Privacy policy.

Privacy at a glance

Datenschutz­erklärung is the privacy policy required under the GDPR (General Data Protection Regulation, in German DSGVO). Where the two texts differ, the German version applies.

• Only with your consent. No cookies are set unless you agree. Your choice is kept in your browser's local storage (section 7).
• Only with your consent: Google Analytics 4. Withdraw at any time via “Cookie settings” in the footer (section 8).
• Only after consent. Fonts, graphics and scripts are served from this server. The servers of the services named are contacted only after you agree.
• Used only to reply. Your details are sent over an encrypted connection to my web server, which forwards them to my mailbox as an email; your entries are not stored on the server. You automatically receive a confirmation at the email address you entered (section 5).
• The hosting provider's server logs, your email enquiries and, if a business relationship results, contract and invoicing data (see section 6).
• External specialists engaged per project, only where needed for your enquiry or project and under contract (section 6).
• Only for enquiries from the UAE and the Gulf states. These enquiries are handled by Business Jot FZE in Sharjah, United Arab Emirates; the details are transferred there for that purpose (sections 1 and 5).
• Access, rectification, erasure, restriction, portability, objection, complaint. Details below.

1. Controller

BusinessJot in Hof operates this website and its forms and is the controller for the processing involved, and for the data of its own clients.

Clients in the United Arab Emirates and the other Gulf states contract with Business Jot FZE. Business Jot FZE is a controller in its own right for handling their enquiries and for their contract data:

Muhammad Hamd Naveed is the owner of both companies. You can exercise your rights under section 10 against either company through the email address given.

No data protection officer has been appointed, because neither the conditions of Article 37 GDPR nor those of § 38 of the German Federal Data Protection Act (BDSG) are met. Please send any data-protection enquiry to the address above.

2. Principles

This website is built to process as little personal data as possible. It consists of static pages. Fonts, graphics and scripts are served from this server. Analytics, marketing and advertising services of third parties are loaded only after you consent. Until then no cookies are set, no information is stored on or read from your device (§ 25 TDDDG) and no connection is made to those providers' servers. Details are in sections 7 and 8.

3. Hosting and server logs

This website is hosted by Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen. The servers are located in Germany (EU). A data processing agreement under Article 28 GDPR is in place with the hosting provider.

When you open a page, your browser necessarily transmits data to the server, which the hosting provider records in server log files: the IP address of the requesting device, the date and time of the request, the page or file requested, the amount of data transferred, the HTTP status code, the previously visited page (referrer) if your browser sends it, and the browser type and operating system (user agent).

The purpose of this processing is the technical delivery of the website, operational security and stability, error analysis and defence against attacks. The legal basis is Article 6(1)(f) GDPR; the legitimate interest is the secure and undisturbed operation of the website. The log files are not combined with other data and are not analysed to trace individual persons. Retention: log files are deleted after seven days at the latest, unless their further retention is required to investigate a specific security incident.

4. Encryption

Transmission between your browser and the server is encrypted with TLS (HTTPS). Requests over unencrypted HTTP are redirected to the encrypted connection.

5. Contact by email and contact form

If you email me or use the contact form, I process the data transmitted in doing so: your email address, your name and, if you use the form, the name of your company and your telephone number, the content of your message and any details you provide, such as the address of your website, your ad channels and your budget, and the page of this website you came from to reach the form (the path only, for example /pricing). Name, company, email address, telephone number and website are required on the form so that I can match your request and reach you to arrange the next step.

If you use the form to request a free consultation, I also process the subject you choose and the form of meeting you prefer. I use these details solely to arrange and hold the consultation and to answer your enquiry; the legal basis is Article 6(1)(b) GDPR (steps taken at your request before a possible contract). The consultation creates no contract and does not add you to any marketing list.

The contact form sends your details over an encrypted connection to my web server, which forwards them as an email to my mailbox. The form data is not stored on the web server itself. To prevent spam and double sending, the server only keeps a keyed, irreversible value of your IP address for one hour and a marker for the form's security check for 30 minutes; both are then deleted automatically (Art. 6(1)(f) GDPR).

Automatic confirmation. When you submit a form, my web server automatically sends a confirmation to the email address you entered in the form. It confirms that your enquiry has arrived and sets out the next steps; it does not repeat the text of your message. For this I use your name, your email address and the type of enquiry, plus the website you gave for a free audit and the form of meeting you prefer for a consultation. The purpose is to confirm receipt of your enquiry. The legal basis is Article 6(1)(b) GDPR (steps taken at your request before a possible contract). Your email address is not used for anything beyond this, in particular not for advertising or a newsletter. The email is sent through the hosting provider named in section 3.

