Last updated: November 2026

1. Controller

Cybervize Consulting GmbH
Graf-Adolf-Str. 41
40210 Düsseldorf
Germany

Phone: +49 211 1587 4939
Email: contact@cybervize.de
Managing Director: Alexander Busse

Commercial register: District Court Düsseldorf, HRB 101465
VAT ID: DE347501488

Scope of this policy

This policy covers www.cybervize.de and the appointment booking at book.cybervize.de. Two links on our website lead to separate offerings governed by their own terms:

app.cybervize.de: OdySecure. Access is reserved for customers. For the data our customers process in the platform we act as a processor; the respective contract and its data processing agreement govern that. Alongside this, we process data there as a controller in our own right, for example for user accounts, sign-in and access and security logs. Users receive the information required under Art. 13 and 14 GDPR for that within the application itself. Clicking the login link opens the application; this transmits your IP address and browser information to our server.
community.cybervize.de: the community area with its own sign-in. The privacy notices published there apply.

2. Overview of Data Processing

The following overview summarizes the types of data processed and the purposes of their processing.

Types of Data Processed

Inventory data (e.g., names, addresses)
Contact data (e.g., email, phone numbers)
Content data (e.g., form inputs, messages)
Usage data (e.g., pages visited, access times)
Meta/communication data (e.g., IP addresses, device information)

Categories of Data Subjects

Visitors and users of the website
Communication partners (contact form, email, support chat)

Purposes of Processing

Provision of the website and its content
Responding to contact inquiries
Sending the blog subscription (email when new articles are published)
Appointment scheduling
Reach measurement and web analytics
Security measures
Consent management

3. Legal Bases

Below you will find an overview of the legal bases of the GDPR on which we process personal data.

Consent (Art. 6(1)(a) GDPR): The data subject has given consent to the processing of their personal data for one or more specific purposes (e.g., analytics cookies, marketing cookies).
Contract performance and pre-contractual inquiries (Art. 6(1)(b) GDPR): Processing is necessary for the performance of a contract or for pre-contractual measures (e.g., contact inquiries, appointment bookings).
Legitimate interests (Art. 6(1)(f) GDPR): Processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party (e.g., technically necessary cookies, security measures, server logs).

4. Security Measures

We take appropriate technical and organizational measures in accordance with legal requirements, taking into account the state of the art, implementation costs, and the nature, scope, circumstances, and purposes of processing to ensure a level of protection appropriate to the risk.

These measures include securing the confidentiality, integrity, and availability of data by controlling access to data, as well as encrypting transmission via SSL/TLS (recognizable by the lock icon in your browser and the address line with "https://"). TLS protects the transport path between your device and our server. It protects neither the endpoints themselves nor the subsequent processing: on the server the data is present in the clear, and authorised recipients such as processors see it in the clear. How we secure that processing is set out in the sections on the individual services.

5. Rights of Data Subjects

As a data subject, you are entitled to various rights under the GDPR:

Right to object (Art. 21 GDPR): You have the right to object at any time to the processing of your personal data based on Art. 6(1)(f) GDPR for reasons arising from your particular situation.
Right to withdraw consent: You have the right to withdraw any consent given at any time. The withdrawal of consent does not affect the lawfulness of processing carried out prior to the withdrawal.
Right of access (Art. 15 GDPR): You have the right to request confirmation as to whether personal data concerning you is being processed and to obtain access to that data.
Right to rectification (Art. 16 GDPR): You have the right to request the completion or correction of inaccurate data.
Right to erasure (Art. 17 GDPR): You have the right to request the immediate deletion of data concerning you.
Right to restriction of processing (Art. 18 GDPR): You have the right to request the restriction of processing.
Right to data portability (Art. 20 GDPR): You have the right to receive your data in a structured, commonly used, and machine-readable format.
Right to lodge a complaint with a supervisory authority: Without prejudice to any other administrative or judicial remedy, you have the right to lodge a complaint with a supervisory authority. The competent authority for us is: Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen, Kavalleriestr. 2-4, 40213 Düsseldorf.

