Thomas Siegbert IT-Security Consultant

Privacy Notice

This English translation is provided for convenience. In the event of discrepancies, the German version is authoritative.

1. Controller

Thomas Siegbert, freelance IT security analyst and IT security consultant, is responsible for data processing on this website.

Contact details and address can be found in the Legal Notice.

The following separate contact option is available for data protection inquiries:

2. General information on data processing

I only process personal data on this website to the extent that this is necessary for the provision of the website, IT security, processing inquiries or fulfilling legal obligations.

Personal data is any information relating to an identified or identifiable natural person. Processing is carried out in particular in accordance with the General Data Protection Regulation (GDPR), the Federal Data Protection Act (BDSG) and, as far as access to end devices is concerned, in accordance with the Telecommunications Digital Services Data Protection Act (TDDDG).

3. Hosting at STRATO

This website is hosted by STRATO AG. STRATO processes data that is technically generated when the website is accessed in order to deliver the website and ensure the secure operation of the hosting infrastructure.

The following data in particular can be processed in server log files:

  • URL or file accessed
  • Date and time of access
  • amount of data transferred
  • HTTP status code
  • Browser type and browser version
  • operating system used
  • Referrer URL
  • Host name or IP address of the accessing system

Processing is based on Article 6(1)(f) GDPR. My legitimate interest is the stable and secure operation of this website, protection against misuse, and the detection and prevention of attacks.

According to STRATO, IP addresses of website visitors are stored in log files for a maximum of seven days to detect and defend against attacks.

A data processing agreement pursuant to Article 28 GDPR is in place with STRATO.

4. SSL or TLS encryption

This website uses SSL or TLS encryption for security reasons. This means that data that you transmit to this website cannot easily be read by third parties.

5. Contact us

If you contact us using the contact form or another contact method provided, I will process the information you provide to process your request and for possible follow-up questions.

The following information in particular can be processed in the contact form:

  • name
  • business email address
  • Companies, if specified
  • Telephone number, if provided
  • selected concern
  • Target system or affected area
  • Occasion and desired period
  • issue-dependent project details, if specified
  • short description of the request
  • technical form and security data

The legal basis is Article 6(1)(b) GDPR where processing is necessary to take steps prior to entering into a contract or to perform a contract. In all other cases, processing is based on Article 6(1)(f) GDPR. My legitimate interest is the handling of business enquiries and transparent communication with prospective clients, customers and business partners.

The data entered in the contact form will not be passed on to third parties without a legal basis. Disclosure may be necessary if this is necessary to process your request, to fulfill legal obligations or to protect legitimate interests.

Inquiry data will be deleted as soon as it is no longer required to process the inquiry and there are no legal retention obligations or legitimate documentation interests.

The information marked as mandatory fields is necessary so that I can assign and answer your request. Without this information, the contact form cannot be sent and your request cannot be processed in this way. All other information is voluntary. Please do not submit any login details, secrets or special categories of personal information via the form if this is not necessary for the request.

6. Technically necessary functions of the contact form

Technically necessary security functions are used for the contact form. This includes, in particular, session data for CSRF protection, a time limit for repeated requests and a hidden form check to detect misuse.

If information is stored or read out in your end device for this purpose, this is done on the basis of Section 25 Paragraph 2 TDDDG because these functions are necessary for the contact form function you expressly request and its secure operation.

The subsequent processing of personal data is based on Art. 6 Para. 1 lit. f GDPR. My legitimate interest lies in the secure operation of the contact form, in protection against automated inquiries, spam, CSRF attacks and other misuse.

7. hCaptcha

hCaptcha is used to protect the contact form from automated requests. The provider is Intuition Machines, Inc., a company based in the USA.

When loading and using the hCaptcha check, technical and usage data may be transmitted to hCaptcha. This may include, in particular, IP address, browser and device information, time of access, referrer information, interaction data and the result of the hCaptcha check. hCaptcha processes this data to check whether the request comes from a human and to prevent misuse.

