Privacy Policy

1. Controller

Falko Heinze, Heinze Consulting, Miesbacher Str. 34a, 83620 Feldkirchen-Westerham
Email: info@heinze-consulting.de

2. Hosting (Hetzner)

This website is hosted by Hetzner Online GmbH (Germany). Technically necessary data (e.g. IP address, timestamp, requested resource) is processed in server log files on the basis of Art. 6(1)(f) GDPR. A data processing agreement is in place.

3. Analytics (Plausible)

We use Plausible Analytics for cookieless, privacy-friendly analytics. Plausible sets no cookies and stores no personal data; only aggregated metrics without personal reference are collected. Legal basis: Art. 6(1)(f) GDPR. The provider is Plausible Insights OÜ (Estonia, EU); processing takes place on servers within the EU under a data processing agreement.

4. Forms (Salesforce Web-to-Lead)

Data you submit via our forms (contact, checklist download, registration for webinar/event invitations) — first and last name, email, optionally company, phone and message — is transmitted to our CRM operated by Salesforce, Inc. to handle your request. Legal basis: Art. 6(1)(b) and (f) GDPR, or your consent (Art. 6(1)(a) GDPR) for event registration. Processing takes place on Salesforce's "Hyperforce" infrastructure in a data center in Frankfurt am Main, Germany; a data processing addendum including EU Standard Contractual Clauses is in place. For storage periods see section 9.

To protect against spam, the contact form is secured with Google reCAPTCHA (Google Ireland Ltd.). Technical data (e.g. IP address, browser information, interaction behavior) is transmitted to Google to detect automated input. Legal basis: Art. 6(1)(f) GDPR (protection against abuse). Google's privacy policy and terms apply.

5. Webinar & event invitations

If you register for invitations to webinars and events, we store your details in our CRM (see section 4) and use them solely to send you personal invitations. Legal basis: your consent under Art. 6(1)(a) GDPR; you can withdraw it at any time by emailing info@heinze-consulting.de.

6. Appointment booking (Google)

We use Google Appointment Scheduling (Google Ireland Ltd.). The booking window is implemented as an embedded frame ("iFrame") and is loaded only when you actively click a booking button ("click to load"). The button in the navigation bar merely opens this same window: no Google script is loaded and no data is transmitted to Google when you simply visit the page. Only when you open the booking window is technical data (e.g. IP address) transmitted to Google to display the scheduling calendar. Legal basis: your consent under Art. 6(1)(a) GDPR (actively opening the window) or our legitimate interest in simple, direct scheduling (Art. 6(1)(f) GDPR).

7. Processing within the client relationship

To deliver our advisory services we use carefully selected processors, each under a data processing agreement. Legal basis: performance of a contract (Art. 6(1)(b) GDPR) and our legitimate interest in efficient service delivery (Art. 6(1)(f) GDPR):

• Supabase (Supabase, Inc.) — database/backend service for structured management of project and client data; the hosting we use is located in a data center in Frankfurt am Main, Germany (AWS eu-central-1), under a data processing agreement including EU Standard Contractual Clauses.
• Anthropic (Claude) — AI-assisted processing to analyze and prepare documents in the course of our advisory work (we use the Claude web application and the Claude API by Anthropic PBC); only the data required for the respective task is processed and use for training is contractually excluded. Processing is governed by the Anthropic Data Processing Addendum including EU Standard Contractual Clauses. No data is transmitted to Anthropic when you merely visit this website.
• Google — Google Workspace (email, calendar and appointment scheduling) and reCAPTCHA (see section 4), under the Google Workspace Data Processing Amendment including EU Standard Contractual Clauses.

Client, contract and pricing data are treated as strictly confidential and shared only where necessary to deliver the service or where you have consented.

8. SSL/TLS encryption

This website uses SSL/TLS encryption to protect the transmission of confidential content (e.g. form input) — recognizable by "https://" and the lock icon in your browser.

9. Storage period

Unless a more specific period is stated, personal data remains with us until the purpose of processing no longer applies. If you make a justified deletion request or withdraw consent, your data is deleted unless statutory retention obligations apply.

10. Transfers to third countries

The core data of this website is processed in Germany or the EU (Hetzner hosting in Germany, Salesforce CRM on Hyperforce in Frankfurt, Supabase in Frankfurt, Plausible in the EU). Some processors (in particular Google and Anthropic) are based in or may process data in the USA. Such transfers rely on EU adequacy decisions (in particular the EU-US Data Privacy Framework, under which these providers are certified) or EU Standard Contractual Clauses (Art. 46 GDPR). Please note that governmental access to data stored in the USA cannot be fully excluded under local law.

11. Your rights

You have the rights to access, rectification, erasure, restriction and data portability, and you may withdraw consent at any time with effect for the future. You also have the right to lodge a complaint with a supervisory authority.

Right to object (Art. 21 GDPR): Where we process data on the basis of Art. 6(1)(f) GDPR, you have the right to object at any time on grounds relating to your particular situation. You may object to processing for direct marketing at any time without stating reasons.

Last updated: July 2, 2026