Privacy Policy

1. Controller

The controller within the meaning of the General Data Protection Regulation (GDPR) is:

myBytes GmbH
Am Kaiserkai 69
20457 Hamburg
Germany
Email: compliance@mybytes.com
Commercial register: HRB 197538 (Amtsgericht Hamburg)
Managing directors: Guido Winger, Mariusz Pianowski

2. Principles of Data Processing

We process personal data only to the extent permitted by law or with your consent. The legal bases are:

• Art. 6(1)(a) GDPR – Consent (e.g. newsletter sign-up)
• Art. 6(1)(b) GDPR – Performance of a contract (e.g. consulting inquiries)
• Art. 6(1)(c) GDPR – Legal obligation
• Art. 6(1)(f) GDPR – Legitimate interests (e.g. website security, site analytics)

3. Hosting & Infrastructure

3.1 Server Hosting (Hetzner Online)

This website is operated on a dedicated server at Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany. Hetzner is a provider based in Germany; the data remains in the EU. When the website is accessed, the following data is automatically stored in the server log:

• IP address (anonymized after 7 days)
• Date and time of access
• Page / URL accessed
• HTTP status code, volume of data transferred
• Referrer URL (if transmitted)
• Browser type and operating system (user agent)

Legal basis: Art. 6(1)(f) GDPR (legitimate interest: security, troubleshooting). Retention period: 30 days, followed by automatic deletion.

4. Cookies

This website uses exclusively technically necessary cookies. No tracking, analytics, or marketing cookies are set.

As we use only necessary cookies, no cookie banner is required under Section 25 TTDSG (German Telecommunications Digital Services Data Protection Act). Consent for functional cookies is not necessary.

5. Website Tracking (Cookieless Fingerprinting)

5.1 How It Works

Our tracking system analyzes anonymous signals of each page view (e.g. anonymized user agent, language setting, time zone) to compute a non-persistent session hash. This hash is not permanently linked to your person and merely enables us to compile aggregated usage statistics (page views, time on page, click paths).

5.2 What Is Collected

• Pages visited and time on page
• Clicks and scroll depth
• Campaign parameters (UTM tags, LinkedIn tracking IDs) – only if contained in the URL
• Referrer domain (e.g. linkedin.com)
• Browser type, language setting, time zone (not stored, used only for hash computation)

5.3 What Is NOT Collected

• IP addresses (not stored)
• Personal data without your explicit indication
• Device fingerprint stored permanently

Legal basis: Art. 6(1)(f) GDPR (legitimate interest: analysis of website usage). As no personal data within the meaning of the GDPR is stored, no cookie consent is required.

6. Campaign Tracking (LinkedIn, Google)

If you reach our website via an advertisement, the URL may contain so-called campaign parameters, e.g.:

• utm_source, utm_medium, utm_campaign – origin information
• li_fat_id – LinkedIn First-Party Ad Tracking ID
• gclid – Google Click ID

These parameters are automatically appended to the URL of your clicks by LinkedIn or Google. We store these parameters in anonymized form to measure the success of our campaigns. They are linked to your person only if you simultaneously sign up for our newsletter (in that case with your express consent).

Legal basis: Art. 6(1)(f) GDPR. For LinkedIn's privacy policy, please refer to linkedin.com/legal/privacy-policy.

6.1 Google Ads Conversion Measurement

We run search ads via Google Ads (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland). When you click on one of our ads, Google appends a click identifier (the so-called GCLID) to the destination URL. We store this identifier together with the non-personal session data described above. If you subsequently contact us or request an appointment via one of our forms, we transmit this click identifier and the time of the enquiry back to Google in order to measure which ads lead to enquiries. No names, e-mail addresses, or other form contents are transmitted to Google – only the click identifier generated by Google itself and the timestamp. We do not use cookies for this measurement.

The legal basis is our legitimate interest in measuring the effectiveness of our advertising pursuant to Art. 6(1)(f) GDPR; you may object to this processing at any time (see contact above). Further information on data processing by Google: policies.google.com/privacy.

7. Newsletter and Report Downloads

7.1 Sign-Up and Double Opt-In

You can sign up for our quarterly newsletter "KI in Unternehmen" and/or download our reports. Sign-up takes place via a double opt-in procedure:

1. You enter your email address and click "Sign up".
2. We send a confirmation email to the address provided.
3. Your sign-up only takes effect after you click the confirmation link.

Data stored upon sign-up:

Legal basis: Art. 6(1)(a) GDPR (consent).

7.2 Direct Report Download (Without Sign-Up)

You can also download our reports without signing up for the newsletter. In this case, we store:

• Timestamp of the download
• Campaign parameters (UTM, if contained in the URL)
• Hashed IP address (no identification of individuals possible)

Legal basis: Art. 6(1)(f) GDPR (legitimate interest: reach measurement).

7.3 Newsletter Unsubscription (Opt-Out)

You can unsubscribe from the newsletter at any time without giving reasons:

• Via the link in every email: Every newsletter email contains a unique unsubscribe link.
• Directly: mybytes.com/newsletter/abmelden (token from email required)
• By email: compliance@mybytes.com

After unsubscription, your active data is blocked. The consent documentation (email, timestamp) is retained for a further 3 years for legal reasons and then deleted.

7.4 Email Delivery (Mailcow / Own Server)

Emails (confirmations, newsletters) are sent via our own email server (Mailcow) on the Hetzner server. No third-party email services (e.g. Mailchimp, Brevo) are used. Your email address is not passed on to third parties.

8. Contact Form and Consulting Inquiries

When you use our contact forms or consulting inquiries, the data you provide (name, email, message) is processed to handle your inquiry. This data is not used for other purposes (e.g. newsletter) without your consent.

Retention period: 3 years after the communication has concluded, unless a longer statutory retention obligation applies. Legal basis: Art. 6(1)(b) or (f) GDPR.

9. External Fonts (Google Fonts)

This website uses Google Fonts. The fonts are loaded from the Google server, whereby your IP address is transmitted to Google. Provider: Google LLC, USA. Privacy policy: policies.google.com/privacy.

Legal basis: Art. 6(1)(f) GDPR. We are in the process of hosting the fonts locally in order to avoid the transmission to Google.

10. Security

Our website uses HTTPS encryption (TLS). Access is automatically monitored by Fail2ban and CrowdSec. Passwords are stored exclusively in hashed form. Regular security updates and backups are performed.

11. Your Rights Under the GDPR

You have the following rights vis-à-vis us as the controller:

To exercise your rights, please contact: compliance@mybytes.com

You also have the right to lodge a complaint with the competent data protection supervisory authority:
Hamburgischer Beauftragter für Datenschutz und Informationsfreiheit (Hamburg Commissioner for Data Protection and Freedom of Information)
Ludwig-Erhard-Str. 22, 20459 Hamburg · datenschutz.hamburg.de

12. Disclosure of Data to Third Parties

We do not pass on your personal data to third parties, except where:

• You have expressly consented
• A legal obligation exists (e.g. duty to provide information to authorities)
• It is necessary for the performance of a contract (e.g. tax advisor for accounting, subject to a duty of confidentiality)

13. Retention Periods at a Glance

14. Changes to This Privacy Policy

We reserve the right to amend this privacy policy in the event of changes to our data processing practices or legal requirements. The current version is always available at mybytes.com/datenschutz. The date of the last update is stated above.