Privacy policy

Derlo Consulting & Protection
Owner: Marc Derlich
Klettenweg 3
50226 Frechen

Phone: +49 179 3932834
Email: info@derlo-cp.de

This website is hosted by Vercel Inc., 440 N Barranca Ave #4133, Covina, CA 91723, USA (“Vercel”). Vercel delivers the pages through a global server network; visitors from Europe are usually served from servers in Europe. Server functions, such as processing the enquiry form, run in Frankfurt am Main, Germany; redirects and language selection are handled by the data centre closest to you. Each time a page is requested, Vercel processes technically necessary data in order to deliver the website and protect it against attacks:

• IP address of the requesting device
• date and time of access
• requested URL and amount of data transferred
• status code of the response
• previously visited page (referrer), where sent by the browser
• browser and operating system (user agent) and the browser's language setting

The legal basis is Art. 6(1)(f) GDPR. Our legitimate interest lies in the secure, stable and fast delivery of the website. The logs we can view in our Vercel account are deleted automatically after one day at the latest; Vercel may store connection data for longer in order to defend against attacks and abuse (vercel.com/legal/privacy-policy). Vercel is certified under the EU-U.S. Data Privacy Framework; transfers to the USA are based on the European Commission's adequacy decision of 10 July 2023 (Art. 45 GDPR).

Our hosting provider Vercel (see the Hosting section) delivers fonts, images and videos from our own domain. Your browser does not connect to Google or any other third-party provider for this.

On some pages we show reviews from our Google Business Profile. Our server retrieves them via the Google Maps Platform Places API; the provider is Google Cloud EMEA Limited, 70 Sir John Rogerson's Quay, Dublin 2, Ireland. Your browser receives the reviews from our server. Each time a page is requested, our server also fetches the reviewers' profile pictures from Google and passes them on to your browser without storing them. No data about you is transmitted to Google when the page loads. To limit the number of requests, our server counts them using Upstash (Upstash, Inc.); only numbers are stored, no data about you. The legal basis is Art. 6(1)(f) GDPR. Our legitimate interest lies in showing prospective clients the reviews from our Google Business Profile.

We show the information that reviewers have made public on Google: name or profile name, profile picture, link to the Google profile, star rating, text and approximate date. We do not store this information; it is fetched from Google again on every visit. If a reviewer deletes or changes their review on Google, this is reflected here too. Under Art. 21 GDPR, reviewers can object to their review being displayed (info@derlo-cp.de). Google Maps content is subject to the Google Maps/Google Earth Additional Terms of Service and the Google Privacy Policy.

Links to Google – such as “All reviews on Google” and “Write a review”, and links to individual reviews or to reviewers' Google profiles – open pages on Google, where the Google Privacy Policy applies.

If you contact us via the enquiry form, we process the details you give about the occasion, date, location and scope, together with your message, your name and your phone number or email address. The form does not store your enquiry on the website; it sends it to us by email.

The same applies if you contact us by email or phone. Enquiries sent by form or email arrive in our email inbox. The inbox is operated for us by IONOS SE, Elgendorfer Str. 57, 56410 Montabaur, as our processor. We use your details to handle your enquiry, to clarify any follow-up questions and, if you go on to engage us, to carry out the assignment. The legal basis is Art. 6(1)(b) GDPR where your enquiry is aimed at entering into a contract with us (for example for close protection, event security or a course), and otherwise Art. 6(1)(f) GDPR; our legitimate interest lies in answering enquiries. To reply, we need your name and a phone number or email address; without these details we cannot process your enquiry. In addition, all fields in the form that are not marked “optional” must be completed before it can be sent. Please only include in the form what is needed for an initial consultation; we are happy to discuss confidential details, for example about your health or a specific threat, in person. We delete enquiries that do not lead to an engagement no later than six months after the last message. If you do engage us, we keep business correspondence for six years and invoices and other accounting records for eight years (section 147(1) and (3) of the German Fiscal Code, AO; the legal basis is Art. 6(1)(c) GDPR) and delete them afterwards.