The purpose is to handle and answer your enquiry. The legal basis is Article 6(1)(b) GDPR where the enquiry is directed at concluding or performing a contract, and otherwise Article 6(1)(f) GDPR, the legitimate interest being to answer enquiries addressed to me. Retention: your message is deleted once the enquiry has been dealt with and no retention obligation applies. If you give me access to advertising accounts, analytics or your website for an analysis, I use it read-only and solely for that analysis; you can revoke it at any time, and I hand it back once the analysis is complete unless a project follows. If a business relationship results, section 6 applies. Where needed to handle it, your enquiry may be passed to an external specialist engaged for the project (section 6). It is not added to any mailing list or newsletter.

Enquiries from the United Arab Emirates and the Gulf states. If your enquiry comes from a company in the United Arab Emirates or another Gulf state, it is handled by Business Jot FZE in Sharjah, because that company becomes your contracting party (section 1). For this purpose the details in your enquiry are transferred to Business Jot FZE in the United Arab Emirates. The United Arab Emirates is a third country for which the European Commission has issued no adequacy decision; there are no appropriate safeguards under Article 46 GDPR, and the level of data protection there may differ from that in the European Union. The transfer is based on Article 49(1)(b) GDPR: it is necessary to take pre-contractual steps at your request and to perform any contract with you that results. Only the details in your enquiry are transferred.

My mailbox is operated by Hetzner Online GmbH, Gunzenhausen. A data processing agreement under Article 28 GDPR is in place with this provider. Where the provider processes data in a country outside the European Union or the European Economic Area, it does so only on the basis of appropriate safeguards: for a country covered by an adequacy decision of the European Commission, under Article 45 GDPR; otherwise, under the European Commission's standard contractual clauses pursuant to Article 46(2)(c) GDPR. Which of these mechanisms applies in a given case depends on the provider named above; you can obtain a copy of the appropriate safeguards from the address in section 1. Please note that email over the internet is not encrypted end to end; do not send me confidential information by unencrypted email.

6. Data of clients and business partners

If a quotation or a contract results, I process the data required for it: name, company, address, email address, VAT identification number, contract and invoicing data, and the access and project data handed over in the course of the work.

The purposes are preparing quotations, performing the contract, invoicing, and meeting obligations under tax and commercial law. The legal bases are Article 6(1)(b) GDPR (contract) and Article 6(1)(c) GDPR (statutory retention obligations). Recipients: the bookkeeping software sevdesk (sevdesk GmbH, Offenburg, Germany) as a processor, my bank for payment processing, and my tax adviser where required to meet tax obligations. Retention: contract and invoicing data is kept under the retention periods of German tax law and, where I am a merchant subject to bookkeeping obligations, commercial law (§ 147 AO, § 257 HGB): depending on the type of record, six years (for example business letters), eight years (accounting vouchers) or ten years (books, inventories and annual accounts), and then deleted. Project and access data is returned or deleted when the work is complete.

Clients of Business Jot FZE. If you contract with Business Jot FZE (section 1), Business Jot FZE processes the contract and invoicing data listed above as controller in the United Arab Emirates and keeps it under the rules that apply there. Where data is transferred from the European Union to the United Arab Emirates in the process, the legal basis is Article 49(1)(b) GDPR (performance of the contract with you); on the absence of an adequacy decision, see section 5.

External specialists. For individual projects I work with independent specialists who are not employed by me, for example in strategy, performance marketing or software development. They receive only the data they need for their task and are contractually bound to confidentiality and to process data only on my instructions (Article 28 GDPR). Where a specialist is based outside the EU/EEA, the transfer is based on an adequacy decision of the European Commission (for the United States, the EU-U.S. Data Privacy Framework, Article 45 GDPR) or on the European Commission's standard contractual clauses (Article 46(2)(c) GDPR); you can request a copy at the address given in section 1.

Where I receive data about you from a company I work with, for example because you are named there as a contact person, rather than directly from you, I provide information under Article 14 GDPR: the categories of data (typically your name, business contact details and role) follow from this section and the source is the company concerned. The legal basis is Article 6(1)(f) GDPR; the legitimate interest is communicating with my business partners and handling the contractual relationship with the company concerned. Where I process personal data on behalf of a client, for instance in the client's website, analytics or advertising accounts, I do so as a processor under Article 28 GDPR on the basis of a separate data processing agreement, which I provide on request.

