Privacy policy

1. Controller

The controller within the meaning of the General Data Protection Regulation (GDPR) is:

Further information can be found in the legal notice. There is no legal obligation to appoint a data protection officer; for all questions about data protection you can reach us directly using the contact details given above.

2. Overview – and what we deliberately do not do

We process personal data only insofar as this is necessary to provide a functional website as well as our content and services. Data minimisation is not a buzzword for us but a technical decision: this website is built from the ground up so that as little data as possible arises from merely reading the pages.

Specifically, we do not use:

• no cookies
• no analytics or tracking tools (e. g. Google Analytics, Matomo, Meta Pixel)
• no external fonts (e. g. Google Fonts) – the site uses exclusively the system fonts that are already present on your device; no font files are loaded at all
• no content delivery networks, no external script or style libraries
• no embedded maps, videos or social media content
• no advertising, no profiling, no disclosure for marketing purposes

When this page is accessed, no connections to third-party servers are therefore established. All content is delivered exclusively from our own infrastructure.

3. Provision of the website

Our web server is deliberately set up so that no access logs (server log files) are stored when this website is accessed – neither the IP address, time of access, page accessed, browser type and version nor the previously visited page (referrer URL) is logged or evaluated. Merely viewing this website leaves no traces with us. Something else applies only if you become active yourself: when clicking the privacy notice (section 4) and when submitting the contact form (section 5).

Technically unavoidable is only that your IP address is processed briefly in the working memory while the page is being accessed – without it the page could not be delivered to you. This processing ends when the connection is closed; it is not stored. The legal basis is Art. 6 (1) (f) GDPR (legitimate interest in the technical delivery of the website).

Only in the event of a serious technical fault (e. g. a server failure) may a technical error log arise briefly, which serves exclusively to remedy the fault (legal basis: Art. 6 (1) (f) GDPR, legitimate interest in functional and secure operation). No evaluation of usage behaviour takes place in the process; such logs are deleted once the fault has been remedied.

4. Privacy notice and proof of your decision

When you visit our website we show a short notice informing you that this website uses no cookies and no tracking tools, and which you can confirm with „Accept“ or „Decline“.

4.1 Record on your device

Your choice is recorded in the local storage of your browser (localStorage) under a single entry so that the notice does not appear every time you visit again. Only the choice made and the time are stored. This is neither a cookie nor a tracking identifier; the entry does not allow recognition across devices or sessions.

The record is valid for three days. After that it expires and the notice is shown to you again. Storing this single setting is necessary in order to provide you with the service you expressly requested – hiding the notice – and is therefore permitted without consent pursuant to § 25 (2) no. 2 TDDDG. You can remove the entry at any time via your browser settings („Delete website data“).

4.2 Proof on our server

So that we can prove your decision, we additionally record it on our own server. Only the following is stored:

Item	Purpose
Date and time of your decision	Proof of when the decision was made
Your choice („Accept“ or „Decline“)	Proof of how the decision was made
Your IP address	Attribution of the decision
Version of the notice text displayed	Proof of which text was agreed to

This entry arises only if you click one of the two buttons – merely viewing the website is still not logged (see section 3).

Storage period: 3 days. Older entries are deleted automatically and completely. The data is stored on our own server in Germany, is not evaluated, is not combined with other data and is not passed on to third parties.

The legal basis is Art. 6 (1) (f) GDPR; our legitimate interest lies in being able to document the decision you made. You can object to this processing pursuant to Art. 21 GDPR – please use the contact details given above.

5. Contacting us (telephone, e-mail, contact form)

If you contact us by telephone or e-mail, the data you provide (including contact details and the content of your enquiry) is stored and processed by us in order to handle your enquiry.

Our contact form on the home page transfers the data entered to our own server in encrypted form (HTTPS). The following is collected:

• Name – mandatory, so that we can address you
• E-mail address – mandatory, so that we can reply to you
• Message – mandatory, the content of your request
• Telephone number – voluntary, only in case a call back is quicker
• a technical subject field that makes it easier to assign your enquiry

Providing the mandatory fields is neither legally nor contractually required. Without them, however, we cannot process or answer your enquiry; you suffer no other disadvantage.

Before sending, you confirm with a checkbox that you agree to your details being processed in order to handle the enquiry. You can withdraw the consent given in this way (Art. 6 (1) (a) GDPR) at any time with effect for the future – an informal message to info@geier-it.eu is sufficient. The lawfulness of the processing carried out up to the withdrawal remains unaffected. If your enquiry is aimed at concluding or performing a contract, Art. 6 (1) (b) GDPR is an additional legal basis; otherwise we base our reply on Art. 6 (1) (f) GDPR (legitimate interest in communicating with prospective and existing customers).

No database, no permanent storage on the web server: the form data is processed on our server exclusively in order to send it immediately as an e-mail to our mailbox info@geier-it.eu and is not stored in a database or file – the processing takes place only briefly in the working memory until the e-mail has been sent.

Spam protection: the form contains an additional field that is invisible to you and is filled in exclusively by automated programs (a so-called honeypot). If it is filled in, we discard the submission. In addition we limit the number of submissions per sender; for this purpose your IP address is processed exclusively and briefly in the working memory and is not stored or logged. Both measures serve solely to prevent misuse and spam (Art. 6 (1) (f) GDPR). An external service such as Google reCAPTCHA is expressly not used.

E-mail dispatch: the actual dispatch takes place via our e-mail provider STRATO AG, Pascalstraße 10, 10587 Berlin, Germany, through which our other business e-mail communication also runs. The provider is contractually bound as a processor pursuant to Art. 28 GDPR; the servers are located in Germany.

