Privacy Policy

1. Data Controller

Mario Lohe
c/o GAM
Pappelallee 64
10437 Berlin
Email: [email protected]
Phone: +49 152 396 008 57

This is a volunteer knowledge project. The appointment of a data protection officer is not required. For privacy questions, please contact the address above.

2. General Information on Data Processing

I only process personal data insofar as it is necessary to provide a functional website and my content and services. Processing is based on Art. 6(1) GDPR. Data is only shared with third parties as described in this policy.

3. Hosting

This website is hosted by dashserv, a service of Felix Gassan (Realtox Media), Talweg 4s, 21149 Hamburg, Germany. The server is located in a data centre in Düsseldorf, Germany. When visiting the website, information is automatically stored in server log files (IP address, browser type, access time). This data is required for technical operation and is automatically deleted after 7 days. Legal basis: Art. 6(1)(f) GDPR (legitimate interest in technical provision).

Delivery via Cloudflare: The website cannot be reached directly from the internet. All requests pass through the network of Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107, USA, and are forwarded from there to my server via an encrypted tunnel connection (Cloudflare Tunnel). In the process, Cloudflare processes your IP address, the requested address, the time of the request, details about your browser and device, and the content transferred between your browser and the website, for example form entries and cookies. Cloudflare acts as a processor pursuant to Art. 28 GDPR on the basis of its Data Processing Addendum. The legal basis is my legitimate interest in providing the website securely and reliably without exposing the server directly to the internet (Art. 6(1)(f) GDPR). Cloudflare operates a global network; processing in the USA is possible, see Section 14 (Third-country transfers).

4. Emailing me

If you write to me at [email protected], I process your email address, your name if you give it, and the content of your message in order to reply.

The mailbox is hosted by Proton Mail (Proton AG, Route de la Galaise 32, 1228 Plan-les-Ouates, Switzerland). An adequacy decision of the European Commission applies to Switzerland (Art. 45 GDPR).

Retention: I delete the message once the matter is settled.

Legal basis: Art. 6(1)(f) GDPR (legitimate interest in answering inquiries).

5. Newsletter

With your explicit consent, I send you my newsletter with content on business operations, AI integration, and organizational design.

Data processed: Email address, language preference, signup time, IP address at signup (proof of consent).

I store the IP address at the time of sign-up as proof of your consent together with your entry and delete it with the entry, at the latest 6 months after you unsubscribe. Sign-ups that you do not confirm are deleted after 30 days. The data is also included in the encrypted backups of my server, which I keep for up to six months.

Double-Opt-In: After signup, you receive a confirmation email. Your address is only added to the mailing list after clicking the confirmation link.

Delivery: The newsletter is sent via Resend, a service of Plus Five Five, Inc. (USA). See Section 14 (Third-country transfers).

Legal basis: Art. 6(1)(a) GDPR (consent).

Withdrawal: You can withdraw your consent and unsubscribe at any time via the unsubscribe link in every newsletter or by sending an informal message to [email protected].

Retention: Your data is retained for 6 months after unsubscription to document the former consent and then automatically deleted.

6. Web Analytics

This website uses a self-developed, privacy-friendly analytics system. No cookies are set and no personal data is collected.

Not collected: IP addresses, browser fingerprints, cookies, user IDs, or other personal data.

Legal basis: Art. 6(1)(f) GDPR (legitimate interest in analyzing website usage).

Retention: 365 days, then automatically deleted.

7. Cookies

This website only uses technically necessary cookies required for the operation of the website. A cookie banner is therefore not required (Sec. 25(2) no. 2 TDDDG).

8. Security Measures and Logging

To protect the website against attacks and abuse, I log security-relevant events. These include login attempts and changes to security settings in the administration area, requests to addresses that exist only as traps, recognisable attack patterns in URLs and inputs, and too many requests in a short time. Depending on the event, I store the IP address, the browser identifier (user agent), the requested address, the time, the type of event and technical details about it, for example the reason for a block or the name of an input field. I do not store the content of your inputs; the only exception is login forms that serve as traps (see below).

