Privacy Notice

1 Controller and contact details

This privacy notice explains how personal data is processed when you visit www.eighty4.de and when you make enquiries about interim management and consulting through the contact channels offered on the website.

EIGHTY4 Solutions UG (haftungsbeschränkt)
Rheinaue 111, 46535 Dinslaken, Germany
Represented by Managing Director Björn Frese
Email: bjoern.frese@eighty4.de
Telephone: +49 160 2055055
Data protection contact: Björn Frese, privacy@eighty4.de

We provide supplementary information on proposals, contracts and projects in the course of the relevant engagement. Separate notices apply to rentals and enquiries through rental platforms.

2 Hosting and technical access data

Our website uses GoDaddy shared hosting. The provider of GoDaddy.com services is GoDaddy.com, LLC, 100 S. Mill Ave, Suite 1600, Tempe, AZ 85281, USA. When you access the website, the hosting service processes your IP address and the technical connection and request data required to transmit and respond to the request. Access and error logs are used to provide the website, resolve errors and protect against attacks.

The legal basis is Article 6(1)(f) GDPR. Our legitimate interest is to present our services through a functional and secure website. Without the data required to establish the connection, the requested page cannot be delivered.

According to GoDaddy, the hosting logs it manages are cleared on a seven-day cycle by regularly rotating the log files. This is the log rotation described for the shared hosting service we use. Where data is separately required to investigate a specific security incident, retention is determined by the completion of the investigation and the necessary remedial measures; we deal separately with evidence that remains necessary for legal claims. GoDaddy information on hosting logs

GoDaddy processes personal data arising from the hosting services under its Data Processing Addendum. In providing the services, data may be processed outside the European Economic Area, particularly in the USA. GoDaddy identifies the EU–US Data Privacy Framework as the basis for transfers to the USA covered by its certification. For other relevant transfers, Annex 4 of the agreement provides, in particular, for EU Standard Contractual Clauses. The DPF information identifies GoDaddy.com, LLC as a covered entity. The safeguards are available through the linked agreement; you may request further information at privacy@eighty4.de.

3 Cookies and external links

Our website does not use cookies or tools to analyse your website visit or track it for advertising purposes. Fonts and images are served together with the website.

Microsoft Bookings, WhatsApp and LinkedIn can be accessed through ordinary external links. Their content is not embedded in our website. Opening a link takes you to the relevant external service, where the operator may process technical access data. The providers’ own privacy notices also apply to processing for which they are responsible. We explain our subsequent handling of appointment bookings and messages below.

4 Enquiries and business communications

If you contact us by email, telephone or the contact form, we process the contact details and information about your enquiry that you provide. This may include your name, email address, telephone number, company affiliation, messages and attachments, and details of the proposed engagement. We need this data to respond to your enquiry and agree the next steps with you.

If you are personally a prospective or existing party to a contract, the necessary processing is based on Article 6(1)(b) GDPR. If you contact us as a company’s contact person or about another business matter, Article 6(1)(f) GDPR applies. Our legitimate interest is to handle enquiries appropriately and communicate reliably with the relevant individuals. Retention required by law is based on Article 6(1)(c) GDPR in conjunction with the provisions explained in section 7.

Contacting us is voluntary. Without sufficient information about your enquiry and a suitable means of contacting you for follow-up questions, we may be unable to deal with your enquiry. Additional information that is not required is optional.

Contact form

Messages submitted through the contact form are sent via GoDaddy to bjoern.frese@eighty4.de. We handle incoming messages in Microsoft 365 and generally enter them in HubSpot together with the necessary contact details. The contact form requires your name, email address, the nature of your enquiry and a description of the assignment. Company, preferred start date, work location or working arrangement, and a telephone number for a callback are optional. The purposes and legal bases described above apply.

Microsoft 365

We use Outlook for email and OneDrive and SharePoint to store and exchange business documents. Microsoft’s European provider is Microsoft Ireland Operations Limited, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, Ireland. The data processed includes the necessary contact details, messages, attachments and documents, as well as associated appointment, access and technical connection data. The purposes and legal bases are those described above for handling enquiries and contracts.

When providing its business services, Microsoft generally processes the data submitted to it as a processor under its data protection terms. For limited business operations of its own, such as billing, account administration and compliance with its own legal obligations, Microsoft acts as a controller in its own right. Details are set out in the Microsoft Privacy Statement.

In this context, data may be processed outside the European Economic Area, particularly by Microsoft Corporation in the USA and the subprocessors used. Microsoft bases transfers for its enterprise services on EU Standard Contractual Clauses under Article 46 GDPR. These are available through the Microsoft Data Protection Addendum. You may request further information and a copy of the applicable safeguards at privacy@eighty4.de.