6. Website Hosting

Vercel

Our website is hosted by Vercel Inc. (440 N Barranca Ave #4133, Covina, CA 91723, USA). Each time you access our website, Vercel automatically collects information in server log files that your browser transmits. This includes:

IP address of the requesting device
Date and time of the request
Requested URL and referrer URL
Browser type and operating system
Amount of data transferred

Legal basis: Legitimate interests (Art. 6(1)(f) GDPR). Our legitimate interest lies in the stable and secure provision of the website.

Third country transfer: Vercel processes data in the USA. The transfer is based on the EU-U.S. Data Privacy Framework. Further information: Vercel Privacy Policy.

7. Consent Management

Cookie banner

To obtain and manage your cookie consent, we use a self-hosted open-source solution. No data is transmitted to an external service provider and no IP address is processed.

Your consent decision is stored exclusively locally in your browser, in a cookie named "cc_cookie" that contains your cookie preferences (necessary / statistics / marketing) and the time of the decision. Your consent is not logged server-side.

The cookie has a storage duration of 12 months. You can adjust or withdraw your consent at any time via the "Cookie settings" link in the footer of every page or in our cookie policy.

Legal basis: Storing or reading the information required for consent on your device is based on Section 25(2)(2) TDDDG; the management of consent is based on our legitimate interest in legally compliant consent documentation (Art. 6(1)(f) GDPR).

8. Web Analytics

Google Tag Manager and Google Analytics

We use Google Tag Manager (GTM) and Google Analytics by Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Ireland). Google Tag Manager itself does not store personal data but serves as a tool for managing tags and tracking services.

Google Analytics is integrated via the Tag Manager and uses cookies to enable analysis of website usage. The information generated by the cookie about your use of this website is usually transmitted to a Google server.

We use Google Consent Mode v2. The Tag Manager container is only loaded after you have consented to the statistics category in our cookie banner. As long as you have not, no Google script runs, no tracking cookies are set and no data reaches Google. If you withdraw consent later, we immediately set storage access to denied via Consent Mode. The container already loaded stays in the document for the current page view and is not loaded again on the next one.

Data processed: Usage data (pages visited, dwell time, click behavior), device information and your IP address. The IP address is processed when the connection is established and for coarse geolocation, and is discarded by Google before Google Analytics logs it; it is not stored. The transmission to Google servers does take place.

Storage duration: Session to 2 years, depending on the cookie type.

Legal basis: Consent (Art. 6(1)(a) GDPR).

Third country transfer: Google may process data in the USA based on the EU-U.S. Data Privacy Framework. Further information: Google Privacy Policy.

Opt-out: You can withdraw your consent at any time via the cookie banner or use the browser plugin to deactivate Google Analytics: https://tools.google.com/dlpage/gaoptout.

9. Contact Form and Email Communication

Contact Form

When you contact us via our contact form, we process the data you provide to handle your inquiry. This includes:

Name (required)
Email address (required)
Company (optional)
Phone number (optional)
Subject (required)
Message (required)

Self-assessments (security check and NIS-2 maturity check)

On the pages “security check” and “NIS-2 maturity check” you can fill in a questionnaire. Answering the questions and evaluating them happens entirely in your browser. Your answers are not transmitted to us and not stored by us.

Only if you explicitly ask for your result to be sent to you at the end do you transmit your contact details together with the completed questionnaire. Delivery happens in two steps (double opt-in):

You first receive only a short confirmation email without your result. It contains a link valid for seven days. We do not store your details for this: they sit cryptographically signed inside that link.
Only once you click the link do we send your results with the 90-day roadmap to your address and notify ourselves so that we can respond to it.

Without that click, nothing further happens. We do not process the address, and the link lapses. This means nobody can enter a third party's address and have an email from us sent to them this way. Delivery uses the same provider as the contact form (see “Email delivery” below). This does not enrol you in a newsletter or mailing list.