The legal basis for using hCaptcha is Article 6(1)(f) GDPR. My legitimate interest is protecting the contact form against spam, automated misuse and attacks on its functionality. Where hCaptcha stores or reads technically necessary information on your device, this is based on Section 25(2) TDDDG.

When using hCaptcha, personal data is transmitted to the USA or other third countries. According to the provider, EU standard contractual clauses together with additional data protection guarantees are used for transfers from the European Economic Area. You can request further information about the guarantees used using the contact option for data protection inquiries mentioned above.

The hCaptcha check result transmitted by the browser is only used on the server side to check the specific form request and is not permanently saved by this contact form. The information provided by the provider applies to further processing and storage duration with hCaptcha.

Further information can be found in hCaptcha’s privacy policy.

8. Cookies and similar technologies

This website does not use any analytics, marketing or social media tracking services. A general consent banner is not used. According to the current technical configuration, the storage and access functions used on this website are limited to the security and form functions described below.

Technically necessary cookies or comparable storage mechanisms can be used in connection with the contact form, in particular for session management and securing the form function. The contact form uses a session cookie called ts_contact_session for this purpose. It is limited to the contact form, is not used for analytics or marketing purposes and expires at the end of the browser session.

The legal basis for access to the end device is Section 25 Paragraph 2 TDDDG. The subsequent processing of personal data is based on Art. 6 Para. 1 lit. f GDPR.

This website may contain links to external websites. When you simply visit this website, no data is transferred to external providers. Only when you actively click on an external link do the data protection regulations of the respective provider apply.

10. Recipients of data

Recipients of personal data may be technical service providers who are used for hosting, security or the operation of individual website functions. If service providers process personal data on my behalf, they will be integrated in accordance with Art. 28 GDPR.

Any further disclosure will only take place if it is permitted by law, you have consented or there is a legal obligation.

In particular, STRATO for hosting and email transport as well as Intuition Machines, Inc. for the hCaptcha check are included as technical recipients in the contact form.

11. Storage period

Personal data is only stored for as long as necessary for the respective purposes. They will then be deleted, provided that there are no legal retention requirements, statute of limitations or legitimate documentation interests.

According to the hosting provider, server log files are only stored for a limited time. Further information can be found in the “Hosting at STRATO” section.

For contact inquiries, the storage period also depends on the course of business communication. If a contract is concluded, documents relevant to contract and tax law may be stored for longer due to legal retention requirements. Otherwise, inquiries will be deleted as soon as they have been processed and there are no legal obligations, statute of limitations or legitimate documentation interests conflicting with this.

12. Rights of data subjects

In particular, you have the following rights within the framework of the legal requirements:

  • Right to information in accordance with Art. 15 GDPR
  • Right to rectification in accordance with Art. 16 GDPR
  • Right to deletion in accordance with Art. 17 GDPR
  • Right to restriction of processing in accordance with Art. 18 GDPR
  • Right to data portability in accordance with Art. 20 GDPR
  • Right to object, under Article 21 GDPR, to processing based on Article 6(1)(e) or (f) GDPR
  • Right to revoke consent given with effect for the future in accordance with Art. 7 Para. 3 GDPR
  • Right to complain to a data protection supervisory authority in accordance with Art. 77 GDPR

13. Right to object according to Art. 21 GDPR

Where personal data is processed on the basis of Article 6(1)(f) GDPR, you have the right to object to this processing at any time on grounds relating to your particular situation.

In the event of an objection, the personal data concerned will no longer be processed unless there are compelling legitimate reasons for the processing that outweigh your interests, rights and freedoms, or the processing serves to assert, exercise or defend legal claims.

There is no exclusively automated decision-making, including profiling, within the meaning of Art. 22 GDPR. hCaptcha automatically assesses whether a form request probably comes from a human. If this technical check fails, you can use the separate email address for data protection inquiries or the other contact methods listed in the legal notice.

15. Changes to this Privacy Policy

I reserve the right to adapt this data protection notice if legal, technical or organizational requirements change.

As of July 16, 2026