The WhatsApp button is a simple link. WhatsApp only opens when you tap or click it; before that, no data is transferred to WhatsApp. The provider is WhatsApp Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland. If you message us there, we process your phone number, your profile name and the content of your messages in order to answer your enquiry (Art. 6(1)(b) GDPR, otherwise Art. 6(1)(f) GDPR). WhatsApp processes metadata (such as timestamps and device information) under its own responsibility and may transfer data to WhatsApp LLC and Meta Platforms, Inc. in the USA on the basis of the EU-U.S. Data Privacy Framework. The deletion periods stated above apply to the messages. Details: whatsapp.com/legal/privacy-policy-eea. If you do not want this, you can reach us by phone, by email or through the form.

If you apply to work with us, whether via the form or by email, phone or WhatsApp, we process your details and documents (such as your name, contact details, CV, qualifications and certificates under section 34a GewO) in order to decide whether we will work together. The legal basis is Art. 6(1)(b) GDPR. Please only send us a police clearance certificate (Führungszeugnis) if we explicitly ask for one. If we do not end up working together, we delete your documents six months after we have declined your application; we keep them for that long so that we can defend ourselves against any claims (Art. 6(1)(f) GDPR). We only keep them longer with your consent, for example for future assignments. If we do work together, we use your details to carry out our collaboration (Art. 6(1)(b) GDPR) and delete them once it has ended, unless statutory retention obligations apply. For the way your application reaches us (form, email inbox at IONOS SE, WhatsApp), the information in the “Contact” section applies accordingly.

This website only sets the language cookie described in the section “Language selection and language cookie”, and only once you choose a language. We do not use analytics or marketing services, so we do not ask for your consent.

If you choose a language in the language menu (header, menu or footer), we store this choice in the cookie derlo_lang. It contains only the language code (de, en or ar), applies only to this website and is deleted automatically after 12 months at the latest. As long as it is set, we no longer redirect you automatically to another language version. The cookie is strictly necessary for the language selection you have expressly requested; no consent is required for it (section 25(2) no. 2 TDDDG). The legal basis for the processing is Art. 6(1)(f) GDPR; our legitimate interest lies in offering the website in the language you have chosen. You can delete the cookie in your browser at any time.

Automatic language selection: If you open a German page and your browser's language settings (the HTTP header “Accept-Language”) do not include German, we redirect you to the same page in English or Arabic, depending on those settings. We evaluate this setting only for the individual page request; we store it neither in a cookie nor in a profile (for server logs, see the section “Hosting and server logs”). We also use the information your browser sends anyway (browser identifier, type and origin of the request) to check whether the request comes from outside this website: we never redirect requests made within the website or by search engines. Your IP address and location play no part in this. You can choose a different language at any time in the language menu. The legal basis is Art. 6(1)(f) GDPR; our legitimate interest lies in showing you the website in a language you understand.

You have the following rights in relation to us:

• access to the data we hold about you (Art. 15 GDPR)
• rectification of inaccurate data (Art. 16 GDPR)
• erasure (Art. 17 GDPR)
• restriction of processing (Art. 18 GDPR)
• data portability (Art. 20 GDPR)
• withdrawal of any consent you have given, with effect for the future (Art. 7(3) GDPR)

We do not use automated decision-making, including profiling (Art. 22 GDPR).

You also have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR). The supervisory authority responsible for us is the Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen (North Rhine-Westphalia Commissioner for Data Protection and Freedom of Information), Kavalleriestraße 2–4, 40213 Düsseldorf.

To make a request about your data, simply send a message to info@derlo-cp.de.

Right to object under Art. 21 GDPR

Where we process data on the basis of a legitimate interest (Art. 6(1)(f) GDPR), you may object at any time on grounds relating to your particular situation.

The connection to this website is encrypted with TLS throughout (indicated by “https://” and the padlock icon in your browser). We also take technical and organisational measures to protect your data against loss, manipulation and unauthorised access.

Last updated: October 2026. We update this policy whenever there are changes to the website, the services we use or the legal situation.