Email address (required to send the result)
Company (optional)
Your complete result: the rating per area, your largest gaps and your individual answers to every question, so that we can follow the result and respond to it

Legal basis: performance of a contract and pre-contractual requests (Art. 6(1)(b) GDPR), as the transmission happens at your request. Without that request your answers never leave your browser.

Email Delivery via Brevo

For sending contact form messages, we use the service Brevo (formerly Sendinblue) by Brevo GmbH (Köpenicker Str. 126, 10179 Berlin, Germany). Brevo processes the data entered in the form exclusively for the purpose of delivering the email to us.

Legal basis: Contract performance and pre-contractual inquiries (Art. 6(1)(b) GDPR). The processing serves to handle your inquiry.

Storage duration: Your data will be deleted as soon as it is no longer required for the purpose for which it was collected. For contact inquiries, this is generally the case when the conversation has ended and the matter has been conclusively resolved.

Further information: Brevo Privacy Policy.

Blog subscription (email when new articles are published)

On our blog pages you can subscribe to our blog. We then send you an email whenever a new article is published. For this we process only your email address and the language of the page on which you subscribed (German or English).

Confirmation (double opt-in): After you submit the form you receive a confirmation email. We add your address to the subscription list only once you click the link in it. Without that click you receive no further email. This is meant to prevent anyone from signing up a third party's address without their involvement. Brevo stores the time and the confirmation as proof of your consent.

Service provider: Sign-up, subscription list and delivery are handled by Brevo (Brevo GmbH, Köpenicker Str. 126, 10179 Berlin, Germany) as our processor. The sign-up form is part of our website and loads no Brevo scripts into your browser.

Open and click tracking: for every subscription email, Brevo records whether it is opened and which links in it are clicked. For this the email contains an invisible counting image, and links first pass through a Brevo server that records the click and then forwards you to the article. This processes the time, your IP address and information about your email program and device. We use this information only in aggregate, to see which articles are read; we do not build a profile of you. Brevo offers no way to switch this tracking off for the subscription emails. If you do not want it, you can block the loading of images in your email program; clicks on links will still be recorded.

Legal basis: your consent given when subscribing, for delivery and for open and click tracking (Art. 6(1)(a) GDPR, § 25(1) TDDDG). You can withdraw it at any time with effect for the future, via the unsubscribe link in every subscription email or by sending us a message.

Storage period: we keep your address until you unsubscribe. If you do not confirm the sign-up, Brevo does not add the address to the subscription list.

Phone / AI phone assistant

When you call us, our AI phone assistant answers the call first. It says so itself at the start. It takes down your request, your name, your company and your contact details and, where possible, puts you through to a contact person.

We process: the number you are calling from (unless withheld), the time and duration of the call, the details you give and a written transcript of the conversation. No audio recording is stored.

Processing takes place on our own systems in Germany; your details are not transmitted to external AI services.

The purpose is to handle your request and, where applicable, to prepare a contract (Art. 6(1)(b) GDPR), as well as our legitimate interest in being reachable in an orderly way (Art. 6(1)(f) GDPR).

Data in the phone assistant is deleted after 90 days. We keep the details of vendors who present an offer to us (company, offer, phone number) for 365 days so that we can compare offers. Enquiries that lead to a business relationship are transferred to our customer management system, where its retention periods apply.

You can exercise your rights of access, rectification, erasure, restriction and objection at any time at contact@cybervize.de.

10. Appointment Booking

Cal.com (self-hosted)

For online appointment booking, we use a self-hosted instance of the open-source software Cal.com on our own servers in the EU (available at book.cybervize.de). No external booking service is involved. We integrate the booking in two ways:

Redirect: Booking links on our website (paths under /go/) redirect you to book.cybervize.de. A connection is only established once you click the link.
Embedding: On the "Book an appointment" page, the booking form is embedded as an iframe. Your browser connects to book.cybervize.de as soon as the iframe scrolls into view, without you having to click anything. This transmits your IP address and browser information to our own server. No external booking service is involved; OVHcloud acts as a processor for server operations (see the hosting section).

