6(1)⁠(a) GDPR): you have given us your consent for a specific purpose, for example in the consent dialog on this website or when subscribing to our mailing list.
• Contract and pre-contractual steps (Art. 6(1)⁠(b) GDPR): the processing is necessary for a contract with you or for steps taken at your request before entering into a contract.
• Legal obligation (Art. 6(1)⁠(c) GDPR): we are legally required to process the data, for example to retain business records.
• Legitimate interests (Art. 6(1)⁠(f) GDPR): the processing is necessary for our legitimate interests, and your interests do not override them. The specific interest is stated for each processing activity.

Independently of the GDPR, Section 25 of the German Telecommunications Digital Services Data Protection Act (TDDDG) governs when we may store or access information on your device, for example in the form of cookies. This requires your consent (Section 25(1) TDDDG) unless it is strictly necessary to provide the website you have requested (Section 25(2) no. 2 TDDDG).

3. Your rights

You have the following rights regarding your personal data:

• right of access (Art. 15 GDPR)
• right to rectification (Art. 16 GDPR)
• right to erasure (Art. 17 GDPR)
• right to restriction of processing (Art. 18 GDPR)
• right to data portability (Art. 20 GDPR)
• right to withdraw consent at any time with effect for the future (Art. 7(3) GDPR). This does not affect the lawfulness of processing carried out before the withdrawal.

Right to object (Art. 21 GDPR): Where we process your data on the basis of legitimate interests (Art. 6(1)⁠(f) GDPR), you may object at any time on grounds relating to your particular situation. Where we process your data for direct marketing, you may object to this processing at any time without giving reasons.

To exercise any of these rights, simply send a message to info@eingenetzt.net.

Right to lodge a complaint with a supervisory authority (Art. 77 GDPR): You have the right to lodge a complaint with a data protection supervisory authority. The authority responsible for us is:

State Commissioner for Data Protection and Freedom of Information of North Rhine-Westphalia (LDI NRW)
Kavalleriestraße 2–4
40213 Düsseldorf
Germany
www.ldi.nrw.de

You may also contact the supervisory authority in your place of residence or work.

4. Recipients and transfers to third countries

We share personal data only where necessary for the purposes described in this policy. Recipients are mainly technical service providers that we engage as processors under Art. 28 GDPR and bind contractually to our instructions, as well as providers that process data as independent or joint controllers. Each provider is named in the relevant section.

Some providers are based in the United States or transfer data there. On July 10, 2023, the European Commission adopted an adequacy decision for the United States, the EU-U.S. Data Privacy Framework (DPF). Transfers to companies certified under the DPF are based on this decision (Art. 45 GDPR). Where a provider is not certified or the contract provides for it, the European Commission's Standard Contractual Clauses apply (Art. 46(2)⁠(c) GDPR). You can check whether a company is certified at www.dataprivacyframework.gov/list.

5. Retention

We delete personal data as soon as the purpose of processing no longer applies, you withdraw your consent or you object effectively, unless statutory retention obligations apply. Under Section 257 of the German Commercial Code (HGB) and Section 147 of the German Fiscal Code (AO), we retain commercial and business letters for six years, accounting records for eight years, and books of account and annual financial statements for ten years. Specific periods for individual services are stated in the relevant section.

6. Hosting, delivery and server log files

Hosting. Our website is hosted by Kinsta Inc., 8605 Santa Monica Blvd #92581, West Hollywood, CA 90069, USA. Kinsta operates its servers on Google Cloud Platform in the Frankfurt am Main data center in Germany (region europe-west3). Kinsta processes the data on our behalf; the data processing agreement is part of Kinsta's terms of service. Kinsta is certified under the EU-U.S. Data Privacy Framework.

Delivery via a content delivery network. Kinsta delivers the website through the network of Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107, USA. All requests pass through Cloudflare servers, which cache the website, deliver it faster and protect it from attacks. To deliver the content to your browser, Cloudflare processes your IP address. Cloudflare is a sub-processor of Kinsta and is certified under the EU-U.S. Data Privacy Framework.