We delete your enquiry and the associated correspondence as soon as they are no longer necessary for processing and no statutory retention obligations prevent it – as a rule at the latest six months after the final reply. If an order arises from your enquiry, the commercial and tax retention periods of six and ten years respectively apply (§ 257 HGB, § 147 AO).

6. Download area

Downloading our software is possible without registration, login or provision of personal data. Downloads are neither counted nor logged nor attributed to individual persons.

7. Encrypted chat server (Element/Matrix)

At element.geier-it.eu we operate our own messenger service based on the software Matrix Synapse and the app Element. This service is hosted and administered exclusively by ourselves; no external provider and no processor is involved. The server is located on Geier-IT's own infrastructure in Germany.

Messages and files are transmitted using the end-to-end encryption method of the Matrix protocol (Olm/Megolm). The content of your messages is therefore readable exclusively by the respective participants in the conversation – even we as the operator cannot technically view it.

For the technical operation of a messenger service, certain processing operations are inevitably necessary regardless of the provider, which are not covered by the end-to-end encryption of the message content – for example the account details you provide during registration (user name, e-mail address for account recovery), technical connection data when logging in, as well as metadata of the communication (e. g. who is connected with whom in which chat room and when a message was sent). The legal basis for this is Art. 6 (1) (b) GDPR (provision of the service to registered users) as well as Art. 6 (1) (f) GDPR (legitimate interest in secure, functional operation, e. g. prevention of misuse).

Each account has a storage quota of 10 GB. Messages and sent files are deleted irrevocably and automatically after 30 days.

8. Cloud server (Nextcloud)

At cloud.geier-it.eu we offer our own cloud storage service based on the software Nextcloud. This service too is hosted and administered exclusively by ourselves on Geier-IT's own infrastructure in Germany; no external provider and no processor is involved.

During registration and use we process the account details you provide (e. g. user name, e-mail address) as well as the content you store there (files, documents, photos, passwords, calendar and contact data), exclusively for the purpose of providing you with the storage space you booked and the associated functions. We do not access this content except insofar as this is necessary to remedy a technical fault at your express request.

The legal basis for the processing is Art. 6 (1) (b) GDPR (provision of the booked storage service to registered users) as well as Art. 6 (1) (f) GDPR (legitimate interest in secure, functional operation, e. g. prevention of misuse). Your data and files are deleted when you cancel your account or at the latest after statutory retention obligations have expired.

If you use the cloud storage for your company and store personal data of third parties there, you are the controller within the meaning of the GDPR and we are your processor. In this case we conclude a processing agreement with you pursuant to Art. 28 GDPR.

9. Data protection in our apps and programs

Our applications are governed by their own privacy policies tailored to the respective product. They describe which data is processed on your device and where it is transferred to:

• Privacy policy „FotoCloud“ app
• Privacy policy „Zeit Erfassen“ app
• Privacy policy „Lagerbewegung“ app
• Privacy policy „LV Compass“ app
• Privacy policy „SELFTEST“ app
• Privacy policy „GK-UTM“ program
• Privacy policy „LV Viewer“ and „LV PRO“ programs

This policy concerns exclusively your visit to this website.

10. Link to Instagram and external links

On our website we refer to our Instagram profile with a simple link (instagram.com/geier.it). This is purely a reference – no content from Instagram is embedded in our site and no data is transferred to Instagram when you visit our website. Only when you actively click the link do you leave our website, and the privacy policy of Meta Platforms Ireland Ltd. applies, available at privacycenter.instagram.com/policy.

The same applies to all other external links on this site. The operators of linked third-party websites are solely responsible for their content and data protection.

11. Hosting, encryption and security

This website is operated on Geier-IT's own server infrastructure in Germany. No data is transferred to servers outside the EU/EEA. We deliberately do without external fonts, map services and third-party advertising services.

To protect your data we use technical and organisational measures in line with the state of the art pursuant to Art. 32 GDPR, including:

• Transport encryption: all data traffic runs exclusively via HTTPS (TLS). You can recognise this by the padlock symbol in your browser.
• HSTS: the browser is instructed to access this site only in encrypted form in future, so that unencrypted access does not occur in the first place.
• Protective headers: we set X-Content-Type-Options, X-Frame-Options and a restrictive Referrer-Policy, among others, so that no complete address lines reach third parties when you leave our site.
• Access restriction: access to our systems is limited to a narrowly defined group of people and protected by strong authentication.

12. Recipients, third-country transfer and storage period

Your data is only passed on to third parties if this is necessary for the performance of a contract, you have consented or we are legally obliged to do so. Regular recipients are:

• our e-mail provider STRATO AG as a processor (see section 5)
• where applicable, tax advisors and accounting as well as public authorities within the scope of statutory obligations

A transfer to countries outside the EU/EEA (third countries) does not take place.

We store personal data only for as long as is necessary for the respective purpose or as statutory retention periods require. After that the data is deleted or its processing is restricted.

13. No automated decision-making

Automated decision-making including profiling within the meaning of Art. 22 GDPR does not take place. We do not assess you automatically and do not create user profiles.

14. Your rights as a data subject

Under the GDPR you have the following rights:

• right of access (Art. 15 GDPR)
• right to rectification (Art. 16 GDPR)
• right to erasure (Art. 17 GDPR)
• right to restriction of processing (Art. 18 GDPR)
• right to data portability (Art. 20 GDPR)
• right to object to the processing (Art. 21 GDPR)
• right to withdraw consent with effect for the future (Art. 7 (3) GDPR)

An informal message to info@geier-it.eu is sufficient to exercise these rights. Exercising them is free of charge for you.

You also have a right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR). The authority responsible for us is:

15. Changes to this privacy policy

We reserve the right to adapt this privacy policy so that it always complies with current legal requirements or in order to implement changes to our services. The new privacy policy will then apply to your next visit.

Geier-IT · Last updated: 10 September 2026