Privacy policy

Last updated: 7 October 2026

This English version is a translation provided for convenience. Only the German version is legally binding: Datenschutzerklärung.

1. Controller

Riccardo Nentwich – Digitalisierung & Prozessautomatisierung
Owner: Riccardo Nentwich
Lerchenweg 16, 84478 Waldkraiburg, Germany
Phone: +49 1511 6626978
Email: info@riccardonentwich.com

No data protection officer has been appointed, as there is no legal obligation to do so. If you have any questions about data protection, please contact me directly.

2. Overview

If you only read this website, I process the technical data that every web server receives when a page is accessed (section 3). Only if you consent is web analytics with Google Analytics added (section 4). Without your consent there are no cookies and no analytics tools; there are no marketing tools, social media plug-ins or embedded content from other providers. Fonts, images and scripts are loaded from my own server – except for Google’s scripts, which are only loaded after your consent.

I process further personal data only if you provide it to me yourself: via the form for an initial call, via the form for downloading a tool, or if you contact me by email, phone or WhatsApp. The forms do not store anything in a database. Your details are checked on the server and forwarded to me as an email.

3. Hosting and server log files

The website is hosted by ALL-INKL.COM – Neue Medien Münnich, Hauptstraße 68, 02742 Friedersdorf, Germany. A data processing agreement pursuant to Art. 28 GDPR has been concluded with the host. The connection to the website is encrypted using TLS (recognisable by “https://”).

Each time the website is accessed, the server automatically stores information in log files:

• the full IP address of the requesting device
• date and time of access
• the page or file accessed, the amount of data transferred and the status code
• the previously visited page (referrer), if your browser transmits it
• browser and operating system (user agent)

The purpose is the secure and stable operation of the website, in particular detecting and defending against attacks and misuse, and analysing errors. From the log files, the host also produces a summary access statistic that only I can view in the hosting administration area. It is not combined with other data and is not used for advertising. The legal basis is my legitimate interest in a secure and functioning website (Art. 6(1)(f) GDPR). The log files are deleted after 90 days.

4. Cookies, local storage and web analytics

Without your consent, this website does not set any cookies and does not load services from other providers. Cookies are only set if you consent to web analytics (below).

Light/dark appearance

If you explicitly switch the display to “Light” or “Dark” in the footer of the page, your browser saves this choice in local storage under the name rn-scheme so that it is retained on your next visit. Only the value “light” or “dark” is stored. It is not transmitted to me and contains no personal data. If you select “Automatic” again, the entry is removed; you can also delete it at any time via your browser settings. The storage takes place only at your explicit request and is strictly necessary for this purpose (Section 25(2) no. 2 of the German Telecommunications Digital Services Data Protection Act, TDDDG).

Consent management

On your first visit, a notice appears at the bottom of the page. There you can consent to web analytics (“Accept all”), refuse it (“Necessary only”) or decide individually (“Settings”). Refusing is just as easy as consenting. For this notice I use the open-source software CookieConsent (vanilla-cookieconsent); it is loaded from my own server, and no data is transmitted to other providers in the process.

Your browser saves your decision in local storage under the name rn-consent: the selected categories, a version number of these notices, a random identifier of the decision, and the time and expiry. The entry is not transmitted to me. It is valid for 182 days; after that – or if these notices change significantly – I will ask again. No cookie is set for this. The storage is strictly necessary so that your choice is respected (Section 25(2) no. 2 TDDDG).

The legal basis for this is my obligation to be able to demonstrate that consent was given (Art. 6(1)(c) in conjunction with Art. 7(1) GDPR).

Web analytics with Google Analytics and Google Tag Manager

Only if you consent do I use Google Analytics 4. It shows me which pages and content are used, which paths lead visitors to request an initial call or download a tool, and where they drop off. This helps me improve the website. Google Analytics is integrated via Google Tag Manager, a tool for managing such scripts. Before you consent, neither Google Tag Manager nor Google Analytics is loaded, and nothing is transmitted to Google.

The provider of both services is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland.

Google processes the data on my behalf (Art. 28 GDPR); I have concluded a data processing agreement with Google for this purpose. Insofar as Google uses data for its own purposes, Google is itself responsible for this.

