Privacy Policy

Last updated: October 2026

1. Privacy at a Glance

General Information

The following information provides a simple overview of what happens to your personal data when you visit this website. Personal data is any data that can be used to personally identify you. Detailed information can be found in the sections below.

Who is responsible for data collection on this website?

Data processing on this website is carried out by the website operator. You can find the operator's contact details in the section “Responsible Party.”

How do we collect your data?

Some data is collected when you provide it to us, for example via the contact form or by email. Other data is collected automatically by our server when you visit the website. This is primarily technical data (e.g., IP address, browser, operating system, or time of the page view).

What do we use your data for?

We use technical data to provide the website reliably and securely. We use the information from inquiries exclusively to handle your request. We do not use any analytics, tracking, or advertising services, and we do not embed third-party content such as external fonts, videos, or maps.

What rights do you have regarding your data?

You have the right to receive information about the origin, recipient, and purpose of your stored personal data free of charge at any time. You also have the right to request the correction or deletion of this data. If you have given consent to data processing, you can revoke it at any time with effect for the future. You also have the right to request the restriction of the processing of your personal data under certain circumstances. Furthermore, you have the right to lodge a complaint with the competent supervisory authority.

You can contact us at any time regarding this and any other questions about data protection.

2. Hosting and Technical Operation

Hosting

This website is hosted on a server operated by:

netcup GmbH
Daimlerstraße 25
76185 Karlsruhe
Germany

All data generated when you visit the website or use the contact form is processed on this server (in particular IP addresses, server log files, and contact inquiries). We use this provider in the interest of a secure, fast, and efficient provision of our website (Art. 6(1)(f) GDPR) and, with regard to inquiries, to take steps prior to entering into a contract (Art. 6(1)(b) GDPR). Processing is based on a data processing agreement (Art. 28 GDPR); the provider processes the data only according to our instructions.

Content Management System

This website runs on the Kirby content management system. Kirby runs entirely on our own server; no data is transmitted to the developer of Kirby or to any other third party.

Fonts

The font used on this website (Montserrat) is stored locally on our server. No connection to third-party servers, such as Google's, is established when you visit the website.

3. General Information and Mandatory Disclosures

Data Protection

We take the protection of your personal data very seriously and treat it confidentially and in accordance with statutory data protection regulations and this privacy policy.

Please note that data transmitted over the internet (e.g., by email) may be subject to security vulnerabilities. Complete protection of data against access by third parties is not possible.

Responsible Party

The party responsible for data processing on this website is:

Andreas Penzel
Andreas Penzel Consulting
Lehnerstr. 6
85630 Grasbrunn
Germany
Email: info@drxp.de
Phone: +49 15678 512600

The responsible party is the natural or legal person who, alone or jointly with others, determines the purposes and means of processing personal data.

Storage Period

Unless a more specific storage period is stated in this privacy policy, your personal data will remain with us until the purpose for processing no longer applies. If you submit a justified request for deletion or revoke your consent, your data will be deleted unless we have other legally permissible reasons for storing it (e.g., retention periods under tax or commercial law); in that case, the data will be deleted once those reasons no longer apply.

Data Transfers to Third Countries

Personal data is transferred to countries outside the EU/EEA only in connection with the Make service described below. For the USA, the European Commission adopted an adequacy decision (EU-U.S. Data Privacy Framework) on July 10, 2023. Companies certified under this framework ensure an adequate level of data protection.

Revocation of Your Consent to Data Processing

Where data processing is based on your consent, you can revoke it at any time. The lawfulness of the processing carried out before the revocation remains unaffected.

