Privacy Policy

Pursuant to Art. 13, 14 GDPR · German Telecommunications-Digital-Services-Data Protection Act (TDDDG) · Last updated: June 2026

Summary: We only collect data that is necessary to operate this website. We do not sell any data. You have the right to access, rectify, erase, and object to your data at any time. Contact: contact@xpert-one.de

1. Controller

XpertOne Security Consulting GmbH
Hohe Bleichen 8, 20354 Hamburg
Phone: +49 (0) 40 320 43 723
Email: contact@xpert-one.de

2. Data Collected and Purposes

2.1 Server Log Files (Netlify Hosting)

When you visit our website, the following data is automatically stored in server log files:

IP address (anonymized after 24 hours)
Date and time of the request
URL accessed
Referrer URL (previous page)
Browser type and version, operating system
HTTP status code

Legal basis: Art. 6 (1)(f) GDPR (legitimate interest — operation and security of the website).
Retention period: 30 days, then automatically deleted.
Processor: Netlify, Inc., 44 Montgomery Street, Suite 300, San Francisco, CA 94104, USA. Netlify is certified under the EU-US Data Privacy Framework.

2.2 Contact Form

When you use our contact form, we process:

Name and email address (required fields)
Company and phone number (optional)
Content of your message

Purpose: Processing your inquiry, contacting you in response.
Legal basis: Art. 6 (1)(b) GDPR (pre-contractual measures) or Art. 6 (1)(f) GDPR.
Processor: Netlify Forms (Netlify, Inc. — see above).
Retention period: 24 months from the last contact, unless a contractual relationship arises.

2.3 Google Analytics 4

This website uses Google Analytics 4 (GA4), a web analytics service provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland.

GA4 uses cookies to analyze your use of the website. The information generated is typically transferred to and stored on a Google server in the USA. We have enabled IP anonymization. Google processes the data on our behalf based on a data processing agreement pursuant to Art. 28 GDPR.

Data processed: Page URLs, referrers, browser type, device category, approximate location (city), session duration, events (clicks, form submissions).

Legal basis: Art. 6 (1)(a) GDPR (consent). GA4 is only activated after you give consent via our cookie banner (CookieYes).

Data transfer to the USA: Google LLC is certified under the EU-US Data Privacy Framework. EU Standard Contractual Clauses (SCCs) additionally apply as the basis for the data transfer.

Objection: You can object to this data collection by:

Declining analytics cookies in our cookie banner
Browser add-on: https://tools.google.com/dlpage/gaoptout
Adjusting your browser settings (blocking cookies)

Google's privacy policy: https://policies.google.com/privacy

2.4 CookieYes (Cookie Consent Banner)

We use CookieYes to manage your cookie consent preferences. CookieYes stores your consent decision in a cookie.

Provider: CookieYes Limited, 3 Warren Yard, Warren Park, Wolverton Mill, Milton Keynes, MK12 5NW, United Kingdom.
Legal basis: Art. 6 (1)(c) GDPR (legal obligation — proof of consent).
Retention period: 12 months.

2.5 Google Maps

Our website embeds Google Maps to display our location. In doing so, data is transmitted to Google Ireland Limited.

Legal basis: Art. 6 (1)(a) GDPR (consent via cookie banner).

3. Cookie Overview

Cookie	Provider	Purpose	Duration	Type
cookieyes-consent	CookieYes	Stores your consent decision	12 months	Necessary
_ga, _ga_*	Google Analytics	Distinguishing users, session analysis	2 years / 24h	Analytics
_gid	Google Analytics	Distinguishing users	24 hours	Analytics

4. Processors (Overview)

Service provider	Location	Purpose	Legal basis for transfer
Netlify, Inc.	USA	Website hosting, contact form	EU-US DPF
Google Ireland Ltd.	Ireland / USA	Analytics 4, Maps	EU-US DPF + SCC
CookieYes Ltd.	United Kingdom	Cookie consent management	UK adequacy decision

5. Your Rights (Art. 15–22 GDPR)

You have the right to:

Access (Art. 15 GDPR) — find out what data we have stored about you
Rectification (Art. 16 GDPR) — correction of inaccurate data
Erasure (Art. 17 GDPR) — right to be forgotten
Restriction of processing (Art. 18 GDPR)
Data portability (Art. 20 GDPR)
Objection (Art. 21 GDPR) — to processing based on legitimate interests
Withdrawal of consent at any time with effect for the future

To exercise your rights, please contact: contact@xpert-one.de

6. Right to Lodge a Complaint with a Supervisory Authority

You have the right to lodge a complaint with the competent data protection supervisory authority. For Hamburg, this is:

The Hamburg Commissioner for Data Protection and Freedom of Information (HmbBfDI)
Ludwig-Erhard-Str. 22, 20459 Hamburg, Germany
Phone: +49 (0) 40 / 4 28 54 - 40 40
Email: mailbox@datenschutz.hamburg.de
Website: www.datenschutz-hamburg.de

7. Data Security

This website is delivered via HTTPS (TLS 1.3). All contact form data is transmitted in encrypted form. Netlify operates ISO 27001-certified data centers.

8. Changes to this Privacy Policy

We reserve the right to update this privacy policy whenever legal requirements or our data processing practices change. The current version is always available on this page. Version date of this document: June 2026.