When booking an appointment, we process the data you enter (e.g., name, email address, desired appointment time, answers to booking questions) as well as technical data (IP address, browser information).

Legal basis: Contract performance and pre-contractual inquiries (Art. 6(1)(b) GDPR). The appointment booking serves to initiate a business relationship.

Recipients: To conduct the appointment, the calendar entry including the video conference link is created via Google Calendar/Google Meet (Google Ireland Ltd., Gordon House, Barrow Street, Dublin 4, Ireland); booking confirmations and reminders are sent via the email service provider Mailgun (EU region, Sinch Sweden AB) acting as a processor. Google may also process data in the USA (EU-U.S. Data Privacy Framework).

Retention: Booking data is deleted once it is no longer required for conducting and following up on the appointment, at the latest when the business purpose ceases and statutory retention periods expire.

11. Podcast Integration

Spotify

On our website, we embed a podcast player from Spotify AB (Regeringsgatan 19, 111 53 Stockholm, Sweden) as an iFrame. When loading the player, Spotify may set cookies and process technical data (IP address, browser information, device ID).

Legal basis: Consent (Art. 6(1)(a) GDPR). The Spotify player is only loaded after your consent via the cookie banner.

Third country transfer: Spotify may process data in countries outside the EU/EEA. Further information: Spotify Privacy Policy.

Providing our podcast

We provide our podcast ourselves. Our website serves the feed. Audio files, cover images, transcripts and chapter marks are stored with Scaleway (Scaleway SAS, 8 rue de la Ville l'Evêque, 75008 Paris, France) in a data centre in Paris. Scaleway acts as our processor. When you access them, Scaleway processes technical data such as IP address and browser information to deliver the files.

We count how often each episode is accessed. For each access we store the time, the episode, the name of the requesting app from the user agent and a pseudonymous daily identifier. We derive the daily identifier from date, IP address and user agent using a secret key. It changes every day. Without this key it cannot be traced back to the IP address. We do not store the IP address itself. We delete the counting data after 24 months.

Legal basis: Legitimate interests (Art. 6(1)(f) GDPR). Our legitimate interest lies in providing our podcast and in seeing which episodes people listen to.

Further information: Scaleway Privacy Policy.

12. Content Management System

Sanity CMS

For managing our blog content, we use Sanity (Sanity AS, Grønland 32, 0188 Oslo, Norway). Sanity serves as a headless CMS for providing content. When delivering content via the Sanity API, technical data (IP address) may be processed.

Legal basis: Legitimate interests (Art. 6(1)(f) GDPR). Our legitimate interest lies in the efficient management and provision of our website content.

Further information: Sanity Privacy Policy.

13. SSL/TLS Encryption

This website uses SSL/TLS encryption for security reasons and to protect the transmission of confidential content, such as inquiries you send to us as the site operator. An encrypted connection is indicated by the browser address line changing from "http://" to "https://" and by the lock icon in your browser bar.

With SSL/TLS encryption active, the data is protected against being read in transit between your device and our server. The protection ends at the endpoints: on our server the data is present in the clear, and parties we lawfully involve, such as processors, see it in the clear. Which ones those are, and on what basis, is set out in the sections on the individual services.

14. Changes to This Privacy Policy

We reserve the right to adapt this privacy policy to ensure it always complies with current legal requirements or to implement changes to our services. The new privacy policy will apply to your subsequent visits.

15. Cookie Declaration

A detailed list of all cookies used on this website, broken down into necessary, statistics, and marketing cookies, can be found in our cookie policy.

16. Advisory Chat (Website Assistant)

On this website an automated assistant answers questions about our content. It is bound to the text of this website and names the page each statement comes from. The controller is the entity named in the section "Controller".

No third-party service. Unlike the support chat, nothing is loaded: there is no external program and no connection to an external server. Your message travels via our own web server to a service on our own infrastructure in Germany, which talks to a language model on our own machines. No third-party AI service is involved. Your messages are not used to train models.