Right to Object to Data Collection in Special Cases and to Direct Marketing (Art. 21 GDPR)

IF DATA PROCESSING IS BASED ON ART. 6(1)(E) OR (F) GDPR, YOU HAVE THE RIGHT AT ANY TIME, ON GROUNDS RELATING TO YOUR PARTICULAR SITUATION, TO OBJECT TO THE PROCESSING OF YOUR PERSONAL DATA; THIS ALSO APPLIES TO PROFILING BASED ON THESE PROVISIONS. THE RESPECTIVE LEGAL BASIS FOR PROCESSING CAN BE FOUND IN THIS PRIVACY POLICY. IF YOU OBJECT, WE WILL NO LONGER PROCESS YOUR AFFECTED PERSONAL DATA UNLESS WE CAN DEMONSTRATE COMPELLING LEGITIMATE GROUNDS FOR THE PROCESSING THAT OVERRIDE YOUR INTERESTS, RIGHTS, AND FREEDOMS, OR THE PROCESSING SERVES THE ESTABLISHMENT, EXERCISE, OR DEFENSE OF LEGAL CLAIMS (OBJECTION PURSUANT TO ART. 21(1) GDPR).

IF YOUR PERSONAL DATA IS PROCESSED FOR DIRECT MARKETING PURPOSES, YOU HAVE THE RIGHT TO OBJECT AT ANY TIME TO THE PROCESSING OF PERSONAL DATA CONCERNING YOU FOR SUCH MARKETING; THIS ALSO APPLIES TO PROFILING TO THE EXTENT THAT IT IS RELATED TO SUCH DIRECT MARKETING. IF YOU OBJECT, YOUR PERSONAL DATA WILL NO LONGER BE USED FOR DIRECT MARKETING PURPOSES (OBJECTION PURSUANT TO ART. 21(2) GDPR).

Right to Lodge a Complaint with the Competent Supervisory Authority

In the event of violations of the GDPR, you have the right to lodge a complaint with a supervisory authority, in particular in the member state of your habitual residence, your place of work, or the place of the alleged violation. This right is without prejudice to any other administrative or judicial remedies. The authority responsible for us is:

Bayerisches Landesamt für Datenschutzaufsicht (BayLDA)
Promenade 18
91522 Ansbach
Germany

Right to Data Portability

You have the right to have data that we process automatically on the basis of your consent or in fulfillment of a contract handed over to you or to a third party in a common, machine-readable format. If you request the direct transfer of the data to another controller, this will only be done to the extent technically feasible.

Information, Correction, and Deletion

Within the scope of the applicable legal provisions, you have the right at any time to free information about your stored personal data, its origin and recipients, and the purpose of the data processing and, where applicable, the right to have this data corrected or deleted. You can contact us at any time regarding this and any other questions about personal data.

Right to Restriction of Processing

You have the right to request the restriction of the processing of your personal data. You can contact us at any time for this purpose. The right to restriction of processing applies in the following cases:

  • If you dispute the accuracy of your personal data stored by us, we usually need time to verify this. For the duration of the review, you have the right to request the restriction of processing.

  • If the processing of your personal data was or is unlawful, you can request the restriction of processing instead of deletion.

  • If we no longer need your personal data, but you need it to exercise, defend, or assert legal claims, you have the right to request the restriction of processing instead of deletion.

  • If you have filed an objection pursuant to Art. 21(1) GDPR, your interests and ours must be weighed. As long as it has not been determined whose interests prevail, you have the right to request the restriction of processing.

If you have restricted the processing of your personal data, this data – apart from its storage – may only be processed with your consent, for the establishment, exercise, or defense of legal claims, for the protection of the rights of another natural or legal person, or for reasons of important public interest of the European Union or a member state.

SSL/TLS Encryption

For security reasons and to protect the transmission of confidential content, such as inquiries sent via the contact form, this website uses SSL/TLS encryption. You can recognize an encrypted connection by the address bar starting with “https://” and the lock icon in your browser. When encryption is active, the data you send to us cannot be read by third parties.

Objection to Unsolicited Promotional Emails

We hereby object to the use of the contact details published as part of our legal notice obligations for sending unsolicited advertising and informational materials. We expressly reserve the right to take legal action in the event of unsolicited promotional information, such as spam emails.

