privacy policy

This translation is provided for information only. The German version is legally binding.

Protecting your personal data matters to me. This website works without external fonts and without content delivery networks. The audience measurement runs cookieless on my own server. Advertising performance is only measured, and visits are only recorded, if you have expressly consented beforehand.

1. Controller

Can Yildiz Security Consulting
Dietrich-Bonhoeffer-Str. 23
61440 Oberursel (Taunus)
Email: kontakt@cyi-consulting.de

2. Server log files

The hosting provider automatically collects and stores information in so-called server log files, which your browser transmits: browser type and version, operating system used, referrer URL, hostname of the accessing computer, time of the server request and IP address. The legal basis is Art. 6 (1) (f) GDPR; the legitimate interest lies in the technically error-free and secure operation of the website. The data is deleted after seven days at the latest.

3. Contact form and email contact

If you send me enquiries via the contact form or by email, your details including the contact data you provide are stored in order to process the enquiry and in case of follow-up questions.

The legal basis is Art. 6 (1) (b) GDPR where your enquiry relates to the performance of a contract or is necessary for pre-contractual measures. In all other cases, processing is based on my legitimate interest in effectively handling the enquiries addressed to me (Art. 6 (1) (f) GDPR). The data remains with me until you ask me to delete it, withdraw your consent or the purpose ceases to apply; mandatory statutory retention periods remain unaffected.

To protect against automated requests, technical characteristics are evaluated on submission (an invisible additional field, timing measurement and a shortened, hashed form of the IP address to limit submission frequency). These characteristics are used solely for spam protection and are deleted automatically after a short time.

4. Cookies and local storage

This website sets a technically necessary session cookie that serves solely to secure the contact form (protection against cross-site request forgery). It is deleted when you close your browser and requires no consent (§ 25 (2) no. 2 TDDDG).

Cookies and comparable identifiers used for conversion measurement (see section 5), as well as the recording of visits (see section 6), require your explicit consent via the consent notice. Your decision is stored locally in your browser for this purpose (localStorage, key “cyi-consent”) and is not transmitted to the server. You can withdraw it at any time by clearing the site data in your browser; the notice will then appear again.

5. Google Ads (conversion measurement)

This website uses the Google Ads tag (gtag.js) provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. It makes it possible to see whether a visit originates from a Google advert and has led to an enquiry (conversion measurement). The tag is loaded on every page but operates in two stages using Google’s consent mode (“Consent Mode v2”).

Without your consent, no cookies are set and no identifiers are stored on or read from your device; the advert’s click identifier (gclid) is removed as well. At this stage only a cookieless signal is transmitted to Google, containing technical details such as your IP address, device and browser information, the page visited and the time of access, from which Google derives a statistical estimate of advert performance without any reference to you as a person. The legal basis for this is my legitimate interest in assessing the commercial performance of my adverts (Art. 6 (1) (f) GDPR); § 25 TDDDG does not apply because nothing is stored on or read from your device.

Only after your explicit consent via the consent notice does Google set cookies or comparable identifiers on your device, read them, and attribute your enquiry to the specific advert. The legal basis is then § 25 (1) TDDDG together with Art. 6 (1) (a) GDPR. Your consent is voluntary and can be withdrawn at any time with effect for the future (see section 4); after withdrawal the cookieless stage described above applies again.

Also only with your consent do I use the “enhanced conversions” feature. The email address you enter in the contact form is converted into an irreversible checksum using SHA-256 on my server and transmitted to Google in that form only; the address in plain text never leaves my server. Google compares the checksum with the checksums of signed-in Google accounts in order to attribute an enquiry to the correct advert even when no cookie is available. The legal basis is Art. 6 (1) (a) GDPR; without consent no checksum is transmitted.

Google also processes the data in the USA. Google LLC is certified under the EU-US Data Privacy Framework; the transfer is additionally based on the European Commission’s standard contractual clauses. Despite these safeguards, protection equivalent to the European level cannot be fully guaranteed, in particular with regard to access by government authorities.

Further information: Google’s privacy policy at policies.google.com/privacy and the ad settings at adssettings.google.com.

6. Audience measurement (Umami)

To understand which content on this website is read, I use the Umami software. Umami runs on a server operated by me in Germany; the data does not leave that server, is not passed on to third parties and is not transferred to a third country. No external analytics provider is involved.