One single, purely technical cookie. So that several visitors behind the same internet connection (office, mobile network) do not lock each other out when one of them sends many messages, our web server sets a cookie named beratung_sitzung: 32 purely random characters with no link to you as a person, not readable by the page itself (HttpOnly), and automatically expiring after 24 hours. It serves to recognise multiple messages from the same browser. This lets us limit the number of requests per browser and link the questions of one conversation to each other in the stored conversation history (see below). It serves no tracking, no recognition beyond those 24 hours, and is not passed on to anyone. Setting and reading this one cookie does not require consent: it is strictly necessary to provide the service you requested (Section 25(2) no. 2 TDDDG). Linking the questions in the conversation history uses the check value our web server derives from the cookie for the limit anyway (next paragraph); there is no second cookie and no further access to your device for this.

What is processed. The text you enter and the selected language. In addition, our web server derives two separate pseudonymous identifiers, each a keyed check value: one from the random value of the cookie described above, another from your IP address (for IPv6 computed only over the network range, not the full address). Both serve to limit the number of requests and thereby protect the service against overload and misuse: the first narrowly per browser, the second more generously per internet connection, as an additional safeguard against repeatedly freshly generated cookies. The first also links the questions of one conversation in the conversation history; we use the second only for the limit. Your IP address itself is not transmitted to the advisory service and is not stored there.

What is stored and for how long. For each of the two identifiers we store how many requests came from it in the current time window and on the current day, and when it last appeared. These counters are deleted once an identifier has not appeared for 26 hours. We store your conversation as a conversation history (next paragraph). The advisory service's operational logs contain time, duration and the identifier, not the text of your messages. The log of the interface to our language model contains your questions and the answers; we keep it as an operational log for operations and troubleshooting.

Conversation history. So that we can check whether the assistant answers your questions correctly and improve its answers, we store every conversation on our advisory service. We store the time and duration, the language, your questions and the assistant's answers, the sources and pages it cited, its working steps (for example which content it searched) and the results of the checks on its answer. For the outcome of each question we store whether you left contact details, whether a link to book an appointment was offered and whether an error occurred. We link the questions of one conversation through the pseudonymous identifier from the cookie. Your IP address and the identifier of your internet connection are not part of the conversation history. Whatever you write in your messages is in it, including a name, an email address or a phone number. The conversation history is deleted automatically after 12 months.

Objection and erasure. You can object to the storage of your conversation history at any time and ask for it to be erased. Write to us using the contact details in the "Controller" section. As a conversation history is not linked to a name, please tell us the approximate date and time and the content of your question so that we can find it.

If you leave your contact details. If a question remains open, the assistant offers to answer it by email. Only then, and only through your active input, do we process your name, email address and, where given, your company. These details take the same route as an enquiry via the contact form (see there) and are also stored in our own customer management system so that we can handle your enquiry. Without your input this does not happen; the assistant does not invent addresses. Because you write these details in the chat, they are also in the conversation history (see above).

No automated decision-making. The assistant answers questions; it does not take any decision about you within the meaning of Art. 22 GDPR. Its answers are machine-generated, may contain errors and are not binding.

Legal basis: For answering your question, our legitimate interest in providing prompt and competent information to interested parties (Art. 6(1)(f) GDPR). For limiting requests per browser and per internet connection, our legitimate interest in secure and available operation (Art. 6(1)(f) GDPR). For storing the conversation histories, our legitimate interest in checking and improving the quality of the answers (Art. 6(1)(f) GDPR). Setting and reading the beratung_sitzung cookie, which is what makes the per-browser limit possible in the first place, does not require consent because it is strictly necessary to provide the service you requested (Section 25(2) no. 2 TDDDG). If you leave contact details, the basis is the performance of pre-contractual measures (Art. 6(1)(b) GDPR).

Recipients and third-country transfers: The advisory service and the language model run on our own infrastructure in Germany. No third-party provider is involved. The website itself is hosted by Vercel in the USA, so the request passes through their servers; see the section on website hosting. For the forwarding of your contact details, the statements in the contact form section apply.