LEGAL

Privacy policy

Version of 24 August 2026

This is an English translation, provided for convenience. The processing described here is governed by the General Data Protection Regulation (GDPR) and German federal law.

1Controller

The controller within the meaning of the General Data Protection Regulation (GDPR) is:

Erhardt Systems UG (haftungsbeschränkt)
Gehegestraße 5
39646 Oebisfelde-Weferlingen
Germany
Email: info@erhardt.systems

Represented by the managing director, Lars Peter Werner Erhardt. Entered in the commercial register at the local court (Amtsgericht) of Stendal under HRB 37973.

No data protection officer has been appointed; the statutory conditions of Art. 37 GDPR and § 38 BDSG (German Federal Data Protection Act) are not met.

2General information on data processing

We process personal data only to the extent necessary to provide a functioning website and our content. Processing is carried out on the basis of the applicable statutory provisions, in particular the GDPR and the German Federal Data Protection Act (BDSG).

3Hosting and domain name resolution

This website is hosted by an external service provider acting as our processor:

Hetzner Online GmbH
Industriestr. 25
91710 Gunzenhausen
Germany

Hetzner processes, on our behalf, the data generated when the website is accessed (in particular server log files, see section 4). We have concluded a data processing agreement with the provider pursuant to Art. 28 GDPR. The legal basis is our legitimate interest in providing the website securely and efficiently (Art. 6 (1) (f) GDPR).

Domain name resolution (DNS)

Name resolution for our domains is handled by Amazon Route 53, a service of Amazon Web Services EMEA SARL, 38 Avenue John F. Kennedy, L-1855 Luxembourg. When your device opens this website, your internet provider first queries our name servers for the IP address of the server. Technical connection data may be generated in the process. A data processing agreement pursuant to Art. 28 GDPR is in place. The legal basis is Art. 6 (1) (f) GDPR (legitimate interest in the reliable operation of the domain). Processing in the USA cannot be ruled out in this context; for the safeguards applied, see section 9.

4Server log files

When the website is accessed, information transmitted by your browser is recorded automatically. This information is technically required in order to deliver the page:

IP address of the requesting device
date and time of access
name and URL of the file retrieved
browser type and version, and operating system
referrer URL (the page visited previously)
volume of data transferred and status message

Purpose: Ensuring a smooth connection, system security and stability, and analysis in the event of a fault.
Legal basis: Art. 6 (1) (f) GDPR (legitimate interest).
Retention: The data is deleted as soon as it is no longer required for the purpose; log data is generally deleted after seven days at the latest, unless security-relevant events require longer retention.

5SSL/TLS encryption

For security reasons, and to protect the transmission of confidential content, this website uses SSL/TLS encryption. You can recognise an encrypted connection by the “https://” prefix in your browser's address bar.

6Contacting us from the home page

The home page contains no contact form. It shows our email address as a mailto link. Selecting that link opens the email program configured on your device with the address already filled in. At that point no data is transmitted to us and none is collected by us. We do not operate a database of enquiries, and no data about you is stored on this website.

If you go on to send us a message, section 7 applies.

7Contacting us by email

If you contact us by email, the details you provide will be stored in order to process your enquiry and to deal with any follow-up questions. The legal basis is Art. 6 (1) (f) GDPR (legitimate interest in responding), or Art. 6 (1) (b) GDPR where the enquiry is directed at concluding a contract. The data is deleted as soon as it is no longer required to achieve the purpose and no statutory retention obligations prevent deletion.

For our business email communication we use Microsoft 365, a service of Microsoft Ireland Operations Limited, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, Ireland. The content of your message, your sender address and the technical header data of the email are processed and stored there on our behalf. A data processing agreement pursuant to Art. 28 GDPR is in place. Processing in the USA cannot be ruled out in this context; for the safeguards applied, see section 9.

8Web analytics

This website uses the open-source software Rybbit for the statistical analysis of visits. We operate Rybbit ourselves, on our own instance at analytics.erhardt.systems. The data collected is processed exclusively on a server operated by us within the European Union and is transmitted neither to the software's manufacturer nor to any other third party.

No cookies, no access to your device

Rybbit sets no cookies and stores no information in your browser, neither in local storage nor in session storage. Accordingly, there is neither any storage of information in your terminal equipment nor any access to information already stored there within the meaning of § 25 (1) TDDDG (German Digital Services Data Protection Act). Consent is therefore not required for this analytics measurement.

