Legal
Privacy policy
Information about personal data processed when you visit this website or contact us. The German privacy policy is authoritative.
This website is hosted by STRATO. Processing in connection with our email communication is described separately in Sections 4 and 8.
1. Controller
Ingenieurbüro HCH
Owner: Dr.-Ing. Heiner Claus Hollekamp
Stadtlohner Straße 3
48683 Ahaus
Germany
Telephone: +49 2561 865866
Email: info@ingenieurbuero-hch.com
Our data protection officer
Maximilian Hollekamp
You can contact him by post at the address above, marked “Data protection officer – confidential”.
2. General information
Personal data is information that can identify a person directly or indirectly. We process it only where required for secure website operation, responding to enquiries, pre-contractual measures, contract performance, legal obligations or where consent has been given.
3. Website provision and hosting
This website is hosted by STRATO GmbH, Otto-Ostrowski-Straße 7, 10249 Berlin, Germany. We have a data processing agreement under Article 28 GDPR. Technical connection and access data, including IP address, request time and requested content, is processed to deliver the website, identify faults and protect it against misuse. The legal basis is Article 6(1)(f) GDPR, reflecting our interest in secure and reliable website operation.
Under the hosting provisions of our STRATO agreement, visitor access logs are retained for a maximum of seven days. Other service logs, email records and backups are subject to their respective purposes and retention provisions. The four-week period for enquiries below does not apply to hosting logs.
Website files, fonts and images are served with this website. The previous ChatGPT Sites preview is not used to deliver this STRATO version. Further provider information is available in STRATO’s privacy information (German).
4. Contact by online form, email or telephone
We process your contact details and message to answer your enquiry. The legal basis is Article 6(1)(b) GDPR for contracts and pre-contractual measures, and otherwise Article 6(1)(f) GDPR for appropriate business communication. Microsoft's email infrastructure is used to receive email addressed to our domain ingenieurbuero-hch.com. Connection data, sender and recipient details and messages are processed for delivery and protection against unsolicited or harmful email. We use Microsoft Outlook on Mac and iPhone and Office applications to handle correspondence. Further information about Microsoft is provided in Section 8.
You can send an enquiry directly through the contact page, the future audit and funding orientation and the industrial electricity price form. Only when you click “Send enquiry” are your name, organisation, email address, optional telephone number, message and any calculation inputs transmitted to our website server. The server validates the input, reconstructs the orientation from the calculation inputs and forwards the enquiry to HCH by email. We use STRATO’s email service to send form enquiries; the connection to the sending server is encrypted using TLS. No customer account or form-message database is created. Section 4a explains the separate calculation requests; Section 4b explains spam protection. Before submitting, you acknowledge the privacy information and request a response. This does not subscribe you to marketing emails.
Deletion is carried out internally by HCH. General enquiries that do not lead to an engagement are deleted no later than four weeks after final processing, unless statutory retention duties or evidence required to establish, exercise or defend legal claims prevent deletion. If an engagement results, necessary information is transferred to project records. Business and tax records subject to retention requirements are kept for the applicable statutory periods, in particular under Section 147 AO and, where applicable, Section 257 HGB. They are not routinely deleted after four weeks.
4a. Future audit and funding orientation and industrial electricity price calculator
Assessments are calculated on this website’s server. The future audit and funding orientation transmits only the five selected answers and your chosen language. The industrial electricity price calculator sends electricity consumption, the investment quota and the flexibility bonus selection. Names, company names, contact details and free-text notes are not included in these requests. Please do not enter personal or confidential information into numeric fields.
Calculation inputs are used only to return the requested result; they are not stored as application records. To limit automated abuse, the server keeps a protected counter file outside the public website directory. It contains pseudonymised connection identifiers and request counts, not raw IP addresses, calculation inputs or contact details. Identifiers use a secret server key and change each minute. The previous minute’s counters are discarded on the next calculator request; without another request, the last counter state remains until the next use. These counters cannot be used to reconstruct an assessment. Hosting-provider connection logs are separate, as described in Section 3.
The legal basis is Article 6(1)(f) GDPR: our interest in providing the guidance tool you have requested and protecting it against misuse. Results are non-binding and do not decide a contract, funding application or legal obligation.
4b. Protection of online enquiries
Before an online enquiry can be sent, your browser performs a computational security check using the self-hosted ALTCHA component. Our website server validates the result. No external verification service, tracking cookies or behavioural profiles are used for this check. The code is delivered with our website. This protection makes automated mass submissions more difficult; it does not verify your identity.
The server additionally limits submission frequency and prevents reused verifications and duplicate enquiries. A protected file outside the public website directory stores keyed, pseudonymised identifiers for connections, email addresses and message content, as well as counters, delivery status and random reference numbers. It does not contain raw IP addresses, email addresses or message text. Verification records remain valid for ten minutes; other protection records for up to 24 hours. Expired records are removed on the next enquiry-system request. If there are no further requests, the last protected counter state remains until the system is used again. Hosting logs and delivered emails are separate.
The legal basis is Article 6(1)(f) GDPR: our legitimate interest in secure communication and preventing abuse. If the security check cannot be completed, you can contact us by telephone or email using the contact details above.