What is collected:

• pages viewed (address and title), the previously visited page, and the time and duration of the visit
• device type, operating system, browser, screen size and language setting
• the approximate location (country, region, city) that Google derives from your IP address. According to Google, IP addresses of visitors from the EU are used for this on servers in the EU and then discarded, not stored.
• a random identifier in a cookie by which repeat visits from the same browser are recognised
• certain actions: clicks on buttons leading to the initial call or to a download (which button), clicks on email, phone and WhatsApp links (only the type of contact channel), downloads (which document, which file format)
• how the forms for the initial call and the download are used: which steps are reached and completed, whether a field was filled in or skipped, which type of input error occurred (for example “required field empty”), how long a step took and whether sending succeeded. In addition, a few predefined selection categories: frequency of the process, desired improvements, company size, how far in the future the selected appointment is (up to 7 days, 8 to 14 days or later), and whether you agreed to be contacted in the download form.

What is not collected: what you enter in the forms is not transmitted to Google – neither name, email address, phone number, company, role or position, nor website addresses, descriptions, messages or other text, nor the date or time of the requested appointment. Likewise, the email address or phone number of a clicked contact link and the address of a download link are not transmitted. Technically, only predefined identifiers and categories can be transmitted.

I do not use data from Google Analytics for advertising. Google Signals and sharing data with other Google products for advertising purposes are disabled; Google Analytics is not linked to Google Ads.

Cookies: after your consent, Google Analytics sets the cookies _ga (distinguishing visitors) and _ga_<ID> (session state), with a lifetime of two years by default according to Google. According to Google, Google Tag Manager itself does not collect information about visitors; Google deletes technical logs of the requests within 14 days.

Recipients and third country: the data is transmitted to Google. Google belongs to a group headquartered in the USA; a transfer to Google LLC in the USA is possible. Google LLC is certified under the EU-US Data Privacy Framework, for which there is an adequacy decision by the European Commission (Art. 45 GDPR). In addition, Google has agreed to the European Commission’s standard contractual clauses (Art. 46(2)(c) GDPR).

Legal basis: your consent (Art. 6(1)(a) GDPR); for storing and accessing information on your device, Section 25(1) TDDDG.

Retention: in Google Analytics, the data is deleted after 14 months. The cookies remain stored until their lifetime expires, unless you withdraw your consent beforehand or delete the cookies in your browser.

Withdrawal: you can withdraw your consent at any time with effect for the future: via “Cookie settings” at the bottom of every page, switch off “Statistics” and save, or choose “Necessary only”. From then on, nothing is transmitted to Google, the Google Analytics cookies are deleted and the page is reloaded. The lawfulness of the processing carried out until the withdrawal remains unaffected.

5. Requesting an initial call

You can request an initial call using the form at /en/initial-call/ (in German: /erstgespraech/).

Which details

Required: a description of the process, the systems involved, the preferred appointment, first name, last name, company and email address. Optional: frequency, people involved, improvement goals, your role, phone number, website, number of employees and a message. Without the required details, I cannot process the request.

What happens to them

Your details are transmitted to the website’s server, checked there and sent as an email via the host’s mail server to my mailbox (Microsoft 365, section 8). You receive a confirmation by email. They are not stored in a database. I confirm the appointment personally; for this I use my calendar and contacts in Microsoft 365 and, for video calls, Microsoft Teams.

If you have consented to web analytics, the way the form is used is analysed – without your entries (section 4).

Protection against misuse

To fend off automated spam requests, the form contains a field that is invisible to humans, a time-limited verification token and a check that the request originates from this website. In addition, the server counts requests per connection: for this purpose, your IP address is stored only as a salted hash value (pseudonymised) and deleted the next time the forms are used after one hour has passed.

Legal basis

The processing serves to take steps prior to entering into a contract (Art. 6(1)(b) GDPR). Where you make the request on behalf of a company you work for, it is based on my legitimate interest in responding to business enquiries (Art. 6(1)(f) GDPR). The protection against misuse is based on my legitimate interest in a secure form (Art. 6(1)(f) GDPR).

6. Downloading tools

I provide tools under /en/insights/ (for example the Process Profile) after a short form. First name, last name, company, position and email address are required.

After submitting the form, you can download the document directly. In addition, you receive the download links by email; they are valid for seven days. I receive an email with your details and can thus see who requested the tool. The protection against misuse is the same as in section 5. If you have consented to web analytics, it is analysed whether the form was used and which document was downloaded – without your entries (section 4).

The legal basis for providing the document is Art. 6(1)(b) GDPR; for the information on who requested the document, it is my legitimate interest in being able to gauge interest in my content (Art. 6(1)(f) GDPR).

