1. General information

Protecting your personal data is important to me. I process personal data in accordance with applicable data protection laws, in particular the General Data Protection Regulation (GDPR).

This Privacy Policy explains which personal data is processed when you visit my website or contact me, the purposes for which such processing takes place, and your rights in relation to your personal data.

2. Data controller

The controller responsible for processing personal data is:

Olaf Timm
otc – Olaf Timm Consult
Management Consulting for Risk Management, Governance & Compliance

Stresemannstraße 73
22769 Hamburg
Germany

Email: contact@otconsult.de

3. Website hosting and operation

This website is hosted by STRATO GmbH, Otto-Ostrowski-Straße 7, 10249 Berlin, Germany.

The website is created and managed using the STRATO SmartWebsite Plus website builder.

When you access this website, technically necessary access data is processed. This may include, in particular:

• IP address of the device accessing the website
• Date and time of access
• Pages and files accessed
• Browser type and version
• Operating system
• Referrer URL
• Technical information relating to data transmission

This data is processed to provide the website, ensure its proper functioning, and detect and prevent technical disruptions and security attacks.

The legal basis for this processing is Article 6(1)(f) GDPR. My legitimate interest is to ensure the secure and reliable operation of my website.

STRATO GmbH acts as a technical service provider in connection with this processing.

According to STRATO's general data protection information, IP addresses of website visitors are stored for a maximum of seven days for the purpose of detecting and preventing attacks.

4. Contact by email

If you contact me by email, I process the personal data you provide in order to respond to your inquiry.

This may include, in particular:

• Name and email address
• Company affiliation, where applicable
• Content of your message
• Any additional information you voluntarily provide

The data is processed for the purpose of handling your inquiry and conducting the related correspondence.

Where your inquiry relates to entering into or performing a contract with you as an individual, the legal basis is Article 6(1)(b) GDPR.

Where inquiries are submitted by representatives or contact persons of a company, processing is generally based on Article 6(1)(f) GDPR. My legitimate interest is to communicate with business partners and respond to business inquiries.

Your data will be deleted once it is no longer required for these purposes, unless statutory retention obligations or other legal grounds require or justify its continued retention.

5. Email communication via Microsoft 365

I use Microsoft 365 Business Basic for my business email communication.

The service provider is Microsoft Ireland Operations Limited, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, Ireland.

When using Microsoft 365, personal data is processed, including email addresses, sender and recipient information, message content, and technical communication data.

This processing is carried out to enable and manage my business communications.

Depending on the purpose of the communication, the legal basis is Article 6(1)(b) or Article 6(1)(f) GDPR. My legitimate interest is to ensure reliable and secure business communications.

Microsoft processes personal data in accordance with the contractual data protection terms applicable to Microsoft 365. Other companies within the Microsoft group and subcontractors may also be involved.

For certain enterprise services, Microsoft has implemented arrangements for storing and processing data within the so-called EU Data Boundary. Nevertheless, certain data may still be processed in or transferred to countries outside the European Economic Area (EEA).

Where personal data is transferred to third countries, the applicable adequacy decisions of the European Commission or appropriate safeguards under Article 46 GDPR, in particular the Standard Contractual Clauses adopted by the European Commission, are used depending on the recipient and the country concerned.

Further information about data protection arrangements, subcontractors and international data transfers is available in Microsoft's privacy and contractual documentation.

6. Contact form

This website provides a contact form that you can use to send me messages.

When you use the contact form, the personal data you enter is processed. This includes, in particular:

• Name, if provided
• Email address
• Company, if provided
• Content of your message

Providing an email address and a message is required to use the contact form. Your email address is necessary to enable me to respond to your inquiry. All other information is optional.

The data is processed for the purpose of handling your inquiry and conducting the related correspondence.

Where your inquiry relates to entering into or performing a contract with you as an individual, the legal basis is Article 6(1)(b) GDPR.

In all other cases, processing is based on Article 6(1)(f) GDPR. My legitimate interest is to respond appropriately to incoming inquiries and communicate with prospective clients and business partners.

The contact form is provided through the STRATO SmartWebsite Plus website builder. The data you enter is processed by STRATO as part of the technical operation and transmission of the form.

