Data protection information for hosting, contact requests, retention periods, and data subject rights.

Data Protection

1. Controller

The controller responsible for data processing on this website is:

STEFAN PILZ Ltd.
Makedonias 11, House 19
8270 Tremithousa
Cyprus

Phone: +357 94 05 64 24
Email: post@stefanpilz.ltd

2. General information about processing

Personal data is processed on this website only to the extent necessary for technical operation, secure delivery, and the handling of contact requests. No browser-side tracking pixel is loaded. Contact requests attributable to an OpenAI ad are measured server-side after successful delivery as described in section 5; for Google ads as described in section 5a. Fonts, icons, and static assets are delivered locally.

3. Hosting and server log files

The website is currently operated via infrastructure provided by united-domains AG, Gautinger Strasse 10, 82319 Starnberg, Germany. When you access the site, the server may process technically required information such as:

  • IP address
  • date and time of access
  • requested URL
  • referrer URL
  • browser type and browser version
  • operating system

This processing is necessary to ensure stability, security, and proper delivery of the website and is based on Art. 6(1)(f) GDPR.

4. Contact form, email, and phone inquiries

If you use the contact form or contact us by email or phone, we process the information you submit solely to answer your request and to handle follow-up communication. This may include your name, email address, phone number, subject, and message.

The legal basis is:

  • Art. 6(1)(b) GDPR where your request relates to a contract or pre-contractual measures
  • Art. 6(1)(f) GDPR for the efficient handling of general inquiries
  • Art. 6(1)(a) GDPR where consent has been given

Your data will not be shared with third parties unless this is necessary to process your request, is part of the conversion measurement described below, or is required by law.

5. OpenAI Ads conversion measurement

If you reach this website through an OpenAI ad, the destination address contains a pseudonymous ad reference (oppref). To associate a later form submission with this visit without using a cookie, our server creates a protected hash value (HMAC) from the IP address, browser identifier, and preferred language. The raw values are not written to the attribution log. The ad reference is stored there in encrypted form. By default, the record expires after six hours and is removed on the next attribution-log access.

If the short-lived hash matches when the contact form is submitted successfully, our server sends a conversion event to OpenAI. The transmission is limited to the OpenAI-provided ad reference, a random event ID, the time, the event type (lead_created), and the page visited. Your name, email address, phone number, message content, internal hash, and IP address are not sent to OpenAI. No conversion event is sent without a previously recorded and still-valid OpenAI ad visit.

This processing measures the effectiveness of our OpenAI ads and is based on our legitimate interest in transparent and economical advertising measurement under Art. 6(1)(f) GDPR. The integration does not load an OpenAI script in your browser and does not set a tracking cookie. You may object to this processing at any time.

5a. Google Ads conversion measurement

If you reach this website through a Google ad, the destination address contains a click identifier assigned by Google (gclid). During your visit this identifier is only kept in your browser's session storage (sessionStorage, deleted when the tab is closed) and carried along as a hidden field in the contact form; no cookie is set and no Google script is loaded. Only if you successfully submit the contact form does our server store the click identifier together with the time of submission in a conversion log. Name, email address, phone number, message content, and IP address are not stored there.

Google Ads retrieves this log from our server at regular intervals via an access-protected address and matches the click identifier to the original ad click. Only the click identifier, the name of the conversion goal (contact request), and the time are transferred. Entries are removed from the log automatically after 60 days. The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland.

This processing measures the effectiveness of our Google ads and is based on our legitimate interest in transparent and economical advertising performance measurement under Art. 6(1)(f) GDPR. You can object to this processing at any time.

6. Retention period

Personal data is stored only for as long as required for the relevant purpose. Contact requests are deleted once processing is complete and no statutory retention obligations apply any longer.

7. Your rights

Under applicable data protection law, you have the right to:

  • request information about your stored personal data
  • request correction of inaccurate or incomplete data
  • request deletion of your data where no legal obligation prevents it
  • request restriction of processing
  • object to processing based on legitimate interests
  • request data portability where the legal requirements are met
  • withdraw consent with future effect

8. Right to lodge a complaint

If you believe that the processing of your personal data violates data protection law, you have the right to lodge a complaint with a competent supervisory authority.

9. No externally loaded resources

The website does not load fonts, scripts, or tracking elements from external third-party servers into your browser. The conversion request described in section 5 takes place exclusively between our server and OpenAI; the retrieval described in section 5a exclusively between Google and our server. External websites are only contacted in your browser when you actively click an outgoing link.