Privacy Policy

Last updated: 30 July 2026

This Privacy Policy explains how we process personal data when you use our website at https://borisconsulting.de. Personal data means any information relating to an identified or identifiable individual.

1. Controller

BORIS Consulting GmbH

Lange Reihe 40

20099 Hamburg

Germany

Managing Director: Boris von Brevern

Telephone: +49 170 2942922

Email: boris@borisconsulting.de

2. General information on data processing

We process personal data only to the extent necessary to provide a functional website, respond to enquiries, provide requested content, arrange appointments and – with your consent – measure reach, advertise and display embedded media.

The relevant legal bases include Article 6(1)(a) GDPR (consent), Article 6(1)(b) GDPR (contract and pre-contractual steps), Article 6(1)(c) GDPR (legal obligation) and Article 6(1)(f) GDPR (legitimate interests). Where information is stored on or accessed from your terminal device, Section 25(1) and (2) of the German Telecommunications Digital Services Data Protection Act (TDDDG) also apply.

3. Hosting and server log files

We host our website with RAIDBOXES GmbH, Hafenstraße 32, 48153 Münster, Germany. RAIDBOXES processes data for us as a processor.

When our website is accessed, technically necessary server log files are generated. These may include the IP address, date and time of the request, requested URL, referrer URL, browser type and version, operating system, user agent, HTTP status code, protocol used and volume of data transferred.

Processing is necessary to provide the website securely, reliably and without errors and to prevent and investigate attacks. The legal basis is Article 6(1)(f) GDPR. Our legitimate interest is the secure and reliable operation of our online service. RAIDBOXES retains server log files for a maximum of seven days and then deletes them, unless longer storage is necessary to investigate a specific security incident.

Further information: RAIDBOXES Privacy Policy

4. WordPress, website security and maintenance

Our website is based on WordPress and uses the Divi Builder Theme. WordPress, the theme and locally operating functional plug-ins run within the hosting environment provided by RAIDBOXES. Under the confirmed configuration, merely visiting the website does not cause these components on their own to establish an additional connection from your browser to WordPress.org, Automattic or Elegant Themes.

To protect the website against attacks and unauthorised login attempts, we use Wordfence Security. Data processed may include your IP address, proxy IP address, URL accessed, HTTP headers, security-relevant request content, time, failed login attempts, usernames entered, lockout information and information about malicious files detected. Processing serves to detect, prevent and investigate attacks. The legal basis is Article 6(1)(f) GDPR; our legitimate interest is the secure operation of our website. Security-related live traffic data is generally retained for no more than 30 days. If a specific security incident occurs, relevant data may be retained longer until the incident has been investigated and for the establishment, exercise or defence of legal claims.

Wordfence is provided by Defiant, Inc., 1700 Westlake Ave N, Suite 200, Seattle, WA 98109, USA. The data described above may be transferred to Defiant in connection with the provision of the plug-in. Defiant makes the European Commission’s Standard Contractual Clauses available for transfers to the United States. Where Wordfence uses cookies for security and authentication purposes, they are necessary for the requested security function; the legal basis is Section 25(2)(2) TDDDG.

For technical troubleshooting of outgoing contact and system emails, we may temporarily use the locally operated WordPress plug-in “Check & Log Email”. The log may contain recipient and sender addresses, subject, time, delivery status, technical error data and, depending on the email, its content. The legal basis is Article 6(1)(f) GDPR; our legitimate interest is resolving specific delivery errors. Logging is disabled outside troubleshooting, and logs are deleted within seven days unless they are still needed to investigate a specific error.

We create backups and temporary migration exports as necessary to secure, maintain and restore the website. They may contain the website database and therefore personal data. Processing is based on Article 6(1)(f) GDPR; our legitimate interest is the availability, integrity and secure maintenance of the website. Temporary migration exports are stored securely and deleted no later than 14 days after maintenance is completed. Rotating hosting backups are overwritten or deleted in accordance with the agreed backup cycles.

Further information: Wordfence Privacy Policy

Further information: Wordfence information on GDPR and Standard Contractual Clauses

5. Cookies and consent management

Our website uses cookies and similar technologies. Strictly necessary cookies are used to provide functions you expressly request, for example to remember your language selection and cookie settings. The legal basis for storing or accessing information is Section 25(2)(2) TDDDG; subsequent processing is based on Article 6(1)(f) GDPR. If the website is temporarily password-protected during maintenance, an additional strictly necessary authentication cookie may be set.

Non-essential statistics and marketing technologies are activated only after you have consented. The legal bases are Section 25(1) TDDDG and Article 6(1)(a) GDPR. You can change or withdraw your choice at any time using the permanent “Cookie Settings” link in the footer. Withdrawal does not affect the lawfulness of processing carried out before withdrawal.

