Privacy policy
Last updated: July 13, 2026
This privacy policy describes data processing on hafsa.de. It covers the website infrastructure actually in use, the contact form, local preferences and—only after consent—Google Analytics.
Personal data means any information relating to an identified or identifiable person.
1. Controller
Ömer Hakan Ölçer – Hafsa Software
Fritz-Reuter-Str. 19
21629 Neu Wulmstorf, Germany
Email: info@hafsa.de
Phone: +49 176 61660555
2. Hosting, delivery and security logs
The website is delivered through Cloudflare services. When you visit, data such as your IP address, request time and destination, referrer, browser and device information, and technical security and routing data may be processed. This is necessary to deliver the website, prevent attacks and abuse, analyse errors and maintain availability.
The legal basis is Article 6(1)(f) GDPR. Our legitimate interest is the secure, stable and efficient operation of the website. Cloudflare may process data outside the European Economic Area as part of its global infrastructure and uses the safeguards required for those transfers.
See the Cloudflare Privacy Policy for more information.
3. Contacting us
Contact by email
When you contact us by email, we process the contact details and content you provide to answer your request. Article 6(1)(b) GDPR applies where the request concerns a possible or existing contract; otherwise processing is based on Article 6(1)(f) GDPR and our interest in handling business enquiries.
Contact form
The contact form processes name, email address and message as required fields. Company and phone number are optional. For security and abuse prevention, the time and submission ID are also processed. The IP address is converted only into an HMAC-SHA-256 identifier created with a secret key; the plain IP address is not stored in the contact archive. User agent and referrer are not archived there either.
The submission is stored in a non-public Cloudflare R2 archive and delivered to info@hafsa.de through an internal Cloudflare service. The data is used only to handle, trace and secure the enquiry. The legal basis is Article 6(1)(b) GDPR for pre-contractual or contractual requests and otherwise Article 6(1)(f) GDPR.
4. Google Analytics after consent
Google Analytics 4, provided by Google Ireland Limited, is loaded only after you select “Allow analytics”. No Analytics script is embedded without consent. If you consent, cookies or similar identifiers may be used and information about page views, interactions, browser, device and approximate location may be processed. Google Analytics 4 discards IP addresses after deriving coarse location data and before they are logged.
The legal basis for loading and storing the technology and for the subsequent processing is your consent under Section 25(1) TDDDG and Article 6(1)(a) GDPR. You can change your choice at any time through the website's privacy settings. Withdrawal applies for the future.
See Google's Analytics data safeguards information for more details.
5. Local website preferences
The website stores the selected language (“hafsa_lang”), colour scheme (“color-scheme”) and Analytics choice (“hafsa_analytics_consent”) in your browser's localStorage. These values restore your choices on later visits. Language and colour scheme are not used for advertising or profiling. You can delete the entries in your browser settings.
6. Recipients and international transfers
Recipients are limited to providers required for the purposes described: Cloudflare for hosting, security, R2 storage and email delivery, and Google only after Analytics consent. Global infrastructure may involve transfers to third countries, particularly the United States. Providers rely on contractual or other legally recognised safeguards. We do not sell personal data.
7. Retention
Submissions in the production contact archive are automatically deleted after 90 days; submissions from the technical test environment are deleted after 30 days. Short-lived abuse and rate-limit records are deleted after one day. Email copies and resulting business correspondence are retained only as long as needed to handle the request or meet contractual or statutory record-keeping and retention duties. Google Analytics data follows the retention settings configured in the Analytics account.
8. Your rights
Subject to the applicable conditions, you have rights of access, rectification, erasure, restriction, data portability and objection. You may withdraw consent at any time for the future. Contact info@hafsa.de to exercise these rights.
You may also lodge a complaint with a data protection supervisory authority, in particular the State Commissioner for Data Protection of Lower Saxony.
9. Security and changes
We use technical and organisational measures designed to protect the website and transmitted data appropriately. This policy will be updated if the services in use or legal requirements change. The version published on this page is the current version.