LEGAL

Privacy Policy

Last updated: October 2026

1. Controller

The controller responsible for data processing on this website within the meaning of the General Data Protection Regulation (GDPR) is:

Nicola Theuss, Theuss Consulting, Isareckstr. 28, 81673 Munich, Germany
Email: nico@theuss-consulting.de

Further contact details can be found in the Legal Notice.

2. In brief

This website is a purely informational page. There is no contact form, no registration, no appointment booking, no analytics or tracking tools and no advertising cookies. Images and fonts are delivered via the servers of the hosting platform, not from Google or other font providers. No maps, videos or social media plugins from third parties are embedded. I process personal data only to the extent necessary for the operation of the website and for handling your enquiry.

3. Hosting and server log files

This website is built and operated with the website builder of the HighLevel platform (HighLevel Inc., 1801 N. Lamar St., Suite 600, Dallas, TX 75202, USA). When you visit the pages, the hosting provider technically processes the data your browser transmits (so-called server log files):

  • IP address
  • date and time of the request
  • page or file requested and amount of data transferred
  • referrer URL (previously visited page)
  • browser type, browser version and operating system

This processing is necessary to deliver the website and to ensure its stability and security. The legal basis is Art. 6(1)(f) GDPR (legitimate interest in the secure and efficient operation of the website).

Images and font files are delivered via the content delivery network of the platform (assets.cdn.filesafe.space); in doing so, your IP address is transmitted to this server. For delivery and protection against automated traffic, the platform uses service providers according to my findings, including Cloudflare, Inc. (USA). I do not evaluate the log files myself; the hosting provider decides on the retention period.

A data processing agreement pursuant to Art. 28 GDPR is in place with HighLevel. Processing in the USA and other third countries is possible. According to its own statements, HighLevel is certified under the EU-U.S. Data Privacy Framework; in addition, Standard Contractual Clauses of the European Commission are provided for (Art. 44 et seq. GDPR).

4. Domain and redirect

The domain is registered with GoDaddy. If you open the address without "www" (theuss-consulting.de), GoDaddy forwards the request to www.theuss-consulting.de for technical reasons and processes your IP address and the requested address in doing so. The legal basis is Art. 6(1)(f) GDPR (legitimate interest in the website being reachable at both addresses). Where data is transferred to third countries, this relies on the safeguards demonstrated by the provider under Art. 44 et seq. GDPR.

5. Getting in touch and vCard

There is no contact form. When you click an email link, your own email program opens; the data only reaches me when you send your message. If you write to me or call me, I process the data you provide (e.g. name, contact details, company, content of your enquiry) in order to answer your enquiry and to prepare a possible engagement.

The legal basis is Art. 6(1)(b) GDPR where your enquiry aims at a contract or pre-contractual measures, and otherwise Art. 6(1)(f) GDPR (legitimate interest in answering business enquiries).

Via the "Save vCard" button you can save my contact details as a file in your address book. The file is generated in your browser; no data is transmitted from you to me or to third parties in the process.

I delete your data once it is no longer needed for its purpose and no statutory retention obligations (e.g. commercial and tax law periods) apply.

For my mailbox I use an email service provider with whom a data processing agreement is in place. Emails are generally not transmitted with continuous end-to-end encryption; please keep this in mind for confidential content.

If you contact me via LinkedIn, LinkedIn's privacy policy applies in addition (LinkedIn Ireland Unlimited Company, Wilton Plaza, Wilton Place, Dublin 2, Ireland).

6. Cookies and local storage

This website does not use cookies or similar technologies for analytics, statistics or marketing purposes. For this reason there is no consent request (cookie banner).

When you visit the website, only the following technically necessary information is stored or accessed:

  • Cookie "__cf_bm" (Cloudflare, Inc., USA), lifetime up to 30 minutes: protection against automated traffic (bot detection). It is set via the infrastructure of the hosting platform, namely on the domain of this website as well as when loading images and fonts from the platform's media server (assets.cdn.filesafe.space). According to the manufacturer, it is generated separately per website and is not used for advertising or cross-website tracking.
  • Session storage "tsr-scroll-restoration-v1_3": remembers your scroll position when navigating back and forth. It contains no identifier and is deleted when the tab is closed.

The legal basis for storing and reading is section 25(2) no. 2 TDDDG. The associated processing of personal data (in particular the IP address) relies on Art. 6(1)(f) GDPR; my legitimate interest is the security and functionality of the website.

7. Fonts

The fonts used on this website (Space Grotesk, Source Serif 4, IBM Plex Mono) are stored as files on the platform's media server (assets.cdn.filesafe.space) and are loaded from there; they are licensed under the SIL Open Font License. No connection to servers of Google or other font providers is established.

8. External links

This website contains a link to my LinkedIn profile. No plugins or share buttons are embedded. Only when you click the link do you leave this website and data is transmitted to LinkedIn. LinkedIn is responsible for the processing there.

9. Your rights

You have the right to access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18) and data portability (Art. 20). Insofar as I process data on the basis of consent, you may withdraw it at any time with effect for the future (Art. 7(3)). No consent is currently obtained on this website.

Right to object under Art. 21 GDPR: You have the right, on grounds relating to your particular situation, at any time to object to the processing of your personal data that is based on Art. 6(1)(f) GDPR. I will then no longer process the data unless I can demonstrate compelling legitimate grounds that override your interests, or the processing serves the establishment, exercise or defence of legal claims.

An email to the address above is sufficient to exercise your rights.

Right to lodge a complaint: You have the right to lodge a complaint with a data protection supervisory authority. The authority responsible for me is the Bayerisches Landesamt für Datenschutzaufsicht (BayLDA) (Bavarian State Office for Data Protection Supervision), Promenade 18, 91522 Ansbach.

10. Data security

This website is delivered exclusively over encrypted HTTPS.

11. No automated decision-making

There is no automated decision-making, including profiling. You are not obliged to provide personal data to me; without your contact details, however, I cannot answer an enquiry.

12. Updates

This privacy policy is current as of October 2026. I will update it when the website or the legal situation changes.