Build Audit Grow
DeutschContact

Privacy policy

Last updated: 3 October 2026. The German version prevails.

This policy explains how personal data is processed on this website. It describes only the services that are actually in place. It is a courtesy translation of the German policy, which prevails.

Richard Steeven Vasquez (Build Audit Grow) is the controller. Full provider and contact details are in the legal notice. For privacy requests, use the enquiry form and state that your request concerns data protection.

You may complain to the Bavarian Data Protection Authority (BayLDA): https://www.lda.bayern.de/.

You have the right to access, rectification, erasure, restriction of processing, data portability and objection. Where processing is based on consent, you may withdraw it at any time with future effect.

You also have the right to lodge a complaint with the competent data-protection supervisory authority.

Cloudflare provides this website and its enquiry processing. Necessary connection and access data, including IP address, time and requested resource, is processed to deliver the website securely. The legal basis is Article 6(1)(f) GDPR (secure, stable operation). The enquiry database uses Cloudflare D1 EU jurisdiction; this does not mean all hosting and security processing is exclusively within the EU.

Additional application logs are disabled for the enquiry Worker. Cloudflare processes its own operational and security data under its privacy terms. Information about recipients, data processing and international transfer mechanisms is available at https://www.cloudflare.com/privacypolicy/ and https://www.cloudflare.com/cloudflare-customer-dpa/.

We process your name, email address, selected topic and message, plus optional company, business type, business description and website details, to handle your enquiry and reply personally. Required fields are marked. We cannot handle a form enquiry without them. Do not include sensitive personal data or other people’s personal data.

The legal basis is Article 6(1)(b) GDPR for pre-contract enquiries and Article 6(1)(f) GDPR for other requests; our legitimate interest is handling incoming enquiries. We do not collect marketing consent or make automated decisions about you.

Enquiries are stored privately in Cloudflare D1 with EU jurisdiction. Only authorised account operators can retrieve them; there is no public retrieval endpoint. Despite the database jurisdiction, hosting and abuse protection may involve international processing, including the United States. Cloudflare processes data under its privacy and data-processing terms and the transfer mechanisms described there.

Form enquiries are automatically deleted after 90 days. If an enquiry becomes a contract, necessary contract data is transferred to separate contract administration and applicable statutory retention duties apply. An internal request ID prevents duplicate storage when you retry. The form sends no automatic emails. Provider recovery history may retain deleted data for up to 30 days, depending on the plan. Expired enquiries are deleted again after restoration.

We validate Cloudflare Turnstile tokens on the server to prevent automated abuse. Cloudflare processes browser and connection data, including the IP address. Short-lived identifiers derived with a secret key enforce request limits; plain IP addresses are not stored in our enquiry database. Identifiers expire after their rate-limit window and are deleted by hourly cleanup. The legal basis is Article 6(1)(f) GDPR; our legitimate interest is preventing spam and abuse.

Details of Cloudflare’s processing are in its privacy information.

WhatsApp buttons are external links. No WhatsApp widget is loaded before you click. Clicking opens WhatsApp/Meta, whose privacy terms and possible international transfers also apply. If you send a message, we process your profile name, phone number and message to handle your request. The legal basis is Article 6(1)(b) GDPR for pre-contract requests and Article 6(1)(f) GDPR otherwise. You can use our enquiry form instead.

We use technically necessary cookies or local storage — among other things for security and abuse protection and to store your cookie choice. Non-essential (analytics) services run only after your consent.

You can change or withdraw your choice at any time via "Cookie settings" in the footer.

With your consent we use Google Analytics 4 (measurement ID G-W7K7KMSYWS), loaded via Google Tag Manager (container GTM-WXH4N62R). There is no direct gtag.js implementation. Without your consent, neither Google Tag Manager nor Google Analytics is loaded; no analytics takes place before consent, after a rejection, or when JavaScript is disabled.

We use Google Consent Mode v2. By default all consent signals are set to "denied". Only when you agree to analytics is "analytics_storage" set to "granted" and Google Tag Manager loaded. Advertising signals (ad_storage, ad_user_data, ad_personalization) remain "denied" in the current implementation; there is no advertising, remarketing or Google Ads conversion measurement.

Google Analytics processes usage and event data (e.g. pages viewed and interactions) as well as device and approximate location information. Google Signals and User-ID collection are not enabled. Once you have consented, Google Analytics may set cookies (such as _ga).

The retention configured in Google Analytics is 2 months for event data and 14 months for user-level data; this period resets on new user activity. Your consent is stored locally in your browser; you can change or withdraw it at any time via "Cookie settings" in the footer.

Fonts are self-hosted; no external font services are used. The website check is provided via the separate application auditmywebsite.app, which has its own privacy policy.

If you contact the email address listed in the legal notice, we process your information to handle your request. The legal basis is Article 6(1)(b) GDPR for pre-contract or contractual requests and Article 6(1)(f) GDPR for other correspondence (handling incoming messages). The enquiry form itself sends no emails and saves requests in the private storage described above. Email correspondence is processed through Google Workspace. Google processes sender and recipient addresses, messages, attachments and technical delivery information. Processing outside the EU is possible; Google publishes its Cloud Data Processing Addendum and subprocessors. Ordinary email is not end-to-end encrypted. Enquiries that do not result in a contract are to be deleted from the mailbox after 90 days; contract records subject to statutory retention are kept separately. Mailbox deletion is managed by the operator and is not performed by automatic deletion in the form storage.

Authorised operators can view contact enquiries alongside audit requests in the protected dashboard. Sign-in is checked by Cloudflare Access using an email one-time code. Sign-in email, technical connection data and necessary session cookies are processed to prevent unauthorised access, under Article 6(1)(f) GDPR (protecting confidential enquiries). Visitors do not need a dashboard account.

We update this policy when the processing described here changes.