1. Privacy at a Glance
General Information
The following notes provide a simple overview of what happens to your personal data when you visit this website. Personal data is any data that could be used to identify you personally.
Data Collection on This Website
Some data is collected because you provide it to us, for example via the contact, training, booking or download form. Other data is collected automatically by our IT systems when you visit (e.g. browser, operating system, time of access) or only with your consent (Google Analytics, the device ID of our statistics).
Your Rights
Within the limits of the law you have the right of access (Art. 15 GDPR), rectification (Art. 16 GDPR), erasure (Art. 17 GDPR), restriction of processing (Art. 18 GDPR) and data portability (Art. 20 GDPR), as well as the right to object to processing based on legitimate interests (Art. 21 GDPR). You can withdraw any consent at any time with effect for the future, for cookies and statistics via the “Cookie settings” link in the footer. You also have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR); the authority responsible for us is the Hamburg Commissioner for Data Protection and Freedom of Information.
2. Controller and Hosting
Controller
The party responsible for data processing on this website is:
ORAI Solutions GmbHSchwarzbuchenweg 1
22391 Hamburg
Phone: 0151 - 68103983
Email: jan.ostermann@orai-solutions.de
Hosting
This website, its database and the content management system run on Microsoft Azure in data centres in the EU. When you visit, the server processes technically necessary data such as IP address, browser type, time of access and requested page in order to deliver the website and protect it against attacks. The legal basis is Art. 6(1)(f) GDPR.
Microsoft processes this data as our processor under a data processing agreement pursuant to Art. 28 GDPR.
3. Data Collection on This Website
Cookies and local storage
As technically necessary, we store your language choice in a session cookie (NEXT_LOCALE) and your decision in the cookie banner in your browser's local storage (cookie-consent). The legal basis is Section 25(2) No. 2 TDDDG in conjunction with Art. 6(1)(f) GDPR.
Only with your consent does Google Analytics set cookies (_ga, _ga_…) and does our own statistics create a random device ID in local storage (orai-device-id). The legal basis is Section 25(1) TDDDG and Art. 6(1)(a) GDPR. You can withdraw your consent at any time via “Cookie settings” in the footer; the device ID and Google Analytics cookies are then deleted.
Contact and training requests
When you write to us via the contact form or the training request form, we process your details (name, company, email address, message, requested training and language) to answer your request. The legal basis is Art. 6(1)(b) GDPR where your request relates to a contract, otherwise Art. 6(1)(f) GDPR (legitimate interest in answering enquiries).
The request is stored in our database and forwarded to us by email via Microsoft 365; you may receive a confirmation of receipt. Microsoft acts as our processor. To prevent abuse we also store a pseudonymised hash of your IP address (Art. 6(1)(f) GDPR). Submissions that our automatic check classifies as spam are stored without sending any email.
Retention: we delete requests after 24 months and submissions classified as spam after 30 days, unless statutory retention obligations apply.
Booking a meeting
When you book a meeting, we process your name, company, email address and the selected time to arrange and hold the meeting (Art. 6(1)(b) GDPR). For this we create the appointment in a consultant's Microsoft 365 calendar and send you an invitation with a Microsoft Teams link. Microsoft acts as our processor.
Retention: we delete appointment data no later than 24 months after the meeting, unless statutory retention obligations apply.
Download requests in blog posts
When you request a document in a blog post, we process your email address and the other details in the form to send you the document by email via Microsoft 365 (Art. 6(1)(b) GDPR) and to follow up with you about it (Art. 6(1)(f) GDPR, legitimate interest in follow-up). You can object to being contacted at any time.
Retention: we delete this data after 24 months, or earlier if you object.
Form protection: Cloudflare Turnstile
We protect our forms with Cloudflare Turnstile, a service of Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107, USA. Turnstile uses technical characteristics (including IP address and browser and device information) to check whether a form is being filled in by a human. For this the page loads a script from challenges.cloudflare.com.
The legal basis is Art. 6(1)(f) GDPR; our legitimate interest is protecting the forms against automated abuse. Data may be transferred to the USA in the process. Cloudflare is certified under the EU-US Data Privacy Framework, and the EU Commission's standard contractual clauses apply in addition.
4. Audience Measurement and Analytics
Our own audience measurement
To understand which pages are read, we count page views on our own server, without cookies. We store the requested page, the domain of an external referring page, your browser's user agent and a pseudonymous visitor hash. We derive this hash from IP address and user agent with a component that changes daily; we do not store the IP address itself. The legal basis is Art. 6(1)(f) GDPR (legitimate interest in privacy-friendly audience measurement).
Only if you consent in the cookie banner does your browser additionally create a random device ID so that we can recognise returning visits over several days (Section 25(1) TDDDG, Art. 6(1)(a) GDPR). It is deleted when you withdraw consent.
Retention: we delete page views after 90 days.
Google Analytics
Only with your consent do we use Google Analytics 4, a web analytics service of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Before that, Google Analytics is not loaded and no data is sent to Google. Google Analytics sets cookies and processes, among other things, your IP address, device and browser information and your use of this website in order to provide us with reports. We do not use advertising features.
The legal basis is your consent (Section 25(1) TDDDG, Art. 6(1)(a) GDPR), which you can withdraw at any time via “Cookie settings” in the footer. Google may transfer data to Google LLC in the USA; Google is certified under the EU-US Data Privacy Framework. Google Analytics deletes the data after the retention period set in our property (at most 14 months).
Fonts
All fonts are hosted on our own server. Visiting the website does not establish a connection to third-party servers such as Google Fonts.
5. Recipients and Transfers to Third Countries
Besides us, the recipients of your data are our processors Microsoft (hosting, email, calendar and Teams via Microsoft 365) and, for form protection, Cloudflare; with your consent also Google. These providers may also process data outside the EEA, in particular in the USA. The transfers are based on the adequacy decision for the EU-US Data Privacy Framework, under which the providers are certified, and on the EU Commission's standard contractual clauses.