Messages submitted through the contact form are forwarded to my business email address and subsequently processed using Microsoft 365.

The transmission of form data between your browser and the website takes place via an encrypted HTTPS connection.

The information submitted will be deleted once it is no longer required to handle your inquiry or for any subsequent business communication, unless statutory retention obligations or other legal grounds require or justify its continued retention.

Data submitted through the contact form is not used for newsletters or other separate marketing activities.

7. Cookies and similar technologies

Cookies and comparable technologies may be used in connection with the operation of this website where they are necessary to provide and use certain website functions.

Cookies are small text files that may be stored on your device. For example, they can be used to enable technical functions during a website visit.

Where the storage of information on your device or access to information already stored on it is strictly necessary to provide functions expressly requested by you, this is carried out in accordance with Section 25(2) of the German Telecommunications Digital Services Data Protection Act (TDDDG).

Where personal data is processed in this context, the legal basis is Article 6(1)(f) GDPR. My legitimate interest is to ensure the secure and proper functioning of my website.

I do not use any analytics or marketing services of my own to create personal user profiles on this website.

8. Recipients of personal data

Personal data is disclosed or made accessible to external recipients only where this is necessary for the purposes described above and an appropriate legal basis exists.

These recipients include, in particular:

STRATO GmbH
Service provider responsible for hosting and the technical operation of the website and contact form.

Microsoft Ireland Operations Limited
Service provider for business email communication.

Where service providers process personal data on my behalf, this is carried out in accordance with the requirements of Article 28 GDPR.

Additional recipients may be involved where disclosure is required by law.

9. Data retention

Personal data is generally retained only for as long as necessary to fulfil the purposes for which it was collected and processed.

Contact inquiries and related correspondence are deleted once the relevant inquiry has been fully handled and the data is no longer required for any subsequent business communication.

Where an inquiry results in a business relationship, the relevant data may continue to be processed for the performance and documentation of that relationship.

Statutory retention obligations, particularly those arising under commercial and tax law, remain unaffected.

Technical access data is deleted in accordance with the retention periods applicable to the relevant hosting service. According to STRATO's general information, IP addresses of website visitors are stored for a maximum of seven days for the purpose of detecting and preventing attacks.

10. Your data protection rights

Subject to the applicable legal requirements, you have the following rights:

Right of access (Article 15 GDPR): You have the right to request information about the processing of your personal data.

Right to rectification (Article 16 GDPR): You have the right to request the correction of inaccurate personal data or the completion of incomplete personal data.

Right to erasure (Article 17 GDPR): Under certain conditions, you have the right to request the deletion of your personal data.

Right to restriction of processing (Article 18 GDPR): Under certain conditions, you have the right to request that the processing of your personal data be restricted.

Right to data portability (Article 20 GDPR): Under the applicable legal conditions, you have the right to receive certain personal data in a structured, commonly used and machine-readable format.

Right to object (Article 21 GDPR): Where processing is based on Article 6(1)(f) GDPR, you have the right to object to the processing of your personal data on grounds relating to your particular situation.

Right to withdraw consent (Article 7(3) GDPR): Where processing is based on your consent, you may withdraw that consent at any time with effect for the future.

To exercise any of these rights, please contact me using the email address provided above.

11. Right to lodge a complaint

Under Article 77 GDPR, you have the right to lodge a complaint with a data protection supervisory authority if you believe that the processing of your personal data infringes applicable data protection laws.

The supervisory authority responsible for my place of business is:

The Hamburg Commissioner for Data Protection and Freedom of Information
(Der Hamburgische Beauftragte für Datenschutz und Informationsfreiheit)

Ludwig-Erhard-Straße 22
20459 Hamburg
Germany

You may also lodge a complaint with another competent data protection supervisory authority.

12. Automated decision-making

No automated decision-making, including profiling within the meaning of Article 22 GDPR, takes place in connection with the operation of this website.

13. Updates to this Privacy Policy

This Privacy Policy will be updated whenever changes to applicable legal requirements or the actual processing of personal data in connection with my website make such updates necessary.

Last updated: October 2026