1. Controller
The controller within the meaning of Article 4 number 7 GDPR is:
Torsten Caspar
c/o Albrecht & Kollegen
Franz-Joseph-Strasse 35
80801 Munich
Germany
Contact via the contact form on this website.
No data protection officer has been appointed. The requirements of Article 37 GDPR and Section 38 BDSG are not met.
2. Overview
This website is a static offering without user accounts, without a login area, without a comment function and without payment processing. Personal data is processed in three contexts: when the pages are technically delivered, as described in section 3, for audience measurement, as described in section 4, and when the contact form is used, as described in sections 5 to 8.
Only two scripts are loaded from third-party servers, both provided by Cloudflare: the audience measurement script described in section 4 and, on the page containing the contact form only, the script protecting against automated access described in section 6. Beyond these, no fonts, maps, videos or other third-party content are loaded. Only system fonts are used for display.
Transmission is encrypted via HTTPS.
3. Hosting and server logs
The website is delivered via Cloudflare Pages. The provider is Cloudflare, Inc., 101 Townsend Street, San Francisco, CA 94107, USA.
No dedicated server is operated. Delivery is static, through the provider's network.
With each page request, the provider processes technically necessary connection data:
- IP address of the requesting device
- date and time of the request
- resource requested
- referrer information, where the browser transmits it
- browser identifier, browser version and operating system
This data is technically necessary for delivery and additionally serves operational security, in particular defence against attacks and overload attempts.
The legal basis is Article 6 paragraph 1 point (f) GDPR. The legitimate interest lies in the secure, stable and efficient provision of the website.
This data is not combined with other data sources. Log retention follows the provider's specifications and is limited in time.
A data processing agreement pursuant to Article 28 GDPR is in place with the provider.
4. Audience measurement with Cloudflare Web Analytics
Cloudflare Web Analytics is used to measure the use of this website. The provider is Cloudflare, Inc., address as stated under section 3.
For this purpose, a script is loaded from static.cloudflareinsights.com when the pages are accessed. The IP address is transmitted to the provider in the course of this.
The service operates without cookies. It does not read information from the end device and does not create a cross-device identifier. Individual visitors are not recognised, and no tracking across different websites takes place.
The following aggregated information is recorded:
- pages accessed
- referrer
- approximate region of origin
- device type and browser
The legal basis is Article 6 paragraph 1 point (f) GDPR. The legitimate interest lies in the statistical evaluation of usage and the improvement of the website.
As no information is stored on or read from the end device, consent under Section 25 TDDDG is not required.
5. Contact form
Process
The details entered in the form are transmitted to an endpoint on the same domain, checked there and then delivered by email to the controller. No storage in a database on the website takes place.
Information collected
Mandatory:
- name
- email address
- description of the enquiry, free text
Optional:
- company or institution
- additional description of the subject matter, free text
The form also contains a field that is invisible to visitors and serves to prevent automated submissions. Its content is neither evaluated nor passed on.
To verify that the submission originates from a human being, the service described under section 6 is used. The sender's IP address is processed in the course of this.
Purpose and legal basis
The information is used exclusively to process and answer the enquiry.
The legal basis is Article 6 paragraph 1 point (b) GDPR where the enquiry is directed at the initiation or performance of a contract, and otherwise Article 6 paragraph 1 point (f) GDPR, with the legitimate interest of responding to enquiries.
Completion of the mandatory fields is necessary in order to process and answer the enquiry. Without this information the form cannot be submitted.
Recipients
Delivery takes place via the dispatch service provider named under section 7 to the mailbox of the controller named under section 8. No further disclosure takes place.
6. Protection against automated access: Cloudflare Turnstile
Cloudflare Turnstile is used to protect the contact form against spam and automated attacks. The provider is Cloudflare, Inc., address as stated under section 3.
The service is loaded exclusively on the page containing the contact form, not on the other pages. A script is retrieved from challenges.cloudflare.com for this purpose. The IP address is transmitted to the provider in the course of this.
The IP address, characteristics of the browser and end device, and interaction patterns are processed. A verification token is generated from this and checked server-side against the provider's interface.
According to the provider, the service operates without cookies. The pre-clearance function is disabled.
The legal basis is Article 6 paragraph 1 point (f) GDPR. The legitimate interest lies in defending the form against spam and automated attacks. Use of the service is necessary in order to operate the form.
7. Email dispatch via Brevo
The Brevo dispatch service is used to deliver the form message to the controller. The provider is Sendinblue SAS, trading under the Brevo brand, 106 boulevard Haussmann, 75008 Paris, France.
