Legal

Our website privacy policy

Information on the processing of personal data on this website pursuant to Art. 13 and Art. 14 GDPR.

This is a courtesy translation. The legally binding version is the German one.

1. Controller

The controller for data processing on this website within the meaning of Art. 4 (7) GDPR is:

MFM Datenschutz-Consulting GmbH
Kaiser-Friedrich-Promenade 6
61348 Bad Homburg v.d.H., Germany
Phone: +49 (0)69 27 13 57 20-0
Email: info@datenschutzfrankfurt.de

2. Contact for data protection matters

For data protection enquiries you can reach us at datenschutz@datenschutzfrankfurt.de.

3. Principles of our data processing

We use no cookies, no tracking and no external analytics services. Fonts (Cormorant Garamond, Inter) are served locally from our own server; Google Fonts or comparable CDNs are not embedded. When you visit this website, we transfer personal data to a third country in one case only: the ProvenExpert review seal, and even then not automatically, but only after your active consent (click); details in section 7. For visits to our pages on social networks, see section 9.

4. Provision of the website (server logs)

When you access this website, our hosting provider processes technically necessary data:

  • IP address of the requesting device, in shortened form only
  • Date and time of access
  • Requested URL
  • HTTP status code and amount of data transferred
  • Browser and operating system used (user agent)
  • Referrer URL, if transmitted by the browser

Purpose: ensuring technical operation, troubleshooting, defence against attacks.
Legal basis: Art. 6 (1) (f) GDPR (legitimate interest in stable and secure operation).
Retention: our hosting provider stores the IP address in shortened form only: for IPv4 the last part is replaced with a random value, for IPv6 the last 88 bits are masked. The server logs are deleted once they are older than one week.

5. Getting in touch

When you contact us by email, phone or via the contact form, we process the data you provide solely to handle your enquiry.

Legal basis: Art. 6 (1) (b) GDPR (contract or pre-contractual measure), and for non-contractual enquiries Art. 6 (1) (f) GDPR (legitimate interest in responding).
Retention: until your enquiry has been dealt with; in the case of a client relationship, in accordance with the statutory retention periods (§ 257 (4) HGB, generally 6 years for commercial correspondence; § 147 (3) AO, 10 years for records relevant to accounting).

Mandatory fields: in the contact form, name, email address, subject and message are required so that we can identify and answer your enquiry. Above the submit button, the form refers to this privacy policy, so that the information under Art. 13 GDPR is available to you before you submit the form. By submitting the form, you confirm that you have taken note of this privacy policy. This confirmation is not consent: the processing is based on the legal bases stated above (Art. 6 (1) (b) and (f) GDPR), and we do not ask you to tick a separate box. Providing a company name and a phone number is optional. Without the required entries we cannot process the enquiry; no further disadvantage arises for you. You can also reach us by phone or email at any time.

Spam protection and abuse prevention: when you submit, we automatically check that the enquiry comes from a person using this website. The form contains an additional field that is invisible to you and that only automated scripts fill in. When the page loads, the form uses JavaScript to record the time in a hidden field; if this record is missing or the form is submitted within a few seconds, nothing is sent. The form therefore cannot be submitted without JavaScript; you will then see a note with our email address. We also discard enquiries whose subject does not come from the selection list or whose message contains links in forum notation. We limit submissions to three per IP address within fifteen minutes and to thirty messages per hour in total, and check the address the form was submitted from (origin and referer). Your IP address is counted for this purpose in the service's memory only, never written to disk and never included in the email; the entry is discarded at the latest when the service restarts. So that we can check whether these safeguards work, the service records for each enquiry only the time, the way it was submitted and whether it was sent or discarded, without the IP address, without your details and without the content of the message. The legal basis for these safeguards is our legitimate interest in preventing abusive use (Art. 6 (1) (f) GDPR).

No automated decision-making: automated decision-making including profiling within the meaning of Art. 22 GDPR does not take place, neither in the contact form nor in the online tools.

6. Reproduction of reviews on this website

On our home page we reproduce excerpts of publicly available customer reviews (Google and ProvenExpert), with the first name and the initial of the surname. There is no technical embedding of external services (Google Reviews widget or similar); the content is integrated statically into our page. The interactive ProvenExpert seal is loaded separately, only with your consent (section 7).