Voluntary consent to be contacted

In the form, you can voluntarily tick a box to agree that I may contact you about the topic by email or phone. Only then will I get in touch with you; without the tick, I do not use your details to contact you. The legal basis is your consent (Art. 6(1)(a) GDPR). You can withdraw it at any time with effect for the future, for example by email to info@riccardonentwich.com. The lawfulness of the processing carried out up to that point remains unaffected. Consent is not required for the download.

7. Contact by email, phone and WhatsApp

If you write me an email or call me, I process your details in order to deal with your request (Art. 6(1)(b) or (f) GDPR). Emails arrive in my mailbox at Microsoft 365 (section 8).

There is a link to WhatsApp on the website. Data is transmitted to WhatsApp only when you click on it and write to me. I use the WhatsApp Business app for this. The provider is WhatsApp Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland. WhatsApp processes in particular your phone number, your profile name, message content and metadata, partly under its own responsibility. This may involve a transfer to the USA (section 9). If you do not want this, please use email, phone or the form.

8. Microsoft 365 and video calls

I use Microsoft 365 for email, calendar, contacts, storing enquiries (Excel, OneDrive) and video calls (Microsoft Teams). The contractual partner is Microsoft Ireland Operations Limited, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, D18 P521, Ireland. Microsoft processes the data as a processor on the basis of the Microsoft Products and Services Data Protection Addendum. The EU or Germany has been set as the data storage location.

If we hold an initial call by video, Microsoft Teams processes the data required for it, such as name, email address, audio and video data during the call and technical connection data. The legal basis is Art. 6(1)(b) or (f) GDPR.

9. Recipients and third countries

I do not sell data and do not pass it on for advertising purposes. The only recipients are the service providers named:

• ALL-INKL.COM (hosting, sending the form emails) – processor
• Microsoft (email, calendar, contacts, storage, Teams) – processor
• WhatsApp, only if you contact me via WhatsApp
• Google (web analytics), only with your consent – section 4

Microsoft and WhatsApp belong to groups headquartered in the USA. Access from the USA, for example for support or security purposes, can therefore not be ruled out. Microsoft Corporation and Meta Platforms, Inc. are certified under the EU-US Data Privacy Framework, for which there is an adequacy decision by the European Commission (Art. 45 GDPR). In addition, the contracts provide for standard contractual clauses of the European Commission (Art. 46(2)(c) GDPR).

For Google and a possible transfer to the USA, see section 4.

10. Retention periods

• Server log files: 90 days
• Your decision in consent management: 182 days in your browser’s local storage
• Web analytics: data in Google Analytics 14 months, cookies up to two years (section 4)
• IP hash values of the protection against misuse: one hour; deleted the next time the forms are used after that
• Enquiries and contacts that do not lead to an assignment (form, email, phone, WhatsApp): deleted six months after the last contact
• Details from the download form: deleted six months after the last contact; I document your consent for as long as I am required to be able to prove it
• If an assignment results: the documents become part of my business records and are deleted after the statutory retention periods under German commercial and tax law have expired.

11. Your rights

You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18) and data portability (Art. 20). You can withdraw any consent you have given at any time with effect for the future (Art. 7(3)). An informal message to info@riccardonentwich.com is sufficient. The easiest way to withdraw your consent to web analytics is via “Cookie settings” at the bottom of every page.

Right to object

Where I process data on the basis of my legitimate interest (Art. 6(1)(f) GDPR), you can object at any time on grounds relating to your particular situation (Art. 21 GDPR). I will then no longer process the data, unless there are compelling legitimate grounds, or the processing serves the establishment, exercise or defence of legal claims.

Right to lodge a complaint

You can lodge a complaint with a data protection supervisory authority (Art. 77 GDPR). The authority responsible for me is the Bavarian State Office for Data Protection Supervision (Bayerisches Landesamt für Datenschutzaufsicht, BayLDA), Promenade 18, 91522 Ansbach, Germany, www.lda.bayern.de⁠ (opens in a new window).

12. Other

You are not legally or contractually obliged to provide me with data. There is no automated decision-making, including profiling (Art. 22 GDPR).

Links to other websites, for example to LinkedIn or to sources in articles, are simple references. Only when you click on them do you reach the other website, where its privacy policy applies.

I adapt this policy when the website or the services used change. The version published here at any given time applies.