All form content is transmitted within the message body, together with the enquirer's email address as the reply address.
The service is used exclusively for the transactional dispatch of a single message. Contact lists, newsletters, campaigns and the measurement of opens or clicks are not used.
A dispatch log is generated at the provider and retained there for a limited period.
The legal basis is Article 6 paragraph 1 point (b) GDPR or Article 6 paragraph 1 point (f) GDPR, in line with section 5. A data processing agreement pursuant to Article 28 GDPR is in place with the provider.
8. Email mailbox
The delivered message arrives in an email mailbox under the domain caspar.consulting. The mailbox is operated via Google Workspace. The contracting party for customers in the European Economic Area is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland.
Further processing takes place within the scope of business correspondence. A data processing agreement pursuant to Article 28 GDPR is in place with the provider.
9. Cookies and local storage
This website does not set any cookies of its own. The browser's local storage is not used.
The provider of the delivery infrastructure may set technically necessary cookies to defend against automated access, in particular the __cf_bm cookie. This serves solely to distinguish between human and automated access and is necessary for secure operation.
No consent banner is used, as only technically necessary cookies within the meaning of Section 25 paragraph 2 number 2 TDDDG are involved, and the other services used neither store nor read information on the end device.
10. Transfers to third countries
Cloudflare, Inc. is based in the United States of America. This concerns the hosting under section 3, the audience measurement under section 4 and the form protection under section 6. Processing in the United States does take place.
The transfer is based on the adequacy decision of the European Commission concerning the EU-US Data Privacy Framework and, in addition, on the standard contractual clauses pursuant to Article 46 paragraph 2 point (c) GDPR, which form part of the data processing agreement with the provider.
Despite these safeguards, it cannot be entirely ruled out that authorities in the United States may access processed data on the basis of United States law. A level of legal protection equivalent in every respect to the European standard is not guaranteed in this regard.
The dispatch service provider under section 7 is based in France and processes the data within the European Union.
For the mailbox under section 8, the contractual terms of Google Ireland Limited apply, including the sub-processors and server locations designated therein.
11. Retention periods
- Website: no storage
- Server logs: limited retention at the provider of the delivery infrastructure
- Audience measurement: aggregated data, retention at the provider
- Dispatch log: limited retention at the dispatch service provider
- Email mailbox: deletion six months after conclusion of the correspondence, provided no contract is concluded. Where a business relationship arises, the retention periods under commercial and tax law apply
12. Links to external offerings
The footer contains a link to a LinkedIn profile. This is a plain hyperlink. No plugins, buttons or embedded content of the provider are integrated. Merely accessing this website does not transmit any data to the provider.
A connection to the provider's servers is established only when the link is clicked, at which point the provider receives the IP address among other data. Sole responsibility for the subsequent processing lies with the provider: LinkedIn Ireland Unlimited Company, Wilton Plaza, Wilton Place, Dublin 2, Ireland. The privacy notice is available at https://www.linkedin.com/legal/privacy-policy.
13. Services not used
The following are not used on this website:
- Google Fonts or other third-party web fonts
- Google Analytics or comparable cookie-based analytics services
- social media plugins
- maps, videos or other embedded third-party content
- advertising and retargeting
- user accounts and login areas
- comment functions
- payment processing
14. Rights of data subjects
Data subjects have the following rights vis-a-vis the controller:
- access to the personal data processed, pursuant to Article 15 GDPR
- rectification of inaccurate data, pursuant to Article 16 GDPR
- erasure, pursuant to Article 17 GDPR
- restriction of processing, pursuant to Article 18 GDPR
- data portability, pursuant to Article 20 GDPR
- objection to processing based on Article 6 paragraph 1 point (f) GDPR, pursuant to Article 21 GDPR
An informal message via the contact form or by post to the address stated above is sufficient to exercise these rights.
15. Right to lodge a complaint with a supervisory authority
Without prejudice to any other remedy, there is a right to lodge a complaint with a data protection supervisory authority pursuant to Article 77 GDPR.
The competent authority is:
Bayerisches Landesamt für Datenschutzaufsicht
Promenade 27
91522 Ansbach
Germany
16. No automated decision-making
Automated decision-making, including profiling, within the meaning of Article 22 GDPR does not take place.
17. Changes to this policy
This policy will be adapted as soon as the technical set-up of the website or the legal situation changes.
Last updated: 26 July 2026
This is a translation provided for convenience. In the event of any discrepancy, the German version prevails.