Last updated: 25 July 2026

This privacy policy explains how personal data is processed when you visit waldbyte.de or contact us. It is based on a technical inventory of the services currently used on the production website.

 

1. Controller

Waldbyte Digital Agentur
Owner: Nayab Noor
Niederwaldstraße 1b
76437 Rastatt
Germany

Phone: +49 176 58824334
Email: info@waldbyte.de

No data protection officer has been appointed because there is currently no legal obligation to appoint one.

 

2. Website delivery and server logs

The website is hosted on a server operated by Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany. Each request requires the web server to process connection data, in particular the IP address, date and time, requested URL, referring page (if transmitted), browser and operating system (user agent), HTTP status and amount of data transferred.

This processing is necessary to deliver the website, maintain stability and security, and identify technical attacks. The legal basis is Article 6(1)(f) GDPR. Our legitimate interest is the secure and reliable operation of the website. Regular access and error logs are normally deleted automatically after 14 days. If a specific security incident occurs, relevant extracts may be retained until the incident has been fully investigated and legal claims have been established, exercised or defended.

Further information: Hetzner privacy policy.

 

3. Contact by email or phone

If you contact us by email or phone, we process the data you provide, normally your name, contact details, the content of your enquiry and related communication data. We use it to handle your enquiry. The legal basis is Article 6(1)(b) GDPR for pre-contractual or contractual communication and otherwise Article 6(1)(f) GDPR, based on our legitimate interest in answering business enquiries.

There is currently no active contact form on the website. Clicking an email link only opens your local email application; the click itself does not send a message or form data to Waldbyte. The website does not store contact-form submissions.

Incoming email to info@waldbyte.de is received and made available in our mailbox by Zoho Mail, Zoho Corporation B.V., Beneluxlaan 4B, 3527 HT Utrecht, the Netherlands. Zoho processes email addresses, header, delivery and log data, message content and attachments. A message remains in the active mailbox in line with our retention rule below. After permanent deletion, Zoho states that data may remain recoverable for up to 30 days; server-side delivery trace data may be retained for up to six months.

TYPO3 is configured to use SMTP2GO / Sand Dune Mail Ltd, 96-106 Manchester Street, Christchurch 8011, New Zealand, for technically generated outgoing email. Sender and recipient addresses, email headers, delivery and technical log data, and message content are processed where necessary for delivery. SMTP2GO states that email headers are normally retained for 35 days; for abuse review, content from a small proportion of messages may also be stored for up to 35 days. According to the provider, personal data from the EEA is stored in the EEA. New Zealand is covered by an adequacy decision of the European Commission under Article 45 GDPR.

We normally delete direct enquiries no later than 12 months after they have been finally handled. If a contract is formed or retention is required by law, relevant documents are kept for the applicable German commercial and tax periods, in particular six years for business correspondence and up to eight or ten years for accounting and tax records.

Further information: Zoho privacy policy, Zoho Mail deletion periods and SMTP2GO privacy policy.

 

4. Appointment booking through Calendly

The contact page links to our external booking page at Calendly, Inc., 115 E Main St., Ste A1B, Buford, GA 30518, USA. Calendly is not embedded on waldbyte.de. A connection to Calendly is made only when you actively open the link.

On the Calendly website, Calendly processes technical access data and cookies. If you book an appointment, the processed data includes your name, email address, time zone, selected appointment and any information you provide voluntarily. Waldbyte receives the booking details to organise the appointment. The legal basis is Article 6(1)(b) GDPR where the booking serves pre-contractual or contractual communication, and otherwise Article 6(1)(f) GDPR based on our legitimate interest in efficient appointment scheduling.

Calendly also processes and stores booking data in the United States. Calendly states that it relies on its EU-US Data Privacy Framework certification and, where necessary, EU Standard Contractual Clauses for transfers. Waldbyte normally deletes routine booking data no later than 12 months after the appointment or final handling; statutory retention duties and the formation of a contract remain unaffected.

Further information: Calendly privacy notice.

 

5. Cookies and consent management

Our consent dialogue distinguishes only between technically necessary functions and optional statistics. We do not use marketing cookies. Google Analytics remains technically blocked before you consent to statistics.

You can change your choice at any time using the “Cookie settings” control at the edge of the page. If you reject statistics or withdraw an earlier consent, Google Analytics is no longer loaded and existing _ga cookies for waldbyte.de are removed. Withdrawal takes effect for the future and does not affect the lawfulness of earlier processing.

 

6. Google Analytics 4

After your explicit consent to statistics, we use Google Analytics 4 with measurement ID G-JER0SPQ2N4. The provider for users in the EEA is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland.

Google Analytics processes, in particular, pages viewed, time and approximate duration, referrer, browser and device information, language, interactions and an approximate region derived from the IP address. Google states that the IP address is used for geolocation and discarded before it is logged. We do not intentionally send names, email addresses or booking data to Google Analytics through this website.