I also record in the log when someone signs up for the newsletter, confirms the sign-up or unsubscribes, and when I send a newsletter. These entries contain no e-mail address. For a sign-up I store the time, the IP address and whether the confirmation e-mail was sent; for confirmation and unsubscription only the time and the type of action; for a mailing only the number of recipients and of successful and failed deliveries.

Some addresses and login forms are never used by ordinary visitors, only by attackers (for example /.env or /wp-login.php). Anyone who requests such a trap or sends a recognisable attack pattern may be blocked automatically for 24 to 72 hours. The block list contains the IP address, the reason and the expiry time; expired entries are removed automatically. If someone types an e-mail address or a user name into a login form that serves as a trap, I store that input (up to 100 characters) in the log. This is the only case in which the security log contains an e-mail address. A password typed there may be transmitted to my server; I neither evaluate nor store it.

Legal basis: Art. 6(1)(f) GDPR (legitimate interest in website security).

Retention: I remove the IP address completely from the log after 7 days. All other data, including an e-mail address typed into a trap, is deleted after 90 days. Deletion runs automatically once a day. The security log is not included in my backups.

9. Email Service (Resend)

For sending emails (the newsletter and the sign-up confirmation email), I use Resend, a service of Plus Five Five, Inc., 2261 Market Street #5039, San Francisco, CA 94114, USA.

Data processed: Email address, subject, email content. Resend stores the metadata of sent emails, logs and API records in the USA, regardless of the selected sending region; Resend retains this data for 30 days. On my own server, I store delivery information (delivered/failed/complaint) only anonymously without personal reference.

Resend processes this data on my behalf (Art. 28 GDPR). For its own account and usage data, for example to operate the service and prevent abuse, Plus Five Five, Inc. is an independent controller under its Data Processing Addendum; in this respect, Resend's privacy policy at resend.com/legal/privacy-policy applies.

See Section 14 for third-country transfers and data processing agreements.

10. AI-Powered Services

The following AI service is used for creating blog content and newsletter editions:

• DeepSeek (DeepSeek, China) - for blog text drafts and newsletter creation in the editorial area

For editorial use (blog, newsletter), only editorial content is transmitted. Ask a-ops (Section 11) and the Agent Decision Tree (Section 12) do not use any AI service.

The AI Transparency page explains which AI systems are used for what purpose and how content is labelled.

11. Ask a-ops: search in my articles

On the start page you can ask a question about my articles. You get passages from my articles. The search runs in your browser on a search index of my articles, which your browser loads from my server for this. No language model is involved.

What reaches my server. When you submit a question or pick an example question for the first time, the page sends the text of the question and the language of the page to my server. If the question contains obvious personal data, such as an email address or a phone number, it stays in your browser. My server only checks the question for length and attack patterns such as script code and then reports back that Ask a-ops runs without a language model. It does not store the question, does not write it to any log, including the security log, and does not send it on. Once the server has reported this, the page no longer sends further questions to it until you reload the page. On the way to my server, the question passes through Cloudflare's network like every request (Section 3).

Briefly on my server. To stop mass use, at most six questions per minute are possible. For this, my server keeps your IP address with the times of your requests in memory, never in a file. Entries whose last request is more than 30 minutes old are removed on a later request, at the latest when the server restarts.

Purpose and legal basis. The purpose is to offer you Ask a-ops and to protect the feature against abuse. The legal basis is Art. 6(1)(f) GDPR. My legitimate interest is to offer you this feature, which you trigger yourself, and to protect it against abuse.

Your rights. The rights in Section 15 apply. Since I do not store your question, I cannot tell later what you asked.

12. Agent Decision Tree

The Agent Decision Tree helps you assess whether a task needs an AI agent. You do not need a user account or an email address. The tool needs no personal data; please do not enter any in the task name or goal.

Assessment in your browser: Your answers are assessed in your browser using fixed rules. No AI service is called, including for the PDF.

Storage in your browser: So that you can continue later, the tool stores your progress in your browser's local storage (localStorage, entry aops-adt-v1): the names and goals of your tasks and your answers. The entry has no expiry date and remains until you delete it. This entry is not transferred to me. A portfolio consisting only of examples is not stored. You delete the entry with “Delete locally” in the tool or in your browser settings. The legal basis is Sec. 25(2) no. 2 TDDDG, as the storage is necessary for the function you use.