Server log files. Each time the website is accessed, Kinsta and Cloudflare collect data transmitted by your browser for technical reasons: IP address, date and time, requested URL, amount of data transferred, status code, the previously visited page (referrer), browser type and operating system. We need this data to deliver the website, keep it stable and secure, and fend off attacks. The legal basis is Art. 6(1)⁠(f) GDPR; our legitimate interest is the secure and reliable operation of the website. Kinsta keeps server log files for no more than four days.

No third-party fonts or maps. The fonts on this website are hosted on our own server; there is no connection to Google Fonts or any other font provider. The map on our contact page is an image on our server, created from OpenStreetMap data (© OpenStreetMap contributors, ODbL). Viewing it does not create a connection to OpenStreetMap or any other map service.

7. Consent management with Borlabs Cookie

To manage consent under Section 25 TDDDG and the GDPR, we use the WordPress plugin Borlabs Cookie by Borlabs GmbH, Rübenkamp 32, 22305 Hamburg, Germany. The plugin runs on our server; no data is transmitted to Borlabs.

Borlabs Cookie stores your choice in a cookie named borlabs-cookie in your browser, together with a randomly generated ID. We also log this ID and your choice on our server so that we can demonstrate that, and for what, you gave consent. The cookie is valid for 183 days, after which we ask again. We keep the log for three years so that we can demonstrate consent for the duration of the standard limitation period, and then delete it.

The legal basis for the cookie is Section 25(2) no. 2 TDDDG, as it is strictly necessary to respect your decision. The legal basis for the processing is Art. 6(1)⁠(c) GDPR in conjunction with Art. 7(1) GDPR (obligation to demonstrate consent).

Changing or withdrawing consent: You can open, change and withdraw your consent at any time with effect for the future via the "Cookie settings" link in the footer of every page or via this link: Open cookie settings.

8. Contact by email and phone

When you contact us by email or phone, we process the information you provide (name, contact details, content of your inquiry) to handle your request. The legal basis is Art. 6(1)⁠(b) GDPR if your inquiry relates to a contract, and otherwise Art. 6(1)⁠(f) GDPR; our legitimate interest is responding to your inquiry. We delete the data once your inquiry has been resolved and no retention obligations apply.

Email service. Our email runs on Google Workspace (Gmail), provided by Google Cloud EMEA Limited, 70 Sir John Rogerson's Quay, Dublin 2, Ireland. Google processes the data on our behalf under the Cloud Data Processing Addendum. Data may be transferred to Google LLC in the United States, which is certified under the EU-U.S. Data Privacy Framework.

9. Video conferencing with Google Meet

For consultations and project meetings, we use Google Meet, part of Google Workspace (provider as in section 8). When you join a video call, Google processes the data needed to run it: your name or display name, your email address if you are invited, video and audio during the call, chat messages, IP address, device and connection data, and the time and duration of your participation. We do not record calls unless we have agreed this with you in advance.

The legal basis is Art. 6(1)⁠(b) GDPR where the call relates to a contract or inquiry, and otherwise Art. 6(1)⁠(f) GDPR; our legitimate interest is simple communication regardless of location. Google processes the data on our behalf under the Cloud Data Processing Addendum. Data may be transferred to Google LLC in the United States, which is certified under the EU-U.S. Data Privacy Framework.

10. Appointment booking with Calendly

To book a free consultation, we use Calendly, provided by Calendly, LLC, 115 E Main St., Ste A1B, Buford, GA 30518, USA.

Until you click, our website loads nothing from Calendly. When you click a booking button, Calendly's booking calendar opens in a window on top of our page; the note next to the button points this out. Only with this click does your browser load content and scripts from Calendly, transmitting your IP address and device information, and Calendly may set cookies. The legal basis is the consent you give with this click (Art. 6(1)⁠(a) GDPR, Section 25(1) TDDDG). If you open the link while holding Ctrl or Cmd, you go directly to Calendly's website in a new tab instead.

With your consent in the "External Media" category, we also embed the booking calendar directly in the page, without a click first. Your browser then loads content and scripts from Calendly, transmitting your IP address and device information, and Calendly may set cookies. The legal basis is your consent (Art. 6(1)⁠(a) GDPR, Section 25(1) TDDDG), which you can withdraw at any time (section 7).