The legal bases are your consent under Article 6(1)(a) GDPR and section 25(1) TDDDG. User- and event-level data in the standard GA4 property is retained for no more than 14 months; a shorter setting may be used. Aggregated standard reports may remain available for longer. Google may process data outside the EEA, particularly in the United States. Google relies, among other mechanisms, on the EU-US Data Privacy Framework and, where necessary, Standard Contractual Clauses.

Further information: Google privacy policy and privacy controls in Google Analytics.

 

7. Technical SEO analysis: Google Search Console and OpenAI API

For technical search engine optimisation, we retrieve performance data for our own website from Google Search Console on the server side. Imported data includes the URL and search query and aggregated metrics such as clicks, impressions, click-through rate and average position for defined periods. This processing does not set additional cookies on your device or cause your browser to make an additional connection to Google when visiting waldbyte.de. Search Console does not provide us with the searcher's IP address or Google account identity. A particular search query may nevertheless contain personal information in an exceptional case.

Selected Search Console metrics, up to eight performance-related search queries per analysed page, publicly visible page content, metadata and technical page characteristics are transmitted through the Responses API to OpenAI Ireland Ltd., 1st Floor, The Liffey Trust Centre, 117-126 Sheriff Street Upper, Dublin 1, D01 YC43, Ireland. OpenAI uses them to draft internal SEO recommendations. Contact enquiries, email content and Calendly booking data are not sent to OpenAI for this purpose. The recommendations are not used to make decisions about website visitors.

The legal basis is Article 6(1)(f) GDPR. Our legitimate interest is measuring and improving the discoverability and technical quality of our website. Imported Search Console source data is retained for no more than 16 months. Derived recommendations and technical audit records are deleted or stripped of specific search queries after no more than 24 months, unless still required for an active measure. The compact AI run history is technically limited to the ten most recent runs.

The OpenAI Responses API currently used stores response application state for at least 30 days by default; under OpenAI's data controls, abuse-monitoring logs may be retained for up to 30 days unless a different contractual data control applies. OpenAI states that API inputs and outputs are not used to train its models by default unless the API customer expressly enables optional data sharing. Where OpenAI processes data outside the EEA, the appropriate safeguards in its data processing addendum apply, in particular adequacy decisions or EU Standard Contractual Clauses.

Further information: Search Console API, OpenAI data controls and OpenAI data processing addendum.

 

8. External links and services not used

Links to external websites create a connection to the respective provider only when you click them. The provider's privacy policy applies to its processing.

Web fonts, stylesheets, scripts and media are delivered from our own server. In particular, we do not load Google Fonts or website resources through an external content delivery network. We also currently use no newsletter tool, other public data-entry or publishing function, CAPTCHA or other external spam-protection service, embedded maps, videos or social-media content, or separate advertising, remarketing or conversion tags. If such a function is introduced in future, we will update this policy and obtain any consent required before it is loaded.

 

9. Recipients and processors

Access is limited to people and service providers who need it for the purposes described above. These include Hetzner (hosting), Zoho Mail and SMTP2GO (email communication), Calendly (appointment scheduling), Google (consent-based web analytics and server-side Search Console) and OpenAI (internal SEO recommendations). Where a provider acts as a processor, processing is governed by an agreement under Article 28 GDPR.

 

10. International data transfers

Zoho, Calendly, Google and OpenAI may process data through affiliates or subprocessors in the United States or other countries outside the EEA; SMTP2GO has its corporate seat in New Zealand. We use services outside the EEA only where the requirements of Articles 44 et seq. GDPR are met, in particular on the basis of an adequacy decision under Article 45 GDPR (such as New Zealand or certified US organisations under the EU-US Data Privacy Framework) or Standard Contractual Clauses under Article 46 GDPR. Despite these safeguards, different public-authority access risks may exist in third countries.

 

11. Retention

The normal periods for each processing activity are stated in the relevant sections. Otherwise, we keep personal data only for as long as necessary for its purpose. We then delete or anonymise it unless a statutory retention duty, an active contract or necessary legal defence requires continued storage.

 

12. Your rights

Subject to the statutory conditions, you have the right of access (Article 15 GDPR), rectification (Article 16), erasure (Article 17), restriction (Article 18), data portability (Article 20) and objection (Article 21). You may withdraw consent at any time with effect for the future (Article 7(3)).

Objection: Where we process data under Article 6(1)(f) GDPR, you may object at any time on grounds relating to your particular situation. You may object to processing for direct marketing at any time without giving specific grounds.

To exercise your rights, email info@waldbyte.de. You may also lodge a complaint with a data protection supervisory authority. The authority responsible for us is the State Commissioner for Data Protection and Freedom of Information Baden-Württemberg, Lautenschlagerstraße 20, 70173 Stuttgart, Germany, email: poststelle@lfdi.bwl.de.

 

13. Automated decisions and changes

We do not make solely automated decisions that have legal or similarly significant effects on website visitors, and we do not carry out personal profiling.

We update this privacy policy when the website, the services used or the law changes. The current version is always available on this page.