The measurement works without cookies: no identifiers are stored on or read from your device. Recorded are the page visited, the previously visited page (referrer), the time and duration of the visit, browser, operating system and device type, screen size, language setting and the country of origin derived from the IP address. An irreversible checksum is formed from the IP address, browser identification and a server-side random value so that related page views can be counted as one visit; the IP address itself is not stored. No cross-site profile is created, and the data is not combined with other data sources.

In addition, the successful submission of the contact form is counted as an anonymous event. Only a fixed event name is transmitted – no details from the form.

The legal basis is Art. 6 (1) (f) GDPR; my legitimate interest lies in the statistical evaluation of website usage in order to improve content and technology. § 25 TDDDG does not apply because nothing is stored on or read from your device. You may object to this processing at any time under Art. 21 GDPR; an informal message to the address given above is sufficient.

I delete the statistical evaluations after twelve months at the latest.

Only after your explicit consent via the consent notice does Umami additionally record the course of your visit (session replay and heatmap): mouse movement, clicks, scrolling, window resizing and the page content displayed at the time. This makes it possible to review the visit afterwards like a film in order to identify usability problems. Entries in form fields are excluded from the recording. The legal basis is Art. 6 (1) (a) GDPR together with § 25 (1) TDDDG. Without your consent the script required for this is not loaded at all. Your consent is voluntary and can be withdrawn at any time with effect for the future (see section 4); I delete the recordings after 30 days at the latest.

7. External content

The contact form is protected against automated requests exclusively by server-side, data-minimising measures (including checksum tokens as well as time and frequency limits); no data is transmitted to third parties in the process.

Apart from the consent-based Google Ads tag described in section 5, no external fonts, maps, video platforms or captcha services are embedded. The audience measurement under section 6 runs on my own server. All other resources are delivered from my own server. Links to external profiles (e.g. LinkedIn) only become active when you click them.

The dates shown on this website (seminars, trade fairs, talks) are fetched at regular intervals by my server itself from the calendars at pretix and Proton and delivered with the page. When you open the page, your browser does not connect to these providers, and no data about you is transmitted to them.

8. Seminar booking via pretix

I sell tickets for open seminars through an online ticket shop operated with the pretix software. The pretix.eu service is provided by pretix GmbH, Berthold-Mogel-Straße 1, 69126 Heidelberg, Germany. When you click “Book a ticket”, you leave this website and the ticket shop opens at pretix.eu.

When you book, I process the data you provide: name, company, billing address, e-mail address, VAT ID where applicable, the names of the participants, and order and payment data. The purpose is to handle the booking, issue the invoice and communicate about the seminar, for example the exact venue, changes or a cancellation. The legal basis is Art. 6(1)(b) GDPR. If the person booking names other people as participants, I process their data on the basis of my legitimate interest in running the seminar properly (Art. 6(1)(f) GDPR); the person booking informs the participants accordingly.

pretix GmbH processes this data on my behalf under a data processing agreement pursuant to Art. 28 GDPR. For payment, the payment data is transmitted to the payment service provider you choose, which processes it under its own responsibility; its privacy notice applies in addition. The privacy notice of pretix.eu also applies to the technical provision of the ticket shop, including the technically necessary cookies used there.

I keep booking and invoice data for as long as commercial and tax retention obligations require (currently up to ten years); I delete all other data once the seminar has taken place and the booking has been fully processed.

9. Your rights

  • Access to the data processed (Art. 15 GDPR)
  • Rectification of inaccurate data (Art. 16 GDPR)
  • Erasure (Art. 17 GDPR)
  • Restriction of processing (Art. 18 GDPR)
  • Data portability (Art. 20 GDPR)
  • Objection to processing (Art. 21 GDPR)
  • Withdrawal of consent with effect for the future (Art. 7 (3) GDPR)
  • Complaint to a supervisory authority (Art. 77 GDPR)

The competent supervisory authority is the Hessian Commissioner for Data Protection and Freedom of Information.

10. SSL/TLS encryption

For security reasons this site uses TLS encryption. You can recognise an encrypted connection by the prefix “https://” in your browser’s address bar.

Last updated: Version 3.0