Privacy notice

Effective: 4 September 2026

1. Controller

IT Consulting Totzauer, proprietor Matthias Totzauer, An der Zollbrücke 8, 95632 Wunsiedel, Germany. Phone: +49 162 592 2574, email: info@itcst.de.

2. Website delivery and server logs

Technically required connection data are processed when the website is accessed. They may include IP address, time, requested resource, referrer, browser and operating system. Processing serves secure, stable and economical delivery under Art. 6(1)(f) GDPR. Logs are deleted or anonymised when no longer required unless a security incident or legal obligation requires longer retention.

3. Contact by email, telephone and enquiry form

Information is transmitted only when you actively send an email or submit the project enquiry. The shortened form processes name, company, business email, optional phone number, optional engagement reason, message, submission time and a coarse source category from the selected website link. A non-reversible temporary throttling key is derived from the IP address and a server-side secret to limit automated enquiries; it expires after no more than 30 minutes. The form does not create a separate permanent enquiry database. The message is sent to the configured business email address, while technically required server logs remain unaffected.

If a Compliance Navigator result is loaded, stable selection IDs are validated and recalculated server-side. A temporary executive PDF is attached to the business email and deleted immediately after the mail function returns. The customer copy is provided only as a direct download; the website does not send documents to a freely entered address. When the mail function accepts a form for processing, only an aggregate counter by language, offer, urgency and source is increased. This confirms acceptance for processing, not inbox delivery. The statistics contain no name, company, contact detail, message, IP address or unique visitor identifier. Processing is used to answer the enquiry and take pre-contractual steps under Art. 6(1)(b) GDPR and otherwise under Art. 6(1)(f) GDPR. Recipients may include the hosting provider, email provider and technical service providers required to deliver the website and message. Data are erased after the enquiry is concluded unless contractual or statutory retention duties apply.

A configured external scheduling page is not embedded or contacted before a visitor actively follows the clearly marked link. The external provider's privacy information applies after that click.

4. Cookies and local settings

The website is designed without audience analytics, marketing tracking, external fonts or embedded third-party content. The installed CookieYes or Cookie Law Info consent manager is used first to store and later withdraw your privacy choice. Depending on the plugin generation, it sets the technically required cookie cookieyes-consent or the technically required cookies viewed_cookie_policy, CookieLawInfoConsent and cookielawinfo-checkbox-*. They record consent status and selected categories for no more than twelve months so the website can respect the decision without repeating the notice on every visit.

If that external consent manager is temporarily unavailable, the theme uses itcst_privacy_choice as a data-minimising fallback for no more than six months. It stores only the control version, activation of technically necessary functions, disabled optional categories and the selection time. itcst_language_preference stores an expressly selected language for up to twelve months. These functional settings are based on section 25(2)(2) TDDDG and Art. 6(1)(f) GDPR. They can be reviewed or changed at any time through the fixed privacy-settings control, the footer link and browser settings. Google Site Kit analytics, tag-manager, advertising and AdSense tags are technically blocked in this release.

The Decision Navigator stores a timestamped selection locally in itcst_navigator_v1 with 30-day validity. The record contains only stable answer IDs, the current step and configuration version—no contact data or confidential system details. An expired record is discarded on the next visit to the Navigator or contact page; “Start again” clears it immediately. The contact page reads and displays a complete local selection in the browser, and no answer ID is placed in the URL. IDs are transferred only when you actively submit the enquiry form, after which the readable summary is recalculated server-side.

The compact Compliance Navigator initially processes choices only in the current page state. Choosing “Request professional validation” stores stable IDs and a timestamp in itcst_compliance_handoff_v1 in the current tab’s session storage for no more than two hours. No result text or selection ID is placed in the URL. Choosing the PDF download transfers stable IDs to the server for validation and immediate in-memory generation of the executive brief. Submitting an enquiry transfers those IDs with the contact details, recalculates the assessment server-side and attaches a temporary PDF to the business email. The temporary file is deleted immediately after the mail function returns. The Navigator is not used for analytics or profiling.

5. External links and downloads

Simply viewing this website does not transmit data to providers of external links. Data are only sent when you follow such a link. Technically required server logs may arise for downloads.

6. Data security

The website uses encrypted HTTPS. Appropriate technical and organisational measures protect data against loss, manipulation and unauthorised access.

7. Your rights

Subject to statutory requirements, you have rights of access, rectification, erasure, restriction, portability and objection. Contact info@itcst.de.

8. Complaint

You may complain to a data-protection authority. The Bavarian Data Protection Authority is the relevant authority for many private entities based in Bavaria.

9. No automated decision

The Decision Navigator and Compliance Navigator provide non-binding orientation. There is no automated decision with legal or similarly significant effect and no profiling under Art. 22 GDPR. The Compliance Navigator does not replace legal advice, authority guidance, conformity assessment or certification advice.

10. Changes

This notice is updated when services, processing purposes or legal requirements change. Analytics, marketing, appointment-booking, video, map or other external services must not be activated without a renewed technical and legal review and corresponding updates to this notice and the consent controls.