Saving and loading files: With “Save as file”, your browser stores a file with your entries on your device. When you load a file, your browser reads it itself. In neither case is anything transferred to me.

PDF report: Only when you request the PDF does your browser transfer the names and goals of your tasks and your answers to my server. The server checks the data, recalculates the result and creates the PDF from it. For this it briefly stores the data in a temporary directory that only the web server can read, and deletes it immediately after the PDF is created. If creation fails with an error, the server also deletes the directory immediately. Only if the server itself crashes during creation can remains be left behind. It deletes them during the next PDF request that comes at least ten minutes later. Your entries are neither stored permanently nor written to my logs. On the way to my server, your data passes through Cloudflare's network. Cloudflare can also see its content, and processing in the USA is possible. My server is hosted by dashserv in Düsseldorf. Details on server log files and Cloudflare are in Section 3, on third-country transfers in Section 14.

Legal basis: Where task names or goals nevertheless contain personal data, Art. 6(1)(b) GDPR (providing the report you requested).

13. Interface for agents (MCP)

At /mcp this website offers an interface based on the Model Context Protocol. Through it, AI agents can search the archive, fetch articles and terms and apply the rules of the Agent Decision Tree. It needs no account and is read-only.

Data processed: The content of the request, that is search words, a term, the address of an article or answers for the Agent Decision Tree, and, as with every request, the IP address (Section 3). The server answers the request and does not store its content. No AI service is called.

Limits and security: At most 60 requests per minute are possible per IP address. For this, the server keeps the IP address with the times of the requests in memory, never in a file. Entries whose last request is more than 30 minutes old are removed on a later request, at the latest when the server restarts. Exceeding the limit is noted in the security log; so are inputs with a recognisable attack pattern, which lead to no block on this interface (Section 8).

Legal basis: Art. 6(1)(f) GDPR (legitimate interest in operating the interface and protecting it against abuse).

14. Third-Country Transfers (USA and China)

Some of the services used are based outside the EU:

• Plus Five Five, Inc. (Resend) (USA) - Email delivery (data processing agreement pursuant to Art. 28 GDPR)
• Cloudflare, Inc. (USA) - Delivery of all requests to the website (Cloudflare Tunnel, data processing agreement pursuant to Art. 28 GDPR); your IP address and the content of your requests are transmitted in the process
• DeepSeek (China) - AI text generation for blog and newsletter in the editorial area

A data processing agreement (DPA) is in place with Resend and with Cloudflare. Both companies are certified under the EU-US Data Privacy Framework. Transfers to the USA are therefore based on the European Commission adequacy decision of 10 July 2023 (Implementing Decision (EU) 2023/1795, Art. 45(3) GDPR). In the alternative, for example if a certification lapses, the European Commission Standard Contractual Clauses agreed in the respective DPA apply (Art. 46(2)(c) GDPR).

There is no EU Commission adequacy decision for transfers to DeepSeek in China. Only editorial content from the editorial area is transmitted to this service, nothing you enter on this website.

15. Your Rights

You have the following rights regarding your personal data:

• Access (Art. 15): You can request a copy of your stored data at any time.
• Rectification (Art. 16): You can request correction of inaccurate data.
• Erasure (Art. 17): You can request deletion of your data.
• Data Portability (Art. 20): You can receive your data in a machine-readable format (JSON).
• Objection (Art. 21): You can object to the processing of your data based on legitimate interests.
• Withdrawal (Art. 7(3)): You can withdraw given consents at any time with effect for the future.

To exercise your rights, contact: [email protected]

16. Right to Lodge a Complaint

You have the right to lodge a complaint with a data protection supervisory authority. The authority responsible for me is:

State Commissioner for Data Protection and Freedom of Information North Rhine-Westphalia
Postfach 20 04 44
40102 Düsseldorf
www.ldi.nrw.de

17. Automated Decision-Making

No automated decision-making including profiling within the meaning of Art. 22 GDPR takes place. The assessments offered on this website (e.g., Maturity Scan) are solely for self-assessment and have no legal or similar effects.

18. Retention Periods - Overview

19. Changes to This Privacy Policy

I reserve the right to update this privacy policy to reflect changes in legal requirements or changes to the website and data processing. The current version can always be found on this page.