The calendar also loads scripts from Stripe (Stripe, Inc., 354 Oyster Point Boulevard, South San Francisco, CA 94080, USA). Stripe is the payment service provider Calendly uses for payment features. When these scripts load, your IP address and device information are transmitted to Stripe. This happens only with your consent (clicking the booking button or the "External Media" category), on the same legal basis. More information: stripe.com/privacy.

Within the calendar, Calendly also loads services from further providers; according to our check on 8 October 2026 these include abuse prevention (Google reCAPTCHA), error tracking (Airbrake) and usage analytics (Segment, Google Analytics, Meta). Your IP address and device information are transmitted in this process as well. This also happens only with your consent (clicking the booking button or the "External Media" category), on the same legal basis. We have no influence on these services; Calendly describes what data they process at calendly.com/privacy.

When you book an appointment, Calendly processes the information you enter (name, email address and your entries in the booking form) on our behalf so that the appointment can take place. The legal basis is Art. 6(1)⁠(b) GDPR. The data processing agreement is part of Calendly's terms of use. Calendly is certified under the EU-U.S. Data Privacy Framework. We use booking data for as long as it is needed to prepare, hold and follow up on the appointment. If this leads to a business relationship, section 19 applies. Otherwise, Calendly stores the data in accordance with its own policies (calendly.com/privacy).

11. Forms and mailing list with Brevo

Forms. On certain pages, for example to request an SEO report, you can send us your details via a form: first name, last name, email address, phone number and company. Required fields are marked. The form is sent to our server, from where we transmit the information to Brevo. We use your phone number to call you back about your request.

Mailing list. We send our emails with Brevo, provided by Sendinblue SAS, 106 boulevard Haussmann, 75008 Paris, France. Brevo processes the data on our behalf within the European Union. The data processing agreement is part of Brevo's terms of use.

Receiving our SEO report is linked to joining our mailing list. We state this directly above the submit button: about two emails a month with insights on SEO and AI search in manufacturing. We add you to the list only after you have clicked the link in our confirmation email (double opt-in). Brevo logs the time of sign-up and confirmation and your IP address; we also store which version of the consent text you saw. This allows us to demonstrate your consent. The legal basis is your consent (Art. 6(1)⁠(a) GDPR).

Email analytics. Our emails contain a tracking pixel and links that allow Brevo to record whether and when an email was opened and which links were clicked. This shows us which topics are relevant to our readers. The legal basis is your consent (Art. 6(1)⁠(a) GDPR), which you give when subscribing. It is not technically possible to withdraw consent for the tracking alone; in that case, please unsubscribe from the mailing list.

Unsubscribing. You can unsubscribe at any time via the link at the end of every email or by writing to info@eingenetzt.net. After you unsubscribe, we remove your data from the mailing list. We keep your email address and the record of your previous consent for up to three years to defend against legal claims (Art. 6(1)⁠(f) GDPR) and keep it on a suppression list so that you receive no further emails.

Requests without the mailing list. If you request something via a form that is not linked to the mailing list, we use your information only to handle the request (Art. 6(1)⁠(b) GDPR) and delete it once the request has been resolved and no retention obligations apply.

12. Website analytics with Matomo

To understand how our website is used and to improve it, we use the analytics software Matomo. Matomo runs on our own server at Kinsta; no data is transmitted to the vendor or any other third party.

In all cases, the IP address is shortened immediately (the last two bytes are removed) and stored only in shortened form. Matomo works in two stages:

Basic measurement without cookies. Without your consent, your browser sends a single request to our Matomo server when you open a page, containing the address and title of the page and the page you came from. We set no cookies, store nothing on your device and read no information from your device. Matomo only processes what every page request contains anyway: the shortened IP address and the browser, operating system and language from the request header. From this, Matomo produces statistics on page views and visits; visitors are not recognized beyond the day. The legal basis is our legitimate interest in privacy-friendly audience measurement to improve our website (Art. 6(1)⁠(f) GDPR). You can object at any time, for example by email (section 1); we will then exclude you from measurement.

