What this website does with your data

The essentials

So that you do not have to read the whole policy to learn what matters:

• This website sets no cookies and therefore needs no cookie banner.
• No analytics services, advertising networks or social media components are embedded.
• Fonts, images and scripts are loaded exclusively from our own server. Your browser makes not a single request to any third party while visiting this site.
• The AI Readiness Check evaluates your answers entirely within your browser. The answers are neither transmitted nor stored.
• We receive personal data only if you write to us yourself — via the contact form, by email or by telephone.

Controller

The controller for data processing on this website within the meaning of the General Data Protection Regulation is:

Concept4IT Consulting GmbH, Gustav-Freytag-Straße 36, 60320 Frankfurt am Main, Germany

Represented by Managing Director Doron Marcu

Phone: +49 (0)69 95 63 57 68 · Email: kontakt@concept4it.de

We have not appointed a data protection officer, as the statutory conditions for doing so are not met. Please address questions about data protection to the above.

Visiting the site: server logs

When you access this website, your browser transmits technically necessary information to our server, which records it in log files. This is the case for every website and cannot be avoided technically.

Recorded are: the address requested, date and time, the volume of data transferred, the message on whether retrieval succeeded, the referring page, browser type and version, the operating system and the IP address.

The legal basis is Art. 6(1)(f) GDPR. Our legitimate interest lies in technically faultless operation, the security of our systems and the prevention of attacks.

Logs are deleted after seven days at the latest, unless they are required to investigate a specific security incident. This data is not combined with other sources.

Audience measurement

To measure reach we use only statistics that our hosting provider generates from the server logs that arise in any case. No tracking pixel, no script in the browser and no cookie is involved, and no data is transmitted to third parties.

This tells us which pages are requested how often — not what individual people do. No consent is required, because nothing is stored on or read from your device.

We deliberately do without Google Analytics, Matomo and comparable tools.

The AI Readiness Check

The AI Check on this website is deliberately built so that no processing of personal data takes place.

Your answers remain in your browser’s memory for as long as the page is open. The evaluation, the scoring and the recommendation are calculated on your device. Neither cookies nor your browser’s local storage are used. As soon as you close or reload the page, the answers are gone.

This is not an incidental property but an undertaking. The answers describe the state of your company’s IT — information that is nobody else’s business unless you pass it on yourself. At this stage it is therefore not transmitted at all.

If at the end you request the detailed report as a PDF, you deliberately transmit your contact details in a separate step. Only then, and only with your express consent, are your score and your category results transmitted to us together with those details. Without that step, nothing leaves your browser.

Contact form, email and telephone

If you reach us via the contact form, by email or by telephone, we process the details you provide in order to handle your enquiry.

Mandatory fields in the form are name, email address and your enquiry. All other fields are optional; they merely help us answer more precisely.

Details from the form are not stored in a database but sent solely as an email to a fixed address within our company.

If you request the AI Check report, our server generates a PDF from it immediately and sends it to your address; the same file goes to us so that we know what you received. The report is not stored while it is produced — it exists in memory and afterwards only in the two emails. Your answers are likewise not retained for the calculation.

The legal basis is Art. 6(1)(b) GDPR where your enquiry is directed at concluding a contract, and otherwise Art. 6(1)(f) GDPR on the basis of our legitimate interest in answering enquiries. Where you have given consent, Art. 6(1)(a) GDPR applies in addition; you may withdraw that consent at any time with effect for the future.

We delete the details once your enquiry has been dealt with conclusively and no statutory retention periods apply. Commercial correspondence is subject to retention periods of six and ten years respectively under German commercial and tax law.

Protection against abusive submissions

To fend off automated submissions, the form contains a field invisible to humans, and the server checks how much time passed between the page being loaded and the form being sent. In addition we limit the number of submissions per IP address within a time window; for this, only a non-reversible hash of the IP address is retained, for a maximum of one hour.

If you request the detailed report on the AI Check, we additionally record how many times this has been done from your email address. From the third request onwards you receive the offer of a personal conversation instead of another report — the twelve questions are the same, so a further report would tell you nothing new. Your address itself is not stored for this: what is kept is a counter and a check value calculated from your address using a secret key held only on our server, which cannot be reversed without that key. The entry lapses after twelve months without a further request. The basis is our legitimate interest in a functioning service under Art. 6(1)(f) GDPR.

Before sending, your browser additionally solves a small computational task. No data is transmitted, nothing is stored on your device and no third-party service is involved — the task is derived solely from your own input and the time of day. For you it takes about a second; for sending thousands of messages automatically it becomes uneconomical. If JavaScript is not active in your browser, the task is skipped and your message is still accepted.

We do not accept messages containing links to external sites through the form. You will be told so and can write to us directly instead.

We deliberately do not use a CAPTCHA. It would be a request to a third-party provider and a genuine obstacle for some people. The three measures above achieve the same without requiring you to do or permit anything.

Hosting

This website is operated at Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany. The server is located in Germany.

A data processing agreement under Art. 28 GDPR is in place with the hosting provider. The provider processes the log data named above exclusively on our instructions.

No disclosure, no third countries, no automated decisions

We do not pass your data to third parties unless we are legally obliged to do so.

No transfer takes place to countries outside the European Union.

No automated decision-making, including profiling, within the meaning of Art. 22 GDPR takes place. The evaluation in the AI Check is not such a decision either: it runs on your device, concerns your company rather than you as a person, and has no legal effect whatsoever.

Your rights

You have the following rights towards us at any time regarding your personal data:

• Access to whether and which data we process (Art. 15 GDPR)
• Rectification of inaccurate data (Art. 16 GDPR)
• Erasure (Art. 17 GDPR)
• Restriction of processing (Art. 18 GDPR)
• Data portability (Art. 20 GDPR)
• Withdrawal of consent given, with effect for the future (Art. 7(3) GDPR)

Your right to object

You have the right to object at any time to the processing of personal data concerning you where that processing is based on a legitimate interest under Art. 6(1)(f) GDPR. On this website that covers the evaluation of server logs and the handling of enquiries not directed at concluding a contract.

If you object, we will no longer process the data concerned — unless we can demonstrate compelling legitimate grounds that override your interests, or the processing serves to establish, exercise or defend legal claims.

An informal message to the address above is sufficient. It costs nothing and needs no justification.

Right to lodge a complaint

Irrespective of the above, you have the right to lodge a complaint with a supervisory authority, in particular in the Member State of your residence, your place of work or the place of the alleged infringement.

The authority responsible for us is: Der Hessische Beauftragte für Datenschutz und Informationsfreiheit, Gustav-Stresemann-Ring 1, 65189 Wiesbaden, Germany.

Changes to this policy

We update this privacy policy whenever the processing changes — for instance when a new function is added. The version available here applies in each case.

As at: August 2026