Privacy Policy

This translation is provided for information only. In case of any discrepancy, the German version prevails.

1. Controller

The controller responsible for data processing on this website is:

We are not legally required to appoint a data protection officer and have not done so. For any data protection questions, please contact us using the details above.

2. Overview

Details are set out in the following sections.

3. Hosting and infrastructure

Our website, the contact form backend, the associated database and our mail server are operated by Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany. The servers are located in Hetzner’s data centre in Helsinki (Finland).

Our calendar and video conferencing system run on Nextcloud (including Nextcloud Talk). Nextcloud is operated by Hetzner as a managed service in its data centre in Falkenstein (Germany) and is available at cloud.selim-it.de.

All locations are within the European Union. We have concluded a data processing agreement with Hetzner pursuant to Art. 28 GDPR. The legal basis is our legitimate interest in reliable and secure operation of the website (Art. 6(1)(f) GDPR).

Fonts, images and scripts of the website are hosted on our own server. Neither Google Fonts nor an external content delivery network is used. The only exceptions are Google Analytics (only with your consent, section 6) and Cloudflare Turnstile in the contact form (section 7). All data is transmitted encrypted (HTTPS).

4. Server log files

Each time the website is accessed, our web server automatically stores the following access data:

• IP address in truncated form (IPv4 without the last octet, IPv6 truncated to the first 64 bits)
• date and time of access
• request method, requested address and HTTP status code
• amount of data transferred
• referring page (referrer), if transmitted
• browser type and operating system (user agent)
• other technical details of the request (e.g. preferred language, duration of the request)

Cookies are not logged. The contact form backend likewise logs only the truncated IP address and no form content.

This data is used to deliver the website, analyse errors and defend against attacks. The legal basis is Art. 6(1)(f) GDPR. Log files are deleted after 14 days. Individual entries are only kept longer where needed to investigate a specific security incident.

5. Consent management (cookie banner)

We use a consent banner developed in-house. No external provider is involved.

Your decision is stored only in your browser, in local storage (localStorage) under the key “selim-it-einwilligung”. If local storage is not available, the decision is kept only for the current session or in the browser’s memory. No cookie is set for this, and your decision is not transmitted to our server. This storage is permitted without consent under Sec. 25(2) no. 2 TDDDG, because we could not otherwise respect your decision.

Your decision applies for 6 months, after which we ask you again. On the legal notice (Impressum) and privacy policy pages, the banner does not open automatically so that you can read this information undisturbed.

We use all other cookies and similar technologies only with your consent (Sec. 25(1) TDDDG). At present this applies exclusively to Google Analytics (section 6). You can change or withdraw your decision at any time via the cookie icon at the bottom left of every page. If you withdraw consent, the Google Analytics cookies are deleted from your browser.

6. Google Analytics 4

If you have given your consent, we use Google Analytics 4, a web analytics service provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (“Google”).

Loaded only after consent. We use Google’s Consent Mode v2 in its basic implementation. Before you consent, no connection whatsoever is made to Google. Only after your consent is the script loaded from www.googletagmanager.com. It runs in a separate background process of the browser (web worker). Google Analytics is never loaded on the page for cancelling an appointment.

Purpose and data. We analyse which content is used in order to improve our services. This includes in particular pages visited, clicks and time spent, the referring page, device category, operating system and browser, and approximate location (country, region). To recognise you across page views, Google Analytics sets the cookies _ga and _ga_<measurement ID> with a lifetime of up to 2 years. These contain a random, pseudonymous identifier.

IP addresses. Google Analytics 4 does not store IP addresses. The IP address is used only briefly to determine approximate location and is then discarded.

Our settings. Google Signals, the User-ID feature and the collection of user-provided data are disabled. Collection of granular location and device data is disabled. There is no link to Google Ads. Sharing of Analytics data with Google for its own purposes (Google products and services, benchmarking) is disabled.

Retention. Event data is deleted automatically in Google Analytics after 14 months.