Full measurement with cookies. If you have consented in the "Statistics" category, your browser also loads the Matomo script. It additionally records time on page, device type and screen resolution and, to recognize returning visits, sets the following cookies on our domain:

The legal basis for full measurement is your consent (Art. 6(1)⁠(a) GDPR, Section 25(1) TDDDG), which you can withdraw at any time (section 7). If you withdraw consent, the Matomo cookies are deleted and only the basic measurement without cookies remains.

We delete the raw data after 13 months; aggregated reports without personal reference are kept longer.

13. Google Tag Manager

To load the advertising tags described in sections 14 to 16, we use Google Tag Manager, provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Tag Manager is a tool we use to manage tags on our website. It does not set cookies or create user profiles itself, but your IP address is transmitted to Google when it loads. Data may be transferred to Google LLC in the United States, which is certified under the EU-U.S. Data Privacy Framework.

We load Tag Manager only if you have consented to at least one service in the "Marketing" category, and each tag in it only if you have consented to that specific service. We pass your choice on to Google via Google's consent mode in its basic version: without your consent, neither Tag Manager nor any tag is loaded, and no cookieless data is sent to Google either. The legal basis is your consent (Art. 6(1)⁠(a) GDPR, Section 25(1) TDDDG), which you can withdraw at any time (section 7).

14. Google Ads with conversion tracking and remarketing

We run ads via Google Ads, provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland ("Google"). To measure whether our ads are effective and to show ads to visitors of our website again later, we load the Google tag for Google Ads via Google Tag Manager.

Conversion tracking. If you reach our website via one of our ads, the Google tag stores a cookie (_gcl_au, valid for 90 days). If you then complete an action that matters to us, such as submitting a form or booking an appointment, Google and we can see that someone came to us via an ad and completed this action (conversion). We receive only aggregated statistics, no information that identifies you personally. We do not pass form entries such as your email address to Google.

Remarketing. We also add you to audiences so that Google can show you our ads as you continue browsing or in Google Search. For this, Google processes information about your visit, your IP address and cookie IDs, including in cookies on Google domains. If you are signed in to a Google account, Google may link this information to your account.

Data processing. Google and we each act as independent controllers (Google Ads Controller-Controller Data Protection Terms). Data may be transferred to Google LLC in the United States, which is certified under the EU-U.S. Data Privacy Framework. Information on processing by Google: policies.google.com/privacy. You can adjust your ad settings at adssettings.google.com.

Legal basis and retention. The Google tag is loaded only if you have given consent in the "Marketing" category (section 13). The legal basis is your consent (Art. 6(1)⁠(a) GDPR, Section 25(1) TDDDG), which you can withdraw at any time (section 7). Cookies used by Google's advertising services are valid for no more than 13 months in the European Economic Area.

15. ChatGPT Ads (OpenAI) with conversion measurement

We run ads in ChatGPT via OpenAI's advertising platform. For users in the European Economic Area, the provider is OpenAI Ireland Limited, 1st Floor, The Liffey Trust Centre, 117–126 Sheriff Street Upper, Dublin 1, Ireland ("OpenAI").

To measure whether our ads in ChatGPT lead to inquiries, we use OpenAI's measurement pixel (OpenAI Ads Measurement Pixel), which we load via Google Tag Manager. If you click one of our ads in ChatGPT and come to our website, the URL contains an identifier for that click. The pixel stores this identifier in cookies on our domain (__oppref, valid for 30 days, and __obref, valid for 365 days) and reports certain events to OpenAI, such as a page view, a form submission or an appointment booking. The data transmitted includes the click identifier, the type and time of the event, the page visited, browser information and your IP address. We do not pass form entries such as your email address or phone number to OpenAI; the automatic transfer of such information (Automatic Advanced Matching) is turned off.

We receive only aggregated reports from OpenAI. OpenAI and we each act as independent controllers. OpenAI also uses the data to measure and improve the effectiveness of ads; according to OpenAI, it does not currently use it to show you personalized ads. Data may be transferred to OpenAI OpCo, LLC in the United States on the basis of the European Commission's Standard Contractual Clauses. Information on processing by OpenAI: openai.com/policies/privacy-policy.

The pixel is loaded and sends data only after you have given consent in the "Marketing" category. The legal basis is your consent (Art. 6(1)⁠(a) GDPR, Section 25(1) TDDDG), which you can withdraw at any time (section 7).

