[ DATENSCHUTZERKLÄRUNG ]

Privacy Policy

Information pursuant to Art. 13 and 14 GDPR · § 25 TDDDG

This site runs lean on purpose. There is no analytics suite, no advertising pixel and no cookie wall, because we do not currently need any of them. What follows is the exact list of what we do collect, why, and who touches it.

01Controller / Verantwortlicher

The controller for the processing described here, within the meaning of Art. 4 (7) GDPR, is:

We are not required to appoint a data protection officer. Privacy questions and requests go to the address above and reach the managing director directly. Full company details are on the Legal Notice.

02How we work with your data

We process personal data only within the General Data Protection Regulation (GDPR), the German Federal Data Protection Act (BDSG) and the German Telecommunications Digital Services Data Protection Act (TDDDG). Three rules govern everything below:

• We collect the minimum a step actually needs. The booking form asks for an email address and nothing else.
• We never sell personal data, and we never pass it to a third party for that third party's own marketing.
• Every provider that touches your data on our behalf does so under a data processing agreement under Art. 28 GDPR.

Terms used here have the meaning given to them in Art. 4 GDPR.

03Server log files

Whenever a page is opened, our hosting provider automatically records the request in server log files. This happens for every website on the internet and cannot be switched off without breaking the site.

Data: IP address, date and time of the request, the page or file requested, HTTP status code, transferred data volume, referring URL, browser type and version, operating system.

Purpose: delivering the site reliably, diagnosing faults, and detecting and defending against attacks.

Legal basis: Art. 6 (1) (f) GDPR. Our legitimate interest is keeping this website available and secure. This data is never merged with other data sources and is never used to identify or profile an individual visitor.

04Hosting

This website is hosted with SiteGround (SiteGround Spain S.L., Madrid, Spain) on servers in the European Union. SiteGround processes only what is needed to serve and secure the site, on our instruction, under a data processing agreement pursuant to Art. 28 GDPR.

Legal basis: Art. 6 (1) (f) GDPR (legitimate interest in a professionally hosted, secure website).

05Web fonts

The typefaces on this site are loaded from two external font services rather than from our own server:

• Fontshare (Indian Type Foundry, India) — Clash Display and General Sans.
• Google Fonts (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland) — JetBrains Mono.

To deliver a font file, your browser has to connect to those services, which means your IP address and technical request data (browser, operating system, referring page) are transmitted to them. Neither service sets cookies on this site and we receive no data back from either of them.

Purpose: a consistent, legible presentation of the site across devices.

Legal basis: Art. 6 (1) (f) GDPR (legitimate interest in a uniform, professional presentation). If you would rather your IP address never reached these providers, you can block third-party font loading in your browser; the site remains fully usable, only the typography changes.

06Cookies and local storage

This site sets no advertising cookies, no analytics cookies and no tracking cookies. There is no Google Analytics, no Google Tag Manager, no Meta pixel and no comparable tool running on these pages, which is why you are not being asked to dismiss a consent banner.

What we do use is your browser's local storage, for three strictly functional purposes:

• ias_lead_email — the email address you typed into the booking form, kept so the calendar step can be prefilled and a half-finished booking is not lost if you reload.
• ias_subscribed — a flag recording that you already subscribed to guide updates, so we stop asking.
• ias_..._pop — a flag recording that you dismissed the subscribe prompt on a guide, so it does not reappear.

These entries stay on your own device, are never transmitted anywhere by themselves, and can be deleted at any time by clearing site data in your browser.

Legal basis: § 25 (2) no. 2 TDDDG — storage that is strictly necessary to provide the service you explicitly requested — together with Art. 6 (1) (f) GDPR.

07Booking a call

The booking flow runs in two steps and processes data at both.

Step one — email opt-in

Data: your email address, plus the page you booked from and any campaign parameters in the link you arrived through (utm_source, utm_medium, utm_campaign, utm_content, utm_term, and click identifiers such as fbclid or gclid).

Purpose: identifying you at the calendar step, being able to follow up if the booking is not completed, and understanding which channel a request came from.

Legal basis: Art. 6 (1) (b) GDPR — steps taken at your request prior to entering into a contract.

Step two — the calendar

The appointment itself is booked in an embedded calendar widget provided by HighLevel (HighLevel Inc., Dallas, Texas, USA), also known as GoHighLevel or LeadConnector. The widget loads only after you complete step one, so nothing is sent to HighLevel until you have chosen to proceed.

Data: name, email address, the slot you select, your time zone, and anything you write into the booking form's message field. HighLevel additionally receives the technical data any embedded content receives, including your IP address.

Purpose: scheduling, confirming and reminding you about the call, and the correspondence around it.