Data processing agreement. Google processes the data on our behalf. For this purpose we have accepted the Google Ads Data Processing Terms (data processing agreement pursuant to Art. 28 GDPR).

Transfer to the USA. Data may be transferred to Google LLC in the USA. Such transfers are based on the European Commission’s adequacy decision for the EU-U.S. Data Privacy Framework (Art. 45 GDPR), under which Google LLC is certified. In addition, the European Commission’s Standard Contractual Clauses have been agreed (Art. 46(2)(c) GDPR).

Legal basis. Sec. 25(1) TDDDG for setting and reading the cookies; Art. 6(1)(a) GDPR for further processing.

Withdrawal. You can withdraw your consent at any time with effect for the future via the cookie icon at the bottom left. You can also install Google’s browser add-on to opt out: tools.google.com/dlpage/gaoptout. More information: Google Privacy Policy.

7. Spam protection in the contact form

Our own measures. Without involving third parties, we protect the form with a check field invisible to humans, a minimum completion time and a limit on the number of enquiries per IP address. The counters required for this are kept only in the server’s memory and are not stored permanently.

Cloudflare Turnstile. In addition, we use Cloudflare Turnstile, provided by Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107, USA. The Turnstile widget is loaded from challenges.cloudflare.com, and only once you reach the last step of the form. Cloudflare processes in particular your IP address, browser and device information (user agent, technical connection characteristics) and signals of your interaction with the widget. After you submit the form, our backend verifies the result server-side with Cloudflare, transmitting the verification token and your IP address. According to Cloudflare, Turnstile does not set cookies and is not used for advertising.

Cloudflare’s role. Cloudflare processes this data on our behalf under a data processing agreement. Cloudflare also processes the data as an independent controller to improve its bot detection. Details, including retention at Cloudflare: Turnstile Privacy Addendum.

Transfer to the USA. Cloudflare, Inc. is certified under the EU-U.S. Data Privacy Framework (Art. 45 GDPR). In addition, the Standard Contractual Clauses in Cloudflare’s data processing agreement apply (Art. 46(2)(c) GDPR).

Legal basis. Our legitimate interest in protecting our systems against spam and abuse (Art. 6(1)(f) GDPR). Accessing information on your device is strictly necessary under Sec. 25(2) no. 2 TDDDG to provide the form you are using securely. If you prefer to avoid Turnstile, you can contact us directly by email or phone at any time.

8. Contact form

Our contact form has four steps. We process the following information:

• selected areas and services, urgency and company size
• your message (optional)
• first name, last name and email address (mandatory)
• company and phone number (optional)
• technically: the page from which you opened the form

Storage and delivery. Your enquiry is stored in a database on our server, together with the time of receipt and your full IP address. We store the IP address in order to detect and prevent spam and abuse. Your enquiry is forwarded by email to our team via our own mail server. You receive a confirmation of receipt with a reference number.

Fallback email delivery. If our own mail server fails, we send alerts to our team and, where applicable, emails to you via the delivery service of Brevo GmbH, Köpenicker Str. 126, 10179 Berlin, Germany. A data processing agreement pursuant to Art. 28 GDPR is in place with Brevo.

Legal basis. Art. 6(1)(b) GDPR if your enquiry relates to a contract or pre-contractual measures. In all other cases, and for storing the IP address, our legitimate interest in handling enquiries and preventing abuse (Art. 6(1)(f) GDPR).

Retention. Enquiries are deleted automatically 6 months after receipt. Deletion is checked daily, and the data is overwritten in the database file. Backups of the database may still contain deleted enquiries until the retention period of the respective backup expires. If a contract is concluded, we keep the required information in our business records for the statutory periods: business correspondence 6 years, invoices and accounting records 8 years (Sec. 257 HGB, Sec. 147 AO).

There are no file uploads and no downloads on our website.

9. Appointment booking and video call

After submitting your enquiry, you can optionally book a free initial consultation.

Available times. Our backend reads available times from our Nextcloud calendar via CalDAV. No personal data is transmitted in the process.