Legal basis: Art. 6 (1) (f) GDPR (legitimate interest in informing potential clients about publicly shared client voices). Reviewers who wish to object to reproduction may contact datenschutz@datenschutzfrankfurt.de.

7. ProvenExpert review seal (only with consent)

On our home page we embed a review seal from the service ProvenExpert, operated by Expert Systems AG, Quedlinburger Straße 1, 10589 Berlin. When the page is loaded, only a static preview without any connection to ProvenExpert is shown at first.

Only when you actively click the "Load seal" button is a connection to ProvenExpert servers established and the interactive seal loaded. In doing so, in particular your IP address as well as browser and device information are transmitted to the provider; ProvenExpert may use cookies or comparable storage techniques on your device. Measured on 11 September 2026, no cookie was set, but an entry was written to your browser's session storage. This entry (PE_PRO_SEAL_CACHE) remains until you close the browser tab, including on reload and when switching to the German version; it does not create a new connection to ProvenExpert, which again requires a click (measured on 1 October 2026). Closing the tab deletes it.

Purpose: display of our customer reviews.
Legal basis: Art. 6 (1) (a) GDPR and § 25 (1) TDDDG; you grant consent by clicking.
Withdrawal: your consent applies only to the respective page view. If you reload the page without clicking again, no connection to ProvenExpert is established.
Recipients / third country: Expert Systems AG is based in Germany. The seal files are, however, delivered through a content delivery network operated by Cloudflare, Inc., based in the USA; measured on 11 September 2026, both request hosts resolved to addresses of that provider. When the seal is loaded, services of Google LLC (USA) are also involved; the responses of the seal servers carry a note of Google infrastructure (measured on 5 October 2026). Cloudflare, Inc. and Google LLC are certified under the EU-U.S. Data Privacy Framework; the transfer to the USA takes place on that basis (details in section 11).
Further information: ProvenExpert data protection information.

8. Online tools (GDPR check, imprint checker, AI check, NIS-2 check)

At our tools we provide free self-assessment tools. Processing differs depending on the tool:

  • GDPR check and imprint checker: You enter the address (URL) of a website. Our server retrieves the publicly accessible HTML source of that page and analyses it; for the GDPR check it also retrieves the privacy policy linked there. That retrieval deliberately happens from our server and not from your browser: the operator of the page under review therefore sees our server address, not your IP address. The URL you enter and the analysis result are processed solely for the duration of the request in order to show you the result; the URLs you enter are not stored permanently or logged. Your IP address is processed solely to prevent abusive use (rate limiting over a 60-second window). It is held in memory only, never written to disk and, beyond the server logs described in section 4, never logged; the entry is discarded at the latest when the service restarts. The legal basis is our legitimate interest in providing the service and protecting it against abuse (Art. 6 (1) (f) GDPR). Please do not enter URLs that contain personal data of third parties unless you have a legal basis for doing so.
  • AI check and NIS-2 check: The evaluation runs entirely locally in your browser. Your answers do not leave your device and are transmitted neither to us nor to third parties. Neither tool contains any function that sends data.

These tools provide an automated, non-binding initial assessment and do not replace individual legal advice.

9. Our pages on social networks (Facebook, LinkedIn)

We run a company page on Facebook and on LinkedIn. On this website both are included only as plain links, in the footer of every page and here. As long as you do not click one of these links, no data is transferred to Meta or LinkedIn; we load no scripts, buttons or content from these providers.

If you visit our page on one of these platforms, the provider processes your data under its own terms, even if you are not logged in there. For the page statistics (“Insights”) that the provider makes available to us about our page, we are joint controllers with the provider (Art. 26 GDPR; CJEU, judgment of 5 June 2018, C-210/16). We receive these statistics only in aggregated form and cannot identify individual people in them.

The essence of the agreements (Art. 26(2) GDPR): The provider generates the page statistics from the data of visitors to our page, at LinkedIn in particular from profile information such as job function, country, industry, seniority, company size and employment status. It provides us only with aggregated figures and does not enable us to link them to individual people. The provider bears primary responsibility for this processing, informs the data subjects and answers requests concerning their rights; we forward requests we receive to the provider. The agreements apply to visitors from the European Economic Area and Switzerland.