Contact management with HubSpot

To handle and follow up enquiries, we generally store contact details, the subject of the enquiry and related emails in HubSpot. This supports organised contact and customer management on the legal bases explained above. Our use of HubSpot as a customer management system does not involve embedding HubSpot tracking on the website.

HubSpot processes this CRM data as a processor. Recipients include HubSpot, Inc., Two Canal Park, Cambridge, MA 02141, USA. The EU–US Data Privacy Framework applies to transfers to HubSpot, Inc. covered by its certification. The HubSpot Data Processing Agreement also contains EU Standard Contractual Clauses and makes the safeguards available. It provides for Module 2 for transfers from a controller to a processor. Information and a copy are also available on request at privacy@eighty4.de.

Optional tracking of email opens and link clicks

With your prior, separate consent, we use HubSpot to measure whether and when our emails are opened and links within them are clicked. We use an invisible tracking image and appropriately tagged links for this purpose. Open and click events can be linked to your email address and contact record. The purpose is to assess the response to our emails. A technically recorded image request does not reliably prove that you have personally read a message.

The legal basis is Article 6(1)(a) GDPR and, where information is stored on or accessed from your terminal equipment, section 25(1) TDDDG. Consent is voluntary and may be withdrawn at any time with effect for the future by contacting privacy@eighty4.de. No such tracking takes place without consent; normal communication and the handling of your enquiry remain possible. The information above applies to HubSpot and its transfers to third countries.

We delete individual tracking events no later than 90 days after they are recorded, or earlier if consent is withdrawn. We retain necessary evidence of consent for as long as the processing based on it continues. Once that processing ends, we retain only the evidence needed, at most until the end of the third calendar year following the year in which the processing ended; we delete it earlier if it is no longer needed. Compliance with our obligation to demonstrate consent is based on Article 6(1)(c) in conjunction with Article 7(1) GDPR. Where evidence is subsequently required to protect our rights, Article 6(1)(f) GDPR applies; our legitimate interest is to defend against claims relating to the processing concerned. Any specific ongoing dispute is dealt with separately under section 7. The retention periods in that section also apply to ordinary correspondence.

5 Appointment bookings and online meetings

You can arrange a meeting using Microsoft Bookings through the booking link. Opening the link takes you to Microsoft, where technical access data is generated. We process the contact and appointment details you provide, particularly your name, email address, selected appointment and information about your enquiry, to organise the meeting, confirm appointments or manage appointment changes. Bookings stores booking data in Exchange within Microsoft 365.

We conduct online meetings using Microsoft Teams. This involves processing the identity details you provide, appointment and connection data, and the meeting content transmitted. If a microphone or camera is enabled, this includes audio or video data; chat messages, shared files and screen content may also be processed. Technical device, usage and diagnostic data is used to operate the service. The enquiry or contract-related legal bases in section 4 and the information about Microsoft in that section apply to our appointment management and conduct of meetings.

We do not use native Teams features for recording, transcription or AI analysis. The use of Fireflies in our consulting activities is a separate processing operation; booking an appointment does not constitute consent to such capture. Separate information must be provided and the necessary consent obtained before any such recording. Bookings and Teams are optional ways of contacting us; alternatively, you can reach us by email or telephone.

6 WhatsApp and communication backups

If you contact us via WhatsApp, we process your telephone number, the profile information visible to us, messages, attachments and message timestamps to handle your enquiry. We use WhatsApp and the WhatsApp Business App. The provider in the EU is WhatsApp Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland.

Article 6(1)(b) GDPR applies to contract-related enquiries from natural persons; Article 6(1)(f) GDPR applies to other business communications. Our legitimate interest is to handle your message through the contact channel you have chosen. You may contact us by email or telephone instead.

WhatsApp’s access to the address book is restricted to selected contacts. We allow WhatsApp to access only those business contacts with whom we communicate about an ongoing enquiry or contract using WhatsApp as a contact channel they have chosen or agreed with us. The telephone numbers of those contacts may be transmitted to WhatsApp for matching. This limited matching helps us reliably identify the people we are communicating with and organise ongoing communications. To the extent that it is necessary for these purposes and is not overridden by the interests of the individuals concerned, it is based on Article 6(1)(f) GDPR. Our legitimate interest is to handle the relevant business communications reliably.