Legal basis: Art. 6 (1) (b) GDPR (performance of pre-contractual steps and the resulting engagement).

Booking data and the leads captured at step one are stored in our database with Supabase (Supabase, Inc., USA) and in our CRM at HighLevel. Both act as processors under Art. 28 GDPR.

08Guide updates by email

Our free guides offer a short subscribe form. If you use it we store your email address and which page you subscribed from, in our Supabase database, and use it only to tell you when a new guide or skill ships.

Legal basis: Art. 6 (1) (a) GDPR (consent), given by submitting the form.

You can withdraw that consent at any time with effect for the future, either by replying to any message we send or by emailing support@iasolutions.agency. Withdrawal does not affect the lawfulness of anything processed before it. We remove the address on request without delay.

The guides themselves are not gated: reading or downloading one does not require an email address.

09Contacting us by email

If you email us, we process your address, your name if you give it, and the content of your message, in order to answer you. Depending on your request the legal basis is Art. 6 (1) (b) GDPR (pre-contractual steps or performance of a contract) or Art. 6 (1) (f) GDPR (our legitimate interest in responding to enquiries). Please note that ordinary email is not an encrypted channel end to end; for anything genuinely confidential, tell us and we will agree a different route.

10Who receives your data

We share personal data only with the providers we need in order to run this site and the service behind it, each under a data processing agreement and only to the extent required:

• SiteGround Spain S.L. (Spain) — website hosting and server logs.
• HighLevel Inc. (USA) — calendar, CRM and the emails around a booked call.
• Supabase, Inc. (USA) — the database holding leads and guide subscribers.
• Google Ireland Limited (Ireland) and Indian Type Foundry (India) — web font delivery, limited to the connection data described in section 05.

Beyond this we disclose data only where we are legally obliged to, for example to a public authority acting on a valid legal basis.

11Transfers outside the EU/EEA

Some of the providers above are established outside the European Economic Area, in particular in the United States. Where a transfer takes place, we rely on the safeguards required by Chapter V GDPR: the European Commission's adequacy decision of 10 July 2023 where a recipient is certified under the EU-US Data Privacy Framework, and otherwise the European Commission's Standard Contractual Clauses together with supplementary technical and organisational measures.

You should be aware that in third countries the level of protection may not match that of the GDPR, and that authorities there may have access rights that cannot be fully excluded by contract. You may request a copy of the safeguards in place at any time.

12How long we keep it

• Server logs: kept for a short period for security and fault analysis, then deleted or anonymised by the host.
• Booking and enquiry data: for the duration of the conversation or engagement, and afterwards for as long as a claim could still arise from it.
• Client records with tax or commercial relevance: for the statutory German retention periods of six or ten years (§ 257 HGB, § 147 AO). Data under retention obligation is blocked from further use rather than deleted early.
• Guide subscribers: until you withdraw consent, after which the address is removed.

13Your rights

In relation to your personal data you have the right to:

• access it and receive a copy (Art. 15 GDPR);
• have inaccurate data corrected (Art. 16 GDPR);
• have it erased (Art. 17 GDPR);
• have its processing restricted (Art. 18 GDPR);
• receive it in a portable, machine-readable format (Art. 20 GDPR);
• object to processing based on legitimate interests, on grounds relating to your particular situation, and to object at any time and without any reason to processing for direct marketing (Art. 21 GDPR);
• withdraw any consent you have given, at any time, with effect for the future (Art. 7 (3) GDPR).

To exercise any of these, write to support@iasolutions.agency. We answer without undue delay and within one month at the latest. We do not use automated decision-making or profiling within the meaning of Art. 22 GDPR.

14Right to lodge a complaint

If you believe we are handling your data unlawfully, you can complain to a supervisory authority — in the member state where you live or work, or where the alleged infringement occurred. The authority responsible for us is:

We would rather hear from you first, though. Most issues are faster to fix directly.

15Data security

This site is served exclusively over TLS-encrypted HTTPS, which you can verify by the lock symbol in your browser's address bar. Beyond that we apply appropriate technical and organisational measures under Art. 32 GDPR to protect your data against manipulation, loss and unauthorised access, including access control on our systems and the principle of least privilege on every provider account. No transmission over the internet can be guaranteed absolutely secure, but the measures we take are reviewed as our systems change.

16Is providing data required?

You are under no statutory or contractual obligation to give us any personal data. The only consequence of not providing it is practical: without an email address we cannot schedule a call with you or send you a guide update.

17Changes to this policy

We update this policy whenever the site or the services behind it change — a new processor, a new form, a tool switched on. The current version always lives at this address and carries its own date, so the version you are reading is the one in force.

Last updated: 7 August 2026 · Legal Notice (Impressum)