Booking. When you book an appointment, we create an entry in our Nextcloud calendar titled “Erstgespräch: first name last name (company)”. The description of the entry contains all information from your enquiry. In addition, a meeting room bearing your name is created automatically in Nextcloud Talk. The room is password-protected and has a lobby that opens 10 minutes before the appointment. Our team members (administrators of our Nextcloud) are moderators of the room and can see it.

Emails. You receive a confirmation with the link to the meeting room, the password and a cancellation link. Our team receives an internal notification.

Cancellation. The cancellation link takes you to a separate page where you can cancel the appointment with one click up to the start of the appointment. The calendar entry and meeting room are then deleted, and both you and our team receive a confirmation. The page keeps the cancellation key only for the open browser tab (sessionStorage). It is never stored in cookies or server log files. Google Analytics is never loaded on this page.

Video call. When you join, technical connection data including your IP address is processed. The connection is established via relay servers (STUN/TURN) operated by Hetzner. When entering the room, participants enter a display name and can write chat messages. Both are deleted together with the room one week after the appointment. We do not use external services such as Zoom, Microsoft Teams or Google Meet.

Legal basis. Art. 6(1)(b) GDPR.

Retention. The meeting room is deleted one week after the appointment. The calendar entry is deleted together with your enquiry 6 months after its receipt. Deleted calendar entries remain in the Nextcloud trash bin for up to 30 days.

10. Links and images

Our website links to our LinkedIn profile and, in the image credits, to Storyset. These are simple links, not embedded content. No data is transferred to these providers until you click a link. All images, including the photo in the contact section, are hosted on our own server. The contact section contains only links to call us or write us an email.

We do not embed maps, videos or other third-party content (iframes).

11. No AI and no automated decisions

We do not use any AI systems on this website; in particular, there is no chatbot. We do not create profiles or make automated individual decisions within the meaning of Art. 22 GDPR.

12. Our customers’ data (processing on behalf)

As part of our services for customers (including managed IT support, server management, Microsoft 365, data backup, email security, process automation and AI communication solutions), we process personal data on behalf of our customers. Each case is governed by a data processing agreement pursuant to Art. 28 GDPR. The customer is the controller in these cases. Data subjects should contact the customer directly. This privacy policy does not apply to such processing. The sub-processors used are listed in the respective data processing agreement.

13. Recipients

Data processed via this website is disclosed only to:

• Hetzner Online GmbH (hosting, Nextcloud)
• Google (only with your consent, section 6)
• Cloudflare, Inc. (spam protection, section 7)
• Brevo GmbH (only if our mail server fails, section 8)

Beyond this, we disclose data only to public authorities where we are legally obliged to do so. We do not sell data.

14. Obligation to provide data

You are not obliged to provide us with personal data. Without the mandatory fields in the form, however, we cannot process your enquiry.

15. Your rights

You have the right to:

• access your stored data (Art. 15 GDPR)
• rectification of inaccurate data (Art. 16 GDPR)
• erasure (Art. 17 GDPR)
• restriction of processing (Art. 18 GDPR)
• data portability (Art. 20 GDPR)
• withdraw any consent given, with effect for the future (Art. 7(3) GDPR)

An informal message to info@selim-it.de is sufficient.

You also have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR). The authority responsible for us is the Hessian Commissioner for Data Protection and Freedom of Information (Der Hessische Beauftragte für Datenschutz und Informationsfreiheit), Postfach 3163, 65021 Wiesbaden, Germany, datenschutz.hessen.de.

16. Right to object (Art. 21 GDPR)

Where we process your data on the basis of legitimate interests (Art. 6(1)(f) GDPR), you have the right to object to this processing at any time on grounds relating to your particular situation. We will then no longer process your data unless we can demonstrate compelling legitimate grounds that override your interests, or the processing serves the establishment, exercise or defence of legal claims. Please send your objection to info@selim-it.de.

17. Changes

We update this privacy policy when our website or the services we use change. The version published here applies.

Last updated: October 2026