Privacy Policy

1. Controller

The controller responsible for data processing on this website is:

Patrick Bär

Proß 41a, 95336 Mainleus, Germany

Email: info@ot-infrasec.de

Phone: +49 15679 362820

2. General information on data processing

We process personal data only within the limits of the law, in particular the General Data Protection Regulation (GDPR), the German Federal Data Protection Act (BDSG) and the German Telecommunications Digital Services Data Protection Act (TDDDG).

Personal data is any information that can be used to identify you personally.

3. Hosting and server log files

This website is hosted by Vercel Inc., 440 N Barranca Ave #4133, Covina, CA 91723, USA. When you visit the website, the server automatically records information, in particular:

• IP address (shortened or complete, depending on the hosting provider)
• date and time of the request
• page or file requested
• browser type and version
• operating system
• referrer URL

This processing is based on Art. 6(1)(f) GDPR (legitimate interest) to ensure the technical stability and security of the website. A data processing agreement is in place with the hosting provider.

4. Contacting us

If you contact us by email or through a contact form, we process the data you provide (e.g. name, email address, message) to handle your request. The contact form only opens your email program; what you enter is not transmitted to our server.

The legal basis is Art. 6(1)(b) GDPR (pre-contractual measures) or Art. 6(1)(f) GDPR (legitimate interest in handling communication).

5. Newsletter

Currently you subscribe to the newsletter solely by telling us by email that you would like to receive it.

We do not currently use a separate newsletter tool or external newsletter platform. As a rule, only your email address and the content of your message are processed.

Processing is based on your consent under Art. 6(1)(a) GDPR. You can withdraw your consent at any time with effect for the future, e.g. by email to info@ot-infrasec.de.

6. Audience measurement with Vercel Web Analytics

We use Vercel Web Analytics (Vercel Inc., USA) to obtain aggregated usage statistics (e.g. pages viewed, country of origin, browser and device type). The service works without cookies and without storing information on your device; visitors are not tracked across websites.

The legal basis is Art. 6(1)(f) GDPR. Our legitimate interest is the statistical evaluation and improvement of our offering. You may object to this processing at any time (Art. 21 GDPR), e.g. by email to info@ot-infrasec.de.

7. Web analytics with PostHog (only with your consent)

If you agree in the cookie banner, we use PostHog to understand how our website is used and where visitors come from. The provider is PostHog Inc., 2261 Market Street #4008, San Francisco, CA 94114, USA. We use PostHog Cloud in the EU (Frankfurt); a data processing agreement is in place with PostHog.

Without your consent PostHog is not loaded, no data is sent to PostHog and nothing is stored on your device.

After you consent, we process the following data:

• pages viewed (URL) and time of the visit
• referrer and campaign parameters (UTM), i.e. where you came from
• time spent on the page and scroll depth
• country derived from your IP address (the IP address itself is discarded after the lookup and not stored)
• browser, operating system and device type
• the event that the contact form or newsletter button was used (without what you entered)
• a randomly generated identifier stored in your browser's local storage (localStorage)

We do not use automatic click capture or session recording, and we do not build user profiles. Data is sent to PostHog through a proxy on our own domain (/ingest); your IP address is passed on to PostHog to determine the country and is then discarded.

The legal basis is your consent under Art. 6(1)(a) GDPR and Section 25(1) TDDDG. Data is kept for 12 months and then deleted.

You can withdraw your consent at any time with effect for the future: click “Cookie settings” in the footer and choose “Reject”. The PostHog data stored locally is then removed from your browser.

8. Local storage on your device

Besides the PostHog data described above, we store the following on your device. They are necessary to operate the website and to remember your choices, and are stored on the basis of Section 25(2) no. 2 TDDDG and Art. 6(1)(f) GDPR:

• ot-consent (localStorage): your choice in the cookie banner and when you made it; kept for about 6 months, after which we ask again.
• astro-locale (cookie): your chosen language, if you explicitly open the German version; kept for 1 year.

9. Recipients and transfers to third countries

Personal data is passed on to third parties only where the law permits it or you have consented. Recipients are our processors Vercel Inc. (hosting, audience measurement) and, after your consent, PostHog (web analytics).

Where service providers outside the EU/EEA are used, data is transferred only under the conditions of Art. 44 et seq. GDPR, for example on the basis of the EU-US Data Privacy Framework or standard contractual clauses.

10. Storage period

We store personal data only as long as necessary for the respective purposes or as required by statutory retention periods. The period stated in section 7 applies to web analytics data.

11. Your rights

Within the limits of the law you have in particular the following rights:

• access (Art. 15 GDPR)
• rectification (Art. 16 GDPR)
• erasure (Art. 17 GDPR)
• restriction of processing (Art. 18 GDPR)
• data portability (Art. 20 GDPR)
• objection to processing (Art. 21 GDPR)
• withdrawal of consent (Art. 7(3) GDPR)

12. Right to lodge a complaint with a supervisory authority

You have the right to lodge a complaint with a data protection supervisory authority about our processing of your personal data (Art. 77 GDPR).

13. Status of this privacy policy

As of: 1 November 2026