Privacy policy

1. Controller

The controller for data processing on this website is:
Marco Pannars, Marco Pannars Consulting
Mariabrunner Str. 31, 81245 München, Germany
Email: consulting@pannars.com

2. Hosting and server log files

The website is hosted by STRATO GmbH, Otto-Ostrowski-Straße 7, 10249 Berlin, Germany. The servers are located in Germany. STRATO therefore receives the server data listed below.

When you visit the website, the server processes technically necessary data in log files: IP address, date and time, page requested, amount of data transferred, status code, and browser and operating system information. This is needed to deliver the page, keep it secure and find errors.

The legal basis is Art. 6(1)(f) GDPR (legitimate interest in secure and stable operation). In the log files STRATO provides to me, IP addresses are anonymised. I can access them for the last six weeks at most; after that STRATO deletes them automatically. I do not analyse them to identify individual visitors.

3. Enquiry form

You can request an intro call through the form on the book a call page. I process these details: name, email address and link to your shop (required) and, if you provide them, topics, monthly Meta ad budget, how you heard about me, preferred times and your message.

The details are sent to me by email and are not stored on the website's server. I only use them to answer your enquiry and prepare the call. Without the required details I cannot reply.

The legal basis is Art. 6(1)(b) GDPR for pre-contractual steps at your request, otherwise Art. 6(1)(f) GDPR (legitimate interest in answering enquiries).

Protection against abuse

The form is protected against automated abuse without external services and without cookies. As soon as you select (by click or keyboard) a form field, the page fetches a short signed time signal from my own server. The server uses it to check that the form was not sent within a fraction of a second and is only used once. The time signal contains no personal data.

The server also limits how often enquiries come in from the same connection. For this it stores your IP address only as a pseudonymised hash value: it is calculated from the IP address with a secret key that changes every day (HMAC); the IP address itself is not stored. The server counts requests and messages under this value. It is only used on the same day for abuse prevention. Files older than 24 hours are deleted automatically the next time the form is used, as are the markers of time signals already used. The legal basis is Art. 6(1)(f) GDPR (legitimate interest in protection against spam and abuse).

4. Contact by email

If you email me, I process your address and the content to reply to you. The legal basis is Art. 6(1)(b) or (f) GDPR. Please note that emails are not always encrypted in transit. My mailbox is also hosted by STRATO GmbH (servers in Germany). Messages from the enquiry form arrive there as well.

5. Cookies, tracking and fonts

This website sets no cookies and uses no analytics or advertising tools. The fonts are stored on my own server; no fonts are loaded from Google or other third-party servers when you visit. A consent banner is therefore not needed. If I use analytics tools later, I will update this policy beforehand.

6. Booking a call

At launch there is no external booking tool: calls are arranged through the enquiry form and by email. Once I add a booking tool, I will extend this policy (provider, purpose, legal basis, data transfer, third countries if applicable).

7. External links

The website links to external pages, such as my LinkedIn profile and the sources cited. Merely visiting my page does not transfer any data to these providers. Only when you click a link do you leave my site; the provider's privacy policy applies to processing there.

8. Retention

Enquiries that do not lead to a collaboration are deleted once they are dealt with and no follow-up questions are expected. If we work together, I keep the records as long as German tax law requires: business letters for 6 years, invoices and accounting records for 8 years, books and records for 10 years, each counted from the end of the calendar year (§ 147 of the Fiscal Code, § 14b of the VAT Act). The legal basis is Art. 6(1)(c) GDPR. After that I delete them.

9. Your rights

You have the following rights against me as the controller:

• Access to your stored data (Art. 15 GDPR)
• Rectification of inaccurate data (Art. 16 GDPR)
• Erasure (Art. 17 GDPR)
• Restriction of processing (Art. 18 GDPR)
• Data portability (Art. 20 GDPR)
• Withdrawal of consent with effect for the future (Art. 7(3) GDPR)

Right to object (Art. 21 GDPR)

Where I process your data on the basis of legitimate interests (Art. 6(1)(f) GDPR), you may object at any time on grounds relating to your particular situation. I will then stop processing the data unless I can demonstrate compelling legitimate grounds that override your interests, rights and freedoms, or the processing serves the establishment, exercise or defence of legal claims.

To exercise them, email me at the address above. There is no automated decision-making including profiling.

10. Right to lodge a complaint

You can complain to a data protection supervisory authority, for example the one where you live. The authority responsible for me is the Bavarian State Office for Data Protection Supervision (BayLDA), Promenade 18, 91522 Ansbach, Germany, www.lda.bayern.de.

Last updated 9 November 2026