This translation is provided as a courtesy and is not legally binding. Only the German version is legally binding: View German version

Legal

Privacy Policy

Last updated: September 2026

1. Controller

The controller responsible for data processing on this website within the meaning of Art. 4 No. 7 GDPR is:

Christopher Benedikt Pilscheur, Dipl.-Ing. (FH), M.Sc.
Ingenieurbüro Pilscheur
[Street No.], [Postcode] [City], Germany
Email: info@ingenieurbuero-pilscheur.com
Phone: [+49 000 0000 000]

2. General information on data processing

We only process our users' personal data to the extent necessary to provide a functioning website and our content and services. Processing regularly takes place only with consent (Art. 6(1)(a) GDPR), for the performance of a contract (Art. 6(1)(b) GDPR), to fulfil legal obligations (lit. c), or on the basis of legitimate interests (lit. f).

3. Access data / server log files

When you visit this website, technically necessary information is processed (IP address, date/time, requested URL, referrer, user agent). The legal basis is Art. 6(1)(f) GDPR; the legitimate interest lies in the secure, uninterrupted operation of the website. Log files are deleted after 30 days unless a specific security incident requires longer retention.

4. Cookies & local storage (§ 25 TTDSG)

Strictly necessary (no consent required under § 25(2) No. 2 TTDSG, the German Telecommunications and Telemedia Data Protection Act):

cookie-consent.v1 (localStorage) — stores your cookie selection.
Supabase auth tokens (localStorage, admin area only) — keep a logged-in session active.

Statistics / audience measurement (only with your consent, Art. 6(1)(a) GDPR in conjunction with § 25(1) TTDSG):

analytics.visitor_id.v1 & analytics.session_id.v1: (localStorage / sessionStorage) — pseudonymous IDs to recognise visits and sessions.
analytics.lead_id.v1: (localStorage) — links page views to a lead if you arrive via a personalised link (URL parameter ?lid=…).
Server-side storage of page views: (path, referrer, anonymous visitor/session ID, hashed IP address, user agent) in our own database.
Email open tracking: our emails contain a 1×1-pixel with a token; loading it stores the time of opening (with hashed IP and user agent).
Link click tracking: links in our emails are routed via short redirect URLs (/api/public/c/…) to attribute the click to a recipient before forwarding.

No data is transferred to third parties and there is no cross-site tracking. You can change or withdraw your selection at any time: .

5. Contact form

When you use the contact form, we process the data you provide (name, email address, phone if given, message) exclusively to handle your enquiry. The legal basis is Art. 6(1)(b) GDPR (initiation/performance of a contractual relationship) or lit. f (legitimate interest in responding). The data is deleted once the matter is concluded, provided no commercial or tax retention obligations apply (usually 6 or 10 years).

6. Funding check

The information you enter in the online funding check (building type, year of construction, planned measures, etc.) is processed to create your assessment and — if you consent — stored together with the result so that we can advise you specifically on request (Art. 6(1)(a) GDPR). Without consent, the evaluation takes place solely locally in your browser.

7. Newsletter (double opt-in)

For our funding newsletter we use the double opt-in procedure: after signing up you receive an email with a confirmation link. Only after clicking it are you added to the list. The legal basis is Art. 6(1)(a) GDPR. You can withdraw your consent at any time, e.g. via the unsubscribe link in every email or at /unsubscribe.

8. Processors & recipients

To provide the website and its functions, we use the following service providers, with whom data processing agreements pursuant to Art. 28 GDPR have been concluded:

Hosting (frontend/edge): Cloudflare — delivery of the website via the global edge network.
Backend (database, auth, storage): Supabase (our own instance, server location EU). Storage of form submissions, newsletter sign-ups, CRM data, page views, email opens/clicks and admin authentication.
Email dispatch: transactional dispatch of confirmation and notification emails via the domain ingenieurbuero-pilscheur.com.

Unless expressly stated otherwise, no data is transferred to third countries.

9. Retention period

Personal data is only stored for as long as necessary for the respective processing or as required by statutory retention obligations. The following default periods apply to data we collect ourselves and are enforced technically by a daily automatic deletion routine:

Server log files: 30 days
Page views (audience measurement): 180 days
Email opens and clicks: 365 days
Document downloads: 365 days
Email dispatch log: 365 days
Newsletter data: until your consent is withdrawn (afterwards only proof of unsubscription)
Enquiry and order data: until final processing, thereafter 6 or 10 years within commercial and tax law obligations

10. Your rights as a data subject

You have the right at any time to:

Access (Art. 15 GDPR)
Rectification (Art. 16 GDPR)
Erasure (Art. 17 GDPR)
Restriction of processing (Art. 18 GDPR)
Data portability (Art. 20 GDPR)
Object to processing (Art. 21 GDPR)
Withdraw consent given, with effect for the future (Art. 7(3) GDPR)

You also have the right to lodge a complaint with a supervisory authority (Art. 77 GDPR), e.g. the data protection authority of your place of residence.

11. Right to object based on legitimate interest

Insofar as processing is based on Art. 6(1)(f) GDPR, you have the right to object at any time for reasons arising from your particular situation.

12. Data security

For security reasons, this website exclusively uses TLS encryption (HTTPS). All transmissions between your browser and our server are thereby protected.

Template text — please have it reviewed by a lawyer before publication and adapt it to the services actually in use.