7. Consent, cookies and storage on your device

On your first visit a notice asks whether you agree to statistics and marketing services. “Accept all”, “Reject all” and “Settings” carry equal weight. Only if you agree are the services named in section 8 loaded and cookies or similar identifiers stored on or read from your device. Without your consent no cookies are set and no connection is made to the servers of those services. No fingerprinting techniques are used.

Storing your choice. Your browser keeps your decision in local storage (key “bj-consent”: the choice, the time and the version of the notice). This is required so that your decision is respected (§ 25(2) no. 2 TDDDG; Art. 6(1)(c) GDPR in conjunction with Art. 7(1) GDPR). The entry expires after 12 months or when the services in use change. I then ask again.

Withdrawal. You can change or withdraw your consent at any time with effect for the future: through “Cookie settings” in the footer of every page. The lawfulness of processing carried out until then is not affected (Art. 7(3) GDPR). On withdrawal the services' cookies are deleted as far as they can be reached from this website; you can delete any others in your browser settings.

8. Analytics, marketing and advertising services

The following services are integrated and are loaded only after you consent. Statistics services fall under the “Statistics” category, the others under “Marketing”; you decide on each category separately. No social-media plug-ins and no third-party content (maps, videos, fonts, content delivery networks) are embedded. All typefaces are stored on this server; no connection is made to Google Fonts or comparable services.

Google Analytics 4

Provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (parent company: Google LLC, USA)
Purpose: Audience measurement: which pages are viewed, where visitors come from and how they use the site, so that I can improve it.
Legal basis: Your consent, Art. 6(1)(a) GDPR and § 25(1) TDDDG.
Identifiers and retention: Cookies _ga and _ga_<container ID>, lifetime up to 2 years. Event data in Google Analytics is deleted after the period set in the account, after 14 months at the latest.
Third-country transfer: Data may be transferred to Google LLC in the USA. Google LLC is certified under the EU-US Data Privacy Framework (adequacy decision of the European Commission of 10 July 2023, Art. 45 GDPR).

With your consent the providers receive, among other things, your IP address, identifiers from the cookies named, the pages viewed, details of your browser and device and your interactions with the website. The recipients are the providers named. The providers may also process the data for their own purposes, in which case their privacy terms apply.

9. Links to external websites

This website contains a small number of links to external websites, in particular the website of the supervisory authority. When you follow such a link you leave this website, and the privacy policy of the respective provider applies to the processing of your data there. External content is only requested when you click, never automatically when this page loads.

10. Your rights

With respect to the personal data concerning you, you have the following rights against me:

• the right of access (Article 15 GDPR),
• the right to rectification (Article 16 GDPR),
• the right to erasure (Article 17 GDPR),
• the right to restriction of processing (Article 18 GDPR),
• the right to data portability (Article 20 GDPR), where the processing is based on consent or a contract and is carried out by automated means,
• the right to withdraw any consent given, at any time with effect for the future (Article 7(3) GDPR). Processing by the statistics and marketing services named in section 8 relies on your consent.

Right to object (Article 21 GDPR): you have the right to object at any time, on grounds relating to your particular situation, to processing of personal data concerning you that is based on Article 6(1)(f) GDPR. I will then no longer process the data unless I can demonstrate compelling legitimate grounds for the processing that override your interests, rights and freedoms, or the processing serves the establishment, exercise or defence of legal claims. No direct marketing takes place.

To exercise your rights, an email to info@businessjot.com is sufficient. This also applies where Business Jot FZE processes your data.

11. Right to lodge a complaint with a supervisory authority

Without prejudice to any other remedy, you have the right to lodge a complaint with a data protection supervisory authority (Article 77 GDPR), in particular in the member state of your habitual residence, place of work or the place of the alleged infringement. The supervisory authority responsible for me is:

12. Obligation to provide data

You are under no statutory or contractual obligation to provide me with personal data. Name, company, email address, telephone number and website are required fields in the forms on this website; without them I cannot process the enquiry. For an enquiry by email, your email address is all that is needed, as I cannot reply without it. Without the data listed in section 6 I cannot conclude a contract or issue an invoice.

13. No automated decision-making

No automated decision-making, including profiling, within the meaning of Article 22 GDPR takes place.

14. Data security

I take appropriate technical and organisational measures under Article 32 GDPR to protect the data processed against loss, misuse and unauthorised access, including encrypted transmission, restriction of access to named persons, two-factor authentication on the accounts used, and regular updating of the systems in use.

15. Changes to this privacy policy

I update this privacy policy when the processing or the legal position changes. The current version is always available at this address.

Version: 10 November 2026