Data processed

page accessed (URL including query parameters) and page title
the page visited previously (referrer)
entry and exit page, and duration of the visit
browser type and version, operating system, device type, screen resolution
country and region, derived from the IP address
campaign parameters (UTM), where you arrive via a link tagged accordingly
clicks on links leading to other websites

How your IP address is handled

Your IP address is processed on a transient basis only, in order to derive the country and region from it. It is not stored in the database. In order to group repeat page views within a single visit, Rybbit forms an identifier from the IP address and the browser identifier, hashed with a random value (salt) that changes daily. This identifier does not allow any conclusions to be drawn about you personally and expires after 24 hours at the latest.

What does not happen

no recording of sessions (no session replay), and no recording of mouse movements, keystrokes or form content
no cross-site tracking and no recognition on a later visit
no profiling, no disclosure to advertising networks, no sale of data

Requests identified as coming from known bots and crawlers are discarded and not analysed.

Purpose: Statistical analysis of usage, in order to tailor the content and the technical delivery of the website to actual needs.
Legal basis: Art. 6 (1) (f) GDPR. Our legitimate interest lies in designing and improving this website in line with actual needs. Since the analysis takes place without cookies, without a persistent identifier and without storing the IP address, the interference is minor.
Retention: 14 months from the time of access; the records are then deleted automatically.
Objection: You may object to the analytics measurement at any time under Art. 21 (1) GDPR; an informal message to the email address given above is sufficient. Independently of this, you can prevent collection technically by blocking the loading of the script from analytics.erhardt.systems in your browser or via a browser extension.

9Recipients and transfers to third countries

We disclose personal data only to the processors listed below, which act for us and are bound by our instructions. Data is not sold and is not disclosed for advertising purposes.

Hetzner Online GmbH, Gunzenhausen — operation of the server (section 3). Processing in Germany.
Amazon Web Services EMEA SARL, Luxembourg — domain name resolution (section 3). Processing in the USA is also possible.
Microsoft Ireland Operations Limited, Dublin — email service (section 7). Processing in the USA is also possible.

The analytics measurement described in section 8 is operated on our own infrastructure; no visitor data is transmitted to the manufacturer of the software used.

Where data is processed in the USA, we base the transfer on an adequacy decision of the European Commission pursuant to Art. 45 GDPR, provided that the recipient concerned is certified under the EU-US Data Privacy Framework, and otherwise on the European Commission's standard contractual clauses pursuant to Art. 46 (2) (c) GDPR. We point out that the USA does not offer a level of data protection equivalent to European law and that, in particular, access by state authorities cannot be entirely ruled out.

10No automated decision-making

Automated decision-making in individual cases, including profiling, within the meaning of Art. 22 GDPR does not take place.

11Your rights

You have the following rights vis-à-vis the controller:

access to the data processed (Art. 15 GDPR)
rectification of inaccurate data (Art. 16 GDPR)
erasure (Art. 17 GDPR)
restriction of processing (Art. 18 GDPR)
data portability (Art. 20 GDPR)
objection to the processing (Art. 21 GDPR)
withdrawal of a consent given, with effect for the future (Art. 7 (3) GDPR)

To exercise these rights, an informal message to the email address given above is sufficient.

12Right to object

Where we process personal data on the basis of Art. 6 (1) (f) GDPR (legitimate interest) — this concerns the server log files and the analytics measurement — you have the right to object at any time, on grounds relating to your particular situation, to that processing. If you object, we will no longer process the data concerned, unless we can demonstrate compelling legitimate grounds that override your interests, rights and freedoms, or unless the processing serves to assert, exercise or defend legal claims.

13Right to lodge a complaint with a supervisory authority

Without prejudice to any other legal remedy, you have the right to lodge a complaint with a data protection supervisory authority. The authority responsible for us is:

Landesbeauftragter für den Datenschutz Sachsen-Anhalt
Leiterstraße 9
39104 Magdeburg
Germany

14Changes to this privacy policy

We will adapt this privacy policy whenever the underlying processing operations or the legal requirements change. The version published here applies in each case; the date given above is decisive.

This website uses no cookies. Apart from the analytics script described in section 8, which is delivered from our own server at analytics.erhardt.systems, no third-party content is embedded. The typefaces used come from the Google Fonts project, but are delivered exclusively locally from our own server. When the website is accessed, no connection is established to servers operated by Google or any other external provider; in particular, no IP address is transmitted to Google.