Privacy policyPrivacy policy

Controller

hey essential GmbH i. G., Brunnenweg 9, 64331 Weiterstadt, Germany. Contact: hello@heyessential.de. Full details are in the imprint.

Access data

When you open a page, your browser transmits technical information that every connection needs: IP address, time, page requested, browser type and operating system. We keep no access log of this and do not analyse it. Short-lived operating messages arise on the server for operation and troubleshooting and are overwritten continuously. The legal basis is Art. 6(1)(f) GDPR, our legitimate interest in secure operation.

Language

This site sets no analytics cookies and uses no advertising services. That is why there is no consent banner.

If you change the language with the switch, a cookie named “lang” remembers your choice for one year. It is created only when you use the switch and is technically necessary for this function (§ 25(2) no. 2 TDDDG). You can delete it in your browser at any time.

Visitor statistics

To understand which content helps you, we count page views with Umami. Umami runs on our own server at Hetzner Online GmbH in Falkenstein, Germany, at stats.heyessential.de, and the data stays with us. Umami sets no cookies and does not store your IP address. So that a visit is not counted twice, it derives an identifier from your IP address and browser details that changes every month.

It records the page you open and its title, the page you came from, country, region and city (derived from the IP address), device type, screen size, language, browser, operating system and clicks on individual buttons. We evaluate this only in aggregate and do not combine it with other data. If your browser has “Do Not Track” switched on, we do not count your visit. The legal basis is Art. 6(1)(f) GDPR, our legitimate interest in improving what we offer.

LinkedIn

We link to our page on LinkedIn. It is a plain link: as long as you do not click it, LinkedIn learns nothing about your visit. If you follow it, LinkedIn’s privacy policy applies there (LinkedIn Ireland Unlimited Company).

Contacting us

If you write to us, we process your details to handle your enquiry. Your message reaches us via Microsoft 365 (Microsoft Ireland Operations Limited). We delete it as soon as the purpose no longer applies and no retention period prevents it. The legal basis is Art. 6(1)(b) GDPR if your enquiry concerns an assignment, otherwise Art. 6(1)(f) GDPR, our legitimate interest in answering enquiries.

Booking a call and the contact form

Through the form on the contact page you send us your name, your email address, your message and, if you like, your company. When you book a call, it is your name, company, email address, the time you chose and, if you like, what the call should be about. We use this information to answer your request or to prepare and hold the call. The legal basis is Art. 6(1)(b) GDPR.

Microsoft Bookings creates the appointment in our Microsoft 365 calendar. We send you the confirmation with the link to the Teams call and a calendar invitation ourselves, from hallo@heyessential.de through Microsoft 365; Bookings does not email you. To change or cancel the appointment, just reply to that email. A request from the form reaches us as an email through Microsoft 365. The provider is Microsoft Ireland Operations Limited; we have a data processing agreement with them under Art. 28 GDPR.

We also store the information in our customer management system. It runs on our own server at Hetzner Online GmbH in Falkenstein, Germany. We delete the information once its purpose has ended and no retention period applies.

Booking and the form set no cookies and load nothing from third-party services. To prevent abuse, the server counts how often something is sent from one IP address. This count exists only in memory, is never stored and expires after 70 minutes at most.

Launch notification and newsletter

On the home page you can sign up so that we let you know when our new website is live and, if you like, for our newsletter with free tips and tricks and news. For this we process your email address and, if you give it, your first name. The legal basis is your consent (Art. 6(1)(a) GDPR), separately for each of the two purposes.

We use double opt-in: you first get an email with a link to confirm. Until that click we store nothing. When you confirm, we store the details in our customer management system (our own server at Hetzner Online GmbH in Falkenstein, Germany) and, as proof, the times you signed up and confirmed, the IP address at each step (for IPv6 only the first part), the language and the wording you agreed to. We send the emails through Microsoft 365 (Microsoft Ireland Operations Limited).

You can withdraw each consent at any time: through the link in every email or with a short message to us. After that we keep the sign-up with the times, the IP address and the wording as proof and note the withdrawal, so that we don’t write to you again. The legal basis for this is our legitimate interest in being able to prove the consent (Art. 6(1)(f) GDPR). We delete sign-ups for the website launch, and contact details created only for them, three months after the launch email.

To prevent abuse, the server also counts how often we write to the same address when you sign up. This count knows the address only as a checksum, exists only in memory and expires after 24 hours and 10 minutes at most.

Your rights

You have the right to access, rectification, erasure, restriction of processing, data portability and objection. You can also lodge a complaint with the supervisory authority responsible for us: Der Hessische Beauftragte für Datenschutz und Informationsfreiheit (Hessian Commissioner for Data Protection and Freedom of Information), Wiesbaden.

Hosting

This site runs on a server of Hetzner Online GmbH in the Falkenstein data centre, Germany. A data processing agreement under Art. 28 GDPR is in place with the provider. Fonts and all other parts of the site come from this server; your browser does not contact any third-party service for them.

Electronic signature

We sign contracts electronically using our own service sign.heyessential.de. It runs on the same server in Falkenstein; the documents do not leave our hands. If you receive a document from us to sign, we process your name, your email address, your signature, the place and the times of opening and signing. To prove that the signature is genuine, the log at the end of the document also records the IP address and the browser used. The legal basis is Art. 6(1)(b) GDPR (contract) and Art. 6(1)(c) GDPR for retention.

We send the invitation and the completed document via Microsoft 365 (Microsoft Ireland Operations Limited). We store the signed document in our Microsoft 365 storage in the EU and keep it for six years (§ 257 HGB, German Commercial Code). The daily backup is stored encrypted with Hetzner Online GmbH in Germany. More about the process is on the page How the electronic signature works (in German).