Privacy

Last updated: 22 September 2026

This notice explains how ConSec handles personal data when you use this website, contact us or act as a business contact. Personal data is information that identifies you or can be linked to you.

1. Who is responsible

ConSec IT Consulting & Services GmbH
Kapellenstraße 22
82008 Unterhaching, Germany

For privacy questions and requests to exercise your rights, contact Emir Rizvanovic, Managing Director, at info@consec-it.com or at the address above. ConSec has not appointed a data protection officer.

2. Website access and hosting

The local development preview is served from the computer running it. The hosted review version uses Google Firebase App Hosting, with the application backend configured in europe-west4 (Netherlands). Google infrastructure processes technical connection and request information, including IP addresses and request metadata, to deliver pages and support operational logging. The application does not implement visitor analytics or its own visitor access-log database.

This processing supports website delivery, reliability and security, based on our legitimate interest under Article 6(1)(f) GDPR. The backend region does not imply that all Google processing, including content delivery and support, is restricted to the EU.

The Google Cloud Logging _Default bucket is configured with a retention period of 30 days and the location “global”. This retention applies to logs stored in that bucket; it does not define the retention of email correspondence or other Google log buckets. The global log location does not provide an EU-only storage commitment.

3. Cookies, fonts and external content

The website does not set cookies for analytics or advertising. It does not integrate visitor tracking, social-media plugins, external video players or booking services. Fonts, icons and illustrations are delivered with the website itself; viewing them does not require a request to an external font or image provider.

Links to other websites open services with their own privacy notices. Clicking an email link opens your email application; it does not automatically send a message.

4. Contact form

When you submit the form, your name (optional), email address and message are transmitted to our Firebase App Hosting backend and delivered to ConSec through the Gmail API and Google Workspace. We use these details to handle your enquiry on the legal bases described in section 5. You can also contact info@consec-it.com directly.

To limit abuse and duplicate submissions, Google Cloud Firestore stores temporary request identifiers, salted hashes of email addresses and expiry timestamps. Message contents are not stored in Firestore or application logs. These identifiers are scheduled to expire after two days; automatic deletion may occur later. This processing serves our legitimate interest in protecting the service under Article 6(1)(f) GDPR.

Draft storage is off by default. If you select “Remember my draft in this tab”, your name, email address and message are stored in that browser tab's session storage so that you can return to them after navigating or switching languages. This optional storage and the associated processing rely on your consent under § 25(1) TDDDG and Article 6(1)(a) GDPR.

You can withdraw consent by unchecking the option; this deletes the saved draft without clearing the text currently displayed in the form. Otherwise, storage normally ends when the tab's session ends. Browser session-restoration settings can preserve it longer. You can also clear the site's data using your browser settings. Saving a draft alone does not transmit it; submitting the form sends the entered enquiry.

5. Email enquiries and business contacts

When you send us a message, we process your contact details, its contents and any attachments to respond to you and handle your request. Please provide only information needed for your enquiry.

In business relationships, we also process professional contact and organisational details, roles and correspondence supplied by you or your employer. Where necessary, information may also come from public business sources, such as the commercial register. We use it to establish and manage our business relationship, coordinate work and meet legal obligations.

If you personally request a contract or steps towards one, processing is based on Article 6(1)(b) GDPR. For other enquiries and contact persons at business partners, Article 6(1)(f) GDPR applies: our legitimate interest is responding to enquiries and maintaining working business relationships. Processing required by tax, accounting or other legal obligations is based on Article 6(1)(c) GDPR.

Providing contact information is voluntary. Without the information necessary to understand and answer your request, we may be unable to respond or arrange the requested service.

6. Recipients and retention

We use Google Workspace to handle email. Google processes message contents, attachments, sender and recipient details and technical delivery data to provide this service. Google's published EMEA contracting entity is Google Cloud EMEA Limited, 70 Sir John Rogerson’s Quay, Dublin 2, Ireland. Its Cloud Data Processing Addendum describes processing on customers' instructions and the safeguards for international transfers. Processing by Google and its subprocessors may take place outside the European Economic Area, including in the United States. Google's terms provide for an applicable adequacy mechanism or EU standard contractual clauses where required. Information about these safeguards is available through that link or by contacting us; Google's Workspace subprocessor list identifies further recipients and locations.

Ordinary email is not necessarily encrypted end to end. Please agree a suitable transfer method with us before sending confidential or sensitive information.

Access within ConSec is limited to people who need the information for the purposes described. IT and email service providers may process data to support our communications. Authorities, courts or professional advisers may receive information where necessary to fulfil legal duties or establish, exercise or defend legal claims.

We keep enquiries and business contact data for as long as needed to handle the matter or maintain the relevant relationship. Afterwards, we delete it unless a legal retention requirement or the need to establish, exercise or defend a claim requires continued storage. Retention depends on the type of record and the applicable tax, commercial or limitation rules; we restrict further use where retention is required solely for those purposes.

7. Your rights

Subject to the applicable statutory conditions, you may:

  • request access to your personal data and a copy of it (Article 15 GDPR);
  • have inaccurate data corrected and incomplete data completed (Article 16);
  • request erasure (Article 17) or restriction of processing (Article 18);
  • receive data you supplied in a structured, commonly used, machine-readable format, and request transfer to another controller where technically feasible, when automated processing relies on consent or a contract (Article 20);
  • withdraw consent at any time, without affecting the lawfulness of processing before withdrawal (Article 7(3)).

Right to object: Where processing relies on Article 6(1)(f) GDPR, you may object at any time for reasons relating to your particular situation. We will stop that processing unless we demonstrate compelling legitimate grounds overriding your interests, rights and freedoms, or need the data for legal claims. You may object to processing for direct marketing at any time; we will then stop using your data for that purpose (Article 21).

Contact info@consec-it.com to exercise your rights. We may request information necessary to verify your identity. We normally respond within one month; if the GDPR permits an extension, we will explain it within that month.

You may also complain to a supervisory authority, particularly where you live, work or believe an infringement occurred (Article 77). For ConSec in Bavaria, you can contact the Bavarian State Office for Data Protection Supervision (BayLDA).

8. Automated decisions and updates

We do not use this website to make decisions with legal or similarly significant effects solely by automated means, and do not use it for profiling. We update this notice when the website or relevant processing changes.