16. LinkedIn Insight Tag

We use the LinkedIn Insight Tag from LinkedIn Ireland Unlimited Company, Wilton Place, Dublin 2, Ireland ("LinkedIn"), which we load via Google Tag Manager. It allows us to measure the success of our advertising on LinkedIn (conversion tracking), receive aggregated statistics about visitors to our website, for example by industry or job function, and show ads on LinkedIn to people who have visited our website (retargeting).

The Insight Tag transmits your IP address, the page visited, the previously visited page, browser and device information and the time of the visit to LinkedIn. If you are or have been signed in to LinkedIn, LinkedIn may link this data to your profile. We receive no information that identifies you personally. The following cookies are set: on our domain li_fat_id (30 days) and li_sugr (90 days); on the linkedin.com domain, among others, bcookie (1 year), lidc (24 hours), UserMatchHistory (30 days) and AnalyticsSyncHistory (30 days).

We and LinkedIn are joint controllers for collecting the data on our website and transmitting it to LinkedIn (Art. 26 GDPR). LinkedIn is solely responsible for any further processing. You can exercise your rights with us and with LinkedIn. Data may be transferred to LinkedIn Corporation in the United States, which is certified under the EU-U.S. Data Privacy Framework. Information on processing by LinkedIn: linkedin.com/legal/privacy-policy and linkedin.com/legal/cookie-policy.

The Insight Tag is loaded only if you have given consent in the "Marketing" category. The legal basis is your consent (Art. 6(1)⁠(a) GDPR, Section 25(1) TDDDG), which you can withdraw at any time (section 7).

17. Videos from YouTube and Vimeo

Some of our articles include videos hosted on YouTube or Vimeo.

Without your consent, we show only a preview image hosted on our own server at that spot. No connection to YouTube or Vimeo is made.

Only when you start the video, or if you have given consent in the "External Media" category, does your browser load the video player from the respective provider. We point this out on the preview image. Your IP address, the page URL and technical information about your browser are transmitted, and the provider may use cookies or similar technologies. The legal basis is your consent (Art. 6(1)⁠(a) GDPR, Section 25(1) TDDDG), which you can withdraw at any time (section 7).

YouTube: The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. We use the privacy-enhanced mode (youtube-nocookie.com). Data may be transferred to Google LLC in the United States, which is certified under the EU-U.S. Data Privacy Framework. Information: policies.google.com/privacy.

Vimeo: The provider is Vimeo.com, Inc., 330 West 34th Street, 10th Floor, New York, NY 10001, USA. We embed Vimeo with the "Do Not Track" setting. Vimeo is certified under the EU-U.S. Data Privacy Framework. Information: vimeo.com/privacy.

18. Our pages on LinkedIn and YouTube

We maintain a company page on LinkedIn and a channel on YouTube. When you visit them, the operators process your data in accordance with their own privacy policies. This privacy policy does not apply to them.

For the statistics of our LinkedIn page (Page Insights), we are joint controllers with LinkedIn Ireland Unlimited Company, Wilton Place, Dublin 2, Ireland (Art. 26 GDPR). LinkedIn provides us only with aggregated statistics. The joint controller agreement and LinkedIn's privacy policy are available at legal.linkedin.com/pages-joint-controller-addendum and linkedin.com/legal/privacy-policy. You can exercise your GDPR rights most effectively directly with LinkedIn. The legal basis for our part is Art. 6(1)⁠(f) GDPR; our legitimate interest is informing people about our services and communicating with prospective clients.

19. Clients and business partners

When we work with you, we process the data needed for proposals, contracts, service delivery and invoicing: names and contact details of your contact persons, contract and payment data, and project communication. The legal basis is Art. 6(1)⁠(b) GDPR and, for retention obligations, Art. 6(1)⁠(c) GDPR. Retention is governed by section 5.

20. No obligation to provide data, no automated decision-making

You are not legally or contractually obliged to provide us with personal data. Without the information requested in a form, however, we cannot process your request. We do not use solely automated decision-making, including profiling, within the meaning of Art. 22 GDPR.

21. Changes to this privacy policy

We update this privacy policy when our website, the services we use or the legal situation change. The version published here applies.