5. Job applications
We process contact, application and qualification data to decide whether to establish an employment relationship. The legal basis is Section 26(1) of the German Federal Data Protection Act in conjunction with Article 6(1)(b) GDPR.
Unsuccessful applications are generally deleted six months after notification of rejection or another conclusion of the recruitment process. Retention during this period supports the potential establishment, exercise or defence of legal claims. Deletion is carried out internally by HCH. Longer retention is limited to what is necessary to establish, exercise or defend legal claims, or to a specifically agreed longer period with your consent. Necessary defence of legal claims relies on Article 6(1)(f) GDPR; voluntary further retention relies on Article 6(1)(a). Consent can be withdrawn at any time for the future. There is no automatic inclusion in a candidate pool. If you are employed, necessary information is transferred to your personnel file.
8. Recipients, processors and international transfers
STRATO provides this website. STRATO may use subprocessors under its data processing agreement; their involvement depends on the products actually purchased. The agreement does not guarantee that all data is processed exclusively in Germany. Further information is available in STRATO’s contractual and privacy documents (German). Within HCH, enquiries and applications are accessed only by the people responsible for processing them. Project partners or advisers are involved only where necessary for the specific matter, agreed and legally permissible.
Microsoft 365, Outlook and Teams
We use a business Microsoft 365 account, Outlook on Mac and iPhone, Office applications and Microsoft Teams for correspondence, meetings and project collaboration. We also operate our own company server for business records. In addition to contact details, Microsoft processes account and participant identifiers, IP addresses, device and connection data, meeting times, chat messages and files shared through these services. Audio is transmitted when you enable your microphone; camera images and shared screens are transmitted when you enable those features. Files shared through Teams are stored in Microsoft 365, particularly SharePoint or OneDrive, depending on how they are shared.
The legal basis is Article 6(1)(b) GDPR for communication necessary for a contract or pre-contractual measures. Otherwise, it is Article 6(1)(f) GDPR and our interest in effective business communication and collaboration. For employment-related processing, the applicable employment-data provisions also apply, particularly Section 26 BDSG. Participants can see the name you use, your contributions and content shared with them. Access to stored HCH records is limited to the people involved in the matter and authorised administrators. If you prefer not to use Teams, you can contact us by email or telephone.
Audio recordings and transcription
For selected meetings, we use audio recordings and automatic transcription to prepare and verify meeting notes and agreed tasks. The invitation includes a notice, and we obtain your permission before starting the recording or transcription. The legal basis for these optional documentation features is your consent under Article 6(1)(a) GDPR. You may refuse without disadvantage and participate in a meeting without these features. If someone joins later, their permission must also be obtained before their contributions are recorded or transcribed. A Teams notification does not replace this consent.
Recordings and transcripts contain spoken contributions and, where available, speaker names and timestamps. A Teams recording may also capture enabled cameras or shared screens; the scope must therefore be explained before recording begins. Recordings and transcripts are stored in the organiser’s OneDrive or the relevant SharePoint site, depending on the meeting type, and are accessible to authorised users. Automated transcripts can contain errors and are checked before their contents are adopted in a meeting note.
We retain recordings and complete transcripts only while they are needed for the agreed documentation and follow-up purpose. We arrange their deletion when that purpose has ended; necessary project notes may be retained separately under the rules for business records. The four-week period in Section 4 applies to general enquiries that do not lead to an engagement. Consent may be withdrawn at any time for the future by contacting the controller named above; this does not affect the lawfulness of processing before withdrawal. Any continued retention requires a separate legal basis.
Provider, contractual safeguards and processing locations
The European provider is Microsoft Ireland Operations Limited, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, Ireland. Microsoft’s business online services are subject to the Microsoft Products and Services Data Protection Addendum, which describes processing on behalf of customers, security measures and subprocessors. Microsoft also processes certain data for its own legitimate business operations as described in its privacy statement.
Processing locations depend on the service and tenant configuration. Microsoft’s EU Data Boundary includes the EU and EFTA countries and provides for limited exceptions involving transfers outside this area. An exclusive Germany or EU storage guarantee therefore does not follow from it. For transfers outside the EEA, Microsoft’s contractual documents provide for an applicable adequacy decision under Article 45 GDPR or suitable safeguards, particularly the European Commission’s Standard Contractual Clauses under Article 46 GDPR. Information on these safeguards is available through the linked addendum; you may also contact us for further information. Microsoft services are not embedded in this website: merely visiting the website does not start a Teams session.
9. Your rights
Subject to statutory requirements, you have rights of access under Article 15 GDPR, rectification under Article 16, erasure under Article 17, restriction under Article 18, data portability under Article 20 and objection under Article 21. Consent can be withdrawn at any time with effect for the future.
You may also lodge a complaint with a data protection supervisory authority. In North Rhine-Westphalia, this is the State Commissioner for Data Protection and Freedom of Information, Kavalleriestraße 2–4, 40213 Düsseldorf, Germany.
10. Encryption and security
The website is delivered over encrypted HTTPS. Appropriate technical and organisational measures are used to protect personal data from loss, manipulation and unauthorised access. Email communication may nevertheless involve security risks; particularly confidential information should only be sent using an appropriate transmission method agreed in advance.
11. Changes to this privacy policy
We update this policy when the website, services used or legal requirements change. The version published on this page applies.