4. Data Collection on This Website

Server Log Files

When you visit the website, our web server automatically collects and stores information transmitted by your browser in so-called server log files. This includes:

  • browser type and version

  • operating system used

  • referrer URL

  • host name or IP address of the accessing computer

  • time of the server request

This data is not combined with other data sources. It is collected on the basis of Art. 6(1)(f) GDPR. We have a legitimate interest in providing our website in a technically error-free and secure manner; to do so, server log files must be recorded.

Cookies

No cookies are set during a normal visit to this website. Only when you use the contact form is a technically necessary session cookie (kirby_session) stored. It is used solely to protect against forged form submissions (CSRF protection) and expires after two hours at the latest.

The cookie is stored on the basis of § 25(2) No. 2 TDDDG (German Telecommunications Digital Services Data Protection Act), as it is strictly necessary for the service you requested (submitting an inquiry); no consent is required. The associated data processing is based on Art. 6(1)(f) GDPR. You can set your browser to notify you when cookies are set or to block them; however, you will then be unable to use the contact form.

Contact Form

When you send us an inquiry via the contact form, we process the data you enter (first name, last name, phone number, email address, optionally company and website, and your message), the page from which you sent the form, and the time of the inquiry. Your inquiry is:

  • stored on our server (see “Hosting”),

  • forwarded to us by email (see “Email Delivery via Zoho”), and

  • transmitted to the automation service Make for further handling in our internal workflows (see “Make”).

Processing is based on Art. 6(1)(b) GDPR if your inquiry relates to the performance of a contract or is necessary to take steps prior to entering into a contract. In all other cases, processing is based on our legitimate interest in effectively handling the inquiries we receive (Art. 6(1)(f) GDPR).

Inquiries stored on our server are automatically deleted no later than six months after receipt. Data that we need beyond that to handle your request (e.g., if it results in an assignment) and statutory retention obligations remain unaffected.

To protect against spam and abuse, the form contains an invisible check field and a minimum completion time. In addition, we store a non-reversible hash of your IP address for a maximum of ten minutes to limit the number of inquiries per sender (Art. 6(1)(f) GDPR; legitimate interest in protection against abusive inquiries).

Inquiries by Email or Phone

If you contact us by email or phone, your inquiry, including all resulting personal data (name, inquiry), will be stored and processed by us for the purpose of handling your request. We do not pass on this data without your consent.

Processing is based on Art. 6(1)(b) GDPR if your inquiry relates to the performance of a contract or is necessary to take steps prior to entering into a contract. In all other cases, processing is based on our legitimate interest in effectively handling the inquiries we receive (Art. 6(1)(f) GDPR).

The data will remain with us until you ask us to delete it or the purpose for storing it no longer applies (e.g., after your request has been completed). Mandatory statutory provisions – in particular retention periods – remain unaffected.

5. Service Providers

Email Delivery via Zoho

We send notifications about incoming contact inquiries via the Zoho Mail email service. The provider is Zoho Corporation B.V., Beneluxlaan 4B, 3527 HT Utrecht, Netherlands. Data is processed in data centers within the EU. Processing is based on a data processing agreement (Art. 28 GDPR) and our legitimate interest in reliable delivery (Art. 6(1)(f) GDPR).

Make

To handle inquiries in our internal workflows, we automatically transmit the data from the contact form to the automation service Make. The provider is Celonis, Inc., USA. Celonis, Inc. is certified under the EU-U.S. Data Privacy Framework; the transfer is based on the European Commission's adequacy decision (Art. 45 GDPR). Processing is based on a data processing agreement (Art. 28 GDPR) and our legitimate interest in handling inquiries efficiently (Art. 6(1)(f) GDPR).

External Links

This website contains links to the websites of our platform partners and other providers. No data is transmitted to these providers when you simply visit our website. Only when you follow a link do the privacy policies of the respective provider apply.