We limit access to the contacts needed for this purpose and revoke it once that communication purpose no longer applies. Our own contact and chat data is subject to the retention periods described: no later than 120 days after final closure for completed enquiries that do not result in a contract, and no later than one year after full completion, including billing and, where applicable, settlement of the deposit, for operational contract and project data. We delete data earlier if the purpose ceases to apply sooner. We retain records required by law and evidence specifically needed for legal claims separately; retaining such records does not justify continued WhatsApp access to the contact.

WhatsApp also processes usage, device and connection information for its own purposes, particularly the operation and security of the service. The WhatsApp Privacy Policy for the EEA explains this processing.

The WhatsApp Data Processing Terms apply to customer contact data processed on our behalf in WhatsApp Business. They do not cover all processing carried out by the provider for its own purposes and do not apply generally to the standard WhatsApp app. WhatsApp bases transfers to the certified US companies WhatsApp LLC and Meta Platforms, Inc. on the EU–US Data Privacy Framework. The Business Data Transfer Addendum provides, in particular, for EU Standard Contractual Clauses between processors as an alternative basis. For other international transfers, WhatsApp identifies adequacy decisions and EU Standard Contractual Clauses.

We back up our WhatsApp chats via iCloud so that they can be restored following a change of device or data loss. Backup copies of the chats, including the personal data they contain, are stored with Apple. The provider is Apple Distribution International Ltd., Hollyhill Industrial Estate, Hollyhill, Cork, Ireland. Processing may also take place outside the EEA, particularly in the USA. Apple identifies EU Standard Contractual Clauses for transfers from the EEA; information and details of how to request a copy are provided in the Apple Privacy Policy.

The backup is based on Article 6(1)(f) GDPR. Our legitimate interest is to ensure the availability and recoverability of the communications needed for our business operations.

The backup does not extend the retention period of the underlying chats. When deletion is due, we remove the relevant data from our active records and replace the chat backup we manage with an updated version from which that data has been removed. When restoring a backup, we reapply any deletions already due so that deleted data does not re-enter ongoing processing.

7 Retention periods

We delete completed enquiries and proposals that do not result in an engagement or contract no later than 120 days after the enquiry is finally closed. This also applies to the related correspondence and appointment management in the services we use. If the processing purpose ceases to apply sooner, we delete the data earlier.

If an enquiry results in an engagement or project, we retain its operational customer and project data for no longer than one year after full completion, including billing; we delete the data earlier if the purpose ceases to apply sooner. We handle records required to be retained by law and evidence specifically needed for legal claims separately. These periods are not blanket retention periods for raw recordings, email tracking events or all technical backup copies.

Where messages constitute commercial or business correspondence, they are generally retained for six years under section 257 HGB or section 147 AO, calculated from the end of the calendar year specified by law. Other statutory records arising in the performance of a contract are retained in accordance with the applicable provisions; the supplementary notices for proposals and contracts explain this. Only the records actually required for this purpose continue to be retained.

Evidence required for a specific legal dispute is retained until the matter has been finally resolved and the evidence is no longer needed. In assessing this, we take account of the relevant limitation periods and any ongoing proceedings. The mere possibility of future use does not justify indefinite retention. Section 2 applies to hosting logs and section 4 to HubSpot tracking events.

8 Your rights

Subject to the statutory requirements, you may request access to your data, including a copy, rectification, erasure and restriction of processing (Articles 15–18 GDPR). Where data is processed by automated means on the basis of consent or a contract, you may receive the data you have provided in a structured, commonly used and machine-readable format and, where technically feasible, have it transmitted directly (Article 20 GDPR). You may withdraw consent at any time with effect for the future; this does not affect the lawfulness of processing before withdrawal (Article 7(3) GDPR). Please contact privacy@eighty4.de to exercise these rights.

Your right to object

Where processing is based on Article 6(1)(f) GDPR, you may object at any time on grounds relating to your particular situation; this also applies to profiling based on that provision. We will then cease processing the data concerned unless we demonstrate compelling legitimate grounds that override your interests, rights and freedoms, or the processing is necessary for the establishment, exercise or defence of legal claims.

You may object to direct marketing at any time without giving reasons, including related profiling. Your data will then no longer be processed for these purposes.

Right to lodge a complaint

Under Article 77 GDPR, you may lodge a complaint with a data protection supervisory authority, in particular in the place of your habitual residence, your place of work or the place of the alleged infringement. The supervisory authority responsible for us is:

State Commissioner for Data Protection and Freedom of Information North Rhine-Westphalia
Postfach 20 04 44, 40102 Düsseldorf
Telephone: +49 211 38424-0 · Email: poststelle@ldi.nrw.de
Contact details for LDI NRW