Cookies on the platforms: When you open our page there, the respective provider stores cookies and similar identifiers on your device or reads them. For anything not strictly necessary for this, the provider asks for your consent through its own consent dialog (Section 25(1) TDDDG, the German Telecommunications Digital Services Data Protection Act); which cookies it classifies as strictly necessary and sets before you choose is decided by the provider. We have no influence on this request or on the cookies set. You can change or withdraw your choice at any time in the provider's cookie settings.

The legal basis for our pages and the page statistics is our legitimate interest in informing people about our company there and getting in touch with prospective clients (Art. 6(1)(f) GDPR). You can exercise your rights (section 12) with us or with the respective provider. Under the agreements, the provider answers requests concerning the page statistics; anything we receive we forward to the provider and support you in the process. For Meta, the agreement names the Irish Data Protection Commission as lead supervisory authority.

Third country: Both providers may transfer data to their parent companies in the USA. Meta Platforms, Inc. and LinkedIn Corporation are certified under the EU-U.S. Data Privacy Framework; the European Commission's adequacy decision applies (Implementing Decision (EU) 2023/1795, Art. 45 GDPR). Date of our check of the certification: 1 October 2026.

10. Recipients / processors

Recipients of your data are the following processors, who act on our behalf and on our instructions (Art. 28 GDPR). We pass on personal data to other parties only if you have consented (section 7), if it is necessary to perform a contract or if there is a legal obligation. Currently engaged:

  • Website hosting and processing of the contact form: Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany. Servers located in Nuremberg, Germany. A data processing agreement under Art. 28 GDPR is in place.
  • Email mailbox and mail delivery, including messages from the contact form: IONOS SE, Elgendorfer Str. 57, 56410 Montabaur, Germany. A data processing agreement under Art. 28 GDPR is in place.

11. Third-country transfer

In regular operation, no personal data is transferred to countries outside the EU/EEA; for visits to our pages on social networks see section 9. The only exception is the „ProvenExpert“ review seal (section 7), when you load it by actively clicking. The seal files are then delivered via the content delivery network of Cloudflare, Inc. (USA). Cloudflare, Inc. is certified under the EU-U.S. Data Privacy Framework; this transfer is therefore covered by the European Commission's adequacy decision (Implementing Decision (EU) 2023/1795 of 10 July 2023, Art. 45 GDPR). The same applies to the services of Google LLC (USA) involved when the seal is loaded; Google LLC is likewise certified under the EU-U.S. Data Privacy Framework. Date of our check of both certifications in the official list of the U.S. Department of Commerce: 8 October 2026 (both „Active“).

12. Your rights

You have the right to:

  • Access to the data stored about you (Art. 15 GDPR)
  • Rectification of inaccurate data (Art. 16 GDPR)
  • Erasure (Art. 17 GDPR)
  • Restriction of processing (Art. 18 GDPR)
  • Data portability (Art. 20 GDPR)
  • Objection to processing (Art. 21 GDPR), see the following section
  • Withdrawal of a consent you have given (Art. 7 (3) GDPR). Withdrawal takes effect for the future; the lawfulness of processing carried out up to that point remains unaffected. This concerns in particular the review seal under section 7.

Your right to object under Art. 21 GDPR

Where we process your data on the basis of our legitimate interest (Art. 6(1)(f) GDPR), that is for the server logs (section 4), abuse protection of the contact form (section 5), the display of reviews (section 6), the online tools (section 8) and our pages on social networks (section 9), you have the right to object to this processing at any time on grounds relating to your particular situation.

If you object, we will no longer process your data for these purposes unless we can demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms, or the processing serves the establishment, exercise or defence of legal claims. You can object informally, for example by email to datenschutz@datenschutzfrankfurt.de.

13. Right to lodge a complaint

You have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR). The authority responsible for us is the

Hessian Commissioner for Data Protection and Freedom of Information (HBDI)
Postfach 3163, 65021 Wiesbaden
datenschutz.hessen.de

14. Changes to this privacy policy

We reserve the right to adapt this privacy policy if the legal framework or our processing activities change. The current version can be accessed on this page at any time.

Version of this policy: 16 October 2026.