Privacy policy

1. Controller

Note on language: This English version is provided for convenience only. In case of any discrepancy, the German version shall prevail.

The controller responsible for data processing on this website within the meaning of the General Data Protection Regulation (GDPR) is:

IT42 GmbH Baumwall 5 20459 Hamburg, Germany Phone: +49 800 20 400 01 Email: info@it42.gmbh

2. Hosting and data processing

This website is operated and delivered via the Onepage platform (onepage.io) of Onepage GmbH, Hanauer Landstraße 172, 60314 Frankfurt am Main, Germany. A data processing agreement pursuant to Art. 28 GDPR is in place with Onepage GmbH. The legal basis is Art. 6(1)(f) GDPR (legitimate interest in the secure and efficient operation of our website).

According to its data processing agreement (version October 2026), Onepage GmbH uses the following sub-processors:

• Amazon Web Services EMEA S.à r.l. – storage and origin servers, AWS region eu-central-1 (Frankfurt am Main)
• Amazon CloudFront (CDN onecdn.io) – delivery of static content, TLS termination and caching via global edge locations, including outside the EU; a transfer to third countries is therefore possible and is based on the EU-U.S. Data Privacy Framework (Art. 45 GDPR) or standard contractual clauses (Art. 46 GDPR)
• Google Cloud EMEA Limited – storage and infrastructure, Ireland; processing is committed to take place exclusively in the EU
• Cloudflare, Inc. (USA) – image optimization and preview images for social networks; transfer based on the EU-U.S. Data Privacy Framework (Art. 45 GDPR); your browser does not connect directly to Cloudflare

3. Server log files

When you visit this website, technically necessary connection data transmitted by your browser is processed. This includes in particular:

• IP address
• Date and time of access
• Referrer URL
• Browser and operating system used
• Page accessed

The legal basis is Art. 6(1)(f) GDPR (legitimate interest in the security and stability of the website). The storage period and scope of logging are determined by the hosting provider as described in section 2.

4. Contact and contact form

If you contact us by email, phone or via the contact form on this website, we process the data you provide (name, company, email address, phone number, message) in order to handle your request and in case of follow-up questions.

Requests submitted via the contact form are stored as contact requests in the CRM of the Onepage platform (see section 2). We store your details only for as long as necessary to handle your request and delete them afterwards, unless statutory retention obligations apply.

The legal basis is Art. 6(1)(b) GDPR (pre-contractual or contractual measures) or Art. 6(1)(f) GDPR (legitimate interest in responding to your request).

5. Appointment booking via Microsoft Bookings

The “Book an intro call” button takes you to a Microsoft Bookings page. By clicking it, you leave our website. We process the data entered there (e.g. name, email address, requested appointment) as controller in order to arrange the appointment with you.

The provider is Microsoft Ireland Operations Limited, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, Ireland. A data processing agreement is in place with Microsoft as part of the Microsoft 365 services. Where data is transferred to the USA, this is based on the EU-U.S. Data Privacy Framework (Art. 45 GDPR). The legal basis is Art. 6(1)(b) GDPR (pre-contractual measures) or Art. 6(1)(f) GDPR (legitimate interest in efficient appointment scheduling).

6. Fonts

This website uses the “Roboto” font. It is delivered via the hosting provider's content delivery network (onecdn.io) and rendered locally in your browser. No data is transmitted to Google Fonts or other font providers.

7. Cookies and consent mechanism

This website does not use tracking or marketing cookies. To store your choice in the cookie banner, the website creates an entry in your browser's storage (localStorage or cookie). This is technically necessary within the meaning of § 25(2) no. 2 TDDDG and contains no personal identifier. Legal basis: Art. 6(1)(f) GDPR (legitimate interest in documenting your choice).

Should content be embedded in the future that triggers further data processing, it will only be loaded after your explicit consent via the cookie banner. The legal basis for this is Art. 6(1)(a) GDPR. You can change or withdraw your choice at any time using the cookie settings button at the bottom right of the page.

8. Your rights as a data subject

You have the right to:

• Access (Art. 15 GDPR)
• Rectification (Art. 16 GDPR)
• Erasure (Art. 17 GDPR)
• Restriction of processing (Art. 18 GDPR)
• Data portability (Art. 20 GDPR)

Right to object pursuant to Art. 21 GDPR

You have the right to object at any time, on grounds relating to your particular situation, to the processing of personal data concerning you which is based on Art. 6(1)(f) GDPR. We will then no longer process the personal data unless we can demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms, or the processing serves the establishment, exercise or defence of legal claims.

You also have the right to lodge a complaint with a data protection supervisory authority. The competent authority is the Hamburg Commissioner for Data Protection and Freedom of Information (HmbBfDI), Ludwig-Erhard-Str. 22, 20459 Hamburg, Germany.

9. Withdrawal of consent

Where the processing of your personal data is based on your consent, you have the right to withdraw your consent at any time. The lawfulness of processing carried out on the basis of the consent until its withdrawal remains unaffected.

10. Changes to this privacy policy

As of: October 2026. Further development of our website or changes in legal requirements may make it necessary to amend this privacy policy. The current version can be accessed on this website at any time.