We use Cookiebot by Usercentrics to manage and document consent. The provider is Usercentrics A/S, Havnegade 39, 1058 Copenhagen K, Denmark. The service processes your consent selection, the time of your selection and a consent identifier. The strictly necessary “CookieConsent” cookie generally stores your choice for one year. Processing serves compliance with and proof of our legal obligations and is based on Article 6(1)(c) and Article 6(1)(f) GDPR.

Further information: Cookiebot Privacy Policy

6. Contact and contact form

If you contact us by email, telephone or through the contact form, we process the information you provide. The contact form collects in particular your name, email address and message. The information is transmitted to us through our website and the hosting and email systems used for it. To prevent spam, the forms use only a locally calculated arithmetic task; no connection to Google reCAPTCHA or any other external CAPTCHA provider is established.

Processing is carried out to handle your enquiry and communicate with you. If your enquiry relates to a contract or pre-contractual steps, the legal basis is Article 6(1)(b) GDPR. In other cases, processing is based on Article 6(1)(f) GDPR; our legitimate interest is to respond appropriately to incoming enquiries.

We delete the data once the enquiry has been finally resolved, unless contractual or statutory retention obligations, legitimate documentation interests or the establishment, exercise or defence of legal claims require further storage.

7. White paper download

You can download white papers directly from our website. You do not need to provide your name or email address. The download involves only the technically necessary server log data described in Section 3.

We do not use the download for newsletters, promotional emails or individual follow-up. If we introduce an optional email delivery or lead-capture process in the future, we will first inform you transparently about its purpose, legal basis and retention period and update this Privacy Policy accordingly.

8. Google Tag Manager

We use Google Tag Manager (container ID GTM-5P57QJS), provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. The Tag Manager technically manages the analytics and marketing tags described below. It does not itself create usage profiles intended for us, but it may transmit technical information such as your IP address and browser and device information to Google when loaded.

On our website, the Tag Manager is loaded only after you consent to the “Statistics” or “Marketing” category. The legal bases are Section 25(1) TDDDG and Article 6(1)(a) GDPR. The tags subsequently triggered depend on the category you selected.

9. Google Analytics 4

With your consent to statistics, we use Google Analytics 4, a web analytics service provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (measurement ID G-RRPP0R4MSR).

Google Analytics processes data including pages visited, referrer, date and time, interactions, approximate location, technical device, browser and operating system information and session identifiers. Google technically processes the IP address; it is not logged or made available to us in Google Analytics 4. The data is used to create pseudonymous usage statistics that help us understand and improve the reach and use of our website.

The legal bases are Section 25(1) TDDDG and Article 6(1)(a) GDPR. Under the current cookie configuration, Google Analytics cookies may be stored for up to two years. User-level and event data retention in our Google Analytics property is set to two months. Standard aggregated reports may remain available for longer regardless of this setting.

Google may also process data in the United States and other countries outside the European Economic Area. Please see Section 14 for information on international transfers. You may withdraw your consent at any time through “Cookie Settings”.

Further information: Google Privacy Policy

10. Google Ads conversion tracking

With your consent to marketing, we use Google Ads conversion tracking, provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (conversion ID AW-11550662487). This enables us to measure whether a visit to our website following a click on a Google advertisement leads to a particular action, such as submitting a form.

The service may process Google click identifiers, cookie or local-storage identifiers, IP address, device and browser information, the page visited, the time and type of conversion. Based on the current implementation, we do not use enhanced conversions; in particular, email addresses entered in our forms are not transmitted to Google through this tracking.

The legal bases are Section 25(1) TDDDG and Article 6(1)(a) GDPR. The retention periods for identifiers stored on your device are shown in the dynamic cookie declaration. Google stores reporting and campaign data in accordance with the retention rules applicable to Google Ads; under the current rules, monthly, quarterly and annual reporting data may remain available for up to eleven years. You may withdraw your consent at any time through “Cookie Settings”.

Further information: Google Ads privacy and data use

11. YouTube videos

We embed YouTube videos in privacy-enhanced mode through youtube-nocookie.com. The provider for users in the EEA is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Videos remain blocked until you consent to the “Marketing” category.

Once enabled, a connection to YouTube is established. Data processed may include your IP address, device and browser information, the page visited and information about playback and interaction. If you are signed in to Google, Google may associate this information with your account. Even privacy-enhanced mode does not fully prevent Google from processing data once a video has been enabled. When the YouTube player loads, font files provided by Google (Google Fonts) may also be requested; this involves transmitting your IP address to Google. This connection is likewise established only after you consent to marketing.

The legal bases are Section 25(1) TDDDG and Article 6(1)(a) GDPR. You may withdraw your consent at any time through “Cookie Settings”. The retention periods for cookies and similar technologies are shown in the dynamic cookie declaration.

Further information: Google Privacy Policy

12. Appointment scheduling through Calendly

Our website contains external links to Calendly booking pages. Calendly content is not embedded in our website; a connection to Calendly is established only when you actively click the link. The provider is Calendly, Inc., 115 E Main St., Ste A1B, Buford, GA 30518, USA.

When you make a booking, Calendly processes your name, contact details, selected appointment, time zone, any information you choose to provide and technical data such as your IP address and browser information. The required appointment data is transmitted to us and, where applicable, to the calendar or video-conferencing service connected to Calendly.

Booking data is processed to organise appointments and conduct pre-contractual or contractual communication on the basis of Article 6(1)(b) GDPR. Where no contract is involved, processing is based on Article 6(1)(f) GDPR; our legitimate interest is efficient appointment scheduling. We delete booking data once it is no longer required for appointment handling, further communication or documentation and no statutory retention obligation or legal claim requires further storage.

Calendly also processes data as a service provider in the United States. Calendly states that it relies on the EU-U.S. Data Privacy Framework and Standard Contractual Clauses for international transfers. Calendly’s own cookie and privacy settings also apply on the Calendly website.

Further information: Calendly Privacy Notice

13. External links and social media

Our website contains ordinary external links, including links to LinkedIn and Calendly. Merely visiting our website does not transmit data to those providers through these links. Only when you click a link do you leave our website and your browser establishes a connection to the relevant provider. The provider is generally responsible for the processing carried out there. Please review its privacy notice.

14. Recipients and international transfers

We disclose personal data only where necessary for the purposes described above. Recipients or categories of recipients may include hosting, consent, analytics, advertising, video, appointment, email, calendar, website security, maintenance and technical support providers. We disclose data to public authorities only where required by law.

Google and Calendly services and Wordfence/Defiant may involve processing in the United States or other countries outside the EEA. The European Commission has adopted an adequacy decision for U.S. organisations certified under the EU-U.S. Data Privacy Framework. Google LLC and Calendly state that they are certified under that framework. Wordfence/Defiant makes the European Commission’s Standard Contractual Clauses available. Where an adequacy decision does not apply, Standard Contractual Clauses and, where appropriate, additional safeguards are used. Despite these mechanisms, access by foreign public authorities cannot be completely ruled out in connection with international processing.

Information from Google: Data transfer frameworks

Information from Calendly: Calendly Privacy Notice

15. Retention periods

Unless a specific retention period is stated in this Privacy Policy, we retain personal data only for as long as necessary for the relevant purpose. We then delete it unless statutory retention obligations, legitimate documentation interests or the establishment, exercise or defence of legal claims require continued storage. Consent records are retained for as long as necessary to demonstrate that valid consent was obtained.

16. Your rights

Subject to the applicable legal requirements, you have the following rights in particular:

1. access to personal data we process about you (Article 15 GDPR),
2. rectification of inaccurate data and completion of incomplete data (Article 16 GDPR),
3. erasure of your personal data (Article 17 GDPR),
4. restriction of processing (Article 18 GDPR),
5. data portability where the legal requirements are met (Article 20 GDPR),
6. objection to processing based on Article 6(1)(e) or (f) GDPR (Article 21 GDPR),
7. withdrawal of consent at any time with effect for the future (Article 7(3) GDPR),
8. lodging a complaint with a data protection supervisory authority (Article 77 GDPR).

To exercise your rights, simply contact us at boris@borisconsulting.de.

17. Right to object

Objection: Where we process personal data on the basis of Article 6(1)(f) GDPR, you have the right to object at any time on grounds relating to your particular situation. Where personal data is processed for direct marketing purposes, you may object at any time without stating reasons.

18. Right to lodge a complaint

You may lodge a complaint with any competent data protection supervisory authority. The authority particularly competent for us is:

The Hamburg Commissioner for Data Protection and Freedom of Information

Ludwig-Erhard-Straße 22

20459 Hamburg

Germany

Telephone: +49 40 42854-4040

Email: mailbox@datenschutz.hamburg.de

Website: https://datenschutz-hamburg.de

19. Automated decision-making

We do not make decisions based solely on automated processing that produce legal effects concerning you or similarly significantly affect you. The analytics and advertising services described above may create pseudonymous usage profiles, but we do not use them to make decisions within the meaning of Article 22 GDPR.

20. Data security

We use appropriate technical and organisational measures to protect personal data against loss, misuse and unauthorised access. Our website is transmitted using HTTPS/TLS encryption. However, internet-based data transmission cannot be completely secured against every risk.

21. Updates to this Privacy Policy

We update this Privacy Policy if our website, the services used or the legal requirements change. The current version is available on this website.