DE

Privacy policy

1. Controller

The controller responsible for data processing on this website is:

Mirko Kloppenburg
c/o MKBurg Process Experiences GmbH
Fahrenkrön 122a
22179 Hamburg, Germany
Phone: +49 40 414319081
Email: Mirko.Kloppenburg@MKBurg.de

If you have questions about data protection, you can contact me at this email address at any time.

2. Principles of processing

I process personal data only as far as necessary to provide and securely operate this website and to handle enquiries.

This website is deliberately built to use as little data as possible. I use no third-party analytics or tracking services, show no advertising, embed no social media services and load no fonts, icons, scripts, maps or videos from external third parties. Everything is served from my own server. I count page views myself with anonymous daily counters without cookies (see section 7).

3. Hosting and server log data

This website is hosted by IONOS SE, Elgendorfer Straße 57, 56410 Montabaur, Germany. A data processing agreement under Art. 28 GDPR exists with IONOS.

When you visit the website, the IP address of your device must technically be transmitted to the web server so that the requested content can be delivered.

According to IONOS, visitor data in the IONOS web hosting I use is stored anonymized at the time of collection. This includes in particular the requested page or file, the referrer, browser type and version, operating system, device type, time of access and an anonymized IP address. IONOS stores this data for eight weeks.

The processing serves the technical provision, security and stability of the website. The legal basis is Art. 6 (1) (f) GDPR. My legitimate interest lies in the secure, stable and trouble-free operation of my website.

4. Cookies

Most pages of this website set no cookies. Only on the page with the contact form do I use a technically necessary session cookie (name “npl_session”). It contains a random identifier and serves solely to protect the form against abusive submissions from other sites (CSRF protection) and to show you the confirmation after submitting. It is not used for recognition, analysis or advertising and ends when you close the browser; the corresponding session file on my server is deleted after 14 days at the latest. It is only set when the page actually displays the form. The legal basis is Section 25 (2) no. 2 TDDDG and Art. 6 (1) (f) GDPR.

No services such as Google Analytics, Google Fonts, Meta Pixel or comparable third-party trackers are used. As no storage or access technologies requiring consent are used, I do not use a cookie consent banner.

5. Fonts and icons

For a consistent appearance I use Poppins, Font Awesome and a custom brand typeface. All files required for this are loaded exclusively from my own server. No connection is made to Google Fonts, Font Awesome CDNs or other external providers.

6. Contact form and email

If you use the contact form, I process the data you enter: name, email address, message and the chosen language. The request reaches me in two ways: by email, and additionally in my CRM at Zoho, where a contact (“lead”) with your message as a note is created or an existing contact is updated. The purpose is to handle your enquiry and document the contact. This is not a newsletter sign-up. On this website’s server the request is only held temporarily in a transfer queue until it has been handed over to Zoho; after that, name, address and message are deleted there, or after 30 days at the latest if the handover finally fails. If you email me directly, I process your details in the same way to reply.

To protect the form against automated abuse I use an invisible extra field (honeypot) and a limit on the number of submissions. For this limit the server counts per hour how often messages are sent from an IP address and with the same email address. Both are stored in the counter only as an irreversible hash value formed with a secret key (HMAC), not in plain text. These counters are deleted after two days at the latest.

The legal basis for handling an enquiry related to a possible or existing contractual relationship is Art. 6 (1) (b) GDPR. For general enquiries and for protecting the form against abuse, processing is based on Art. 6 (1) (f) GDPR. My legitimate interest lies in answering enquiries and protecting my website against automated abuse.

The fields marked as mandatory in the form are required so that I can handle your enquiry.

Retention in the CRM: I delete contacts from contact requests 24 months after the last contact. Where the enquiry leads to a contractual relationship or statutory retention obligations apply, the relevant data may be stored for longer.

7. External links, non-existent addresses and anonymous counters

Some links lead to external offerings, such as my projects (NewProcessLab.com, RocketBPM.com, MKBurg.de, mirko.info) or LinkedIn. Merely visiting this website transmits no data there. Only when you click a link do you leave this website and your browser connects to the target server. The privacy notices of the respective provider apply there; I have no influence on data processing there.

If someone requests an address that does not exist on this website, I count only the address (without IP address and without browser identifier) so that I can repair links; I delete these counters after 12 months.

Anonymous daily counters. Per day and page I count how often a page is viewed, roughly where the visit came from (only a category such as “LinkedIn”, “Google” or “direct”, never an address or search term) and how often a contact form was submitted from a page. Only numbers per day, page and category are stored: no cookie, no IP address, no browser identifier, no identifier of a person and no matching across several days or pages. I do not recognize visitors; repeated views by the same person count repeatedly. I do not count bots, prefetches and browsers that send “Do Not Track” or “Global Privacy Control”. The counters have no personal reference and are kept without a time limit; where they are nevertheless regarded as processing, the basis is my legitimate interest (Art. 6 (1) (f) GDPR).

Errors and warnings of the application are written to a log that is overwritten after about 60 days at the latest; email addresses are stored there only in shortened form. My pages send security policies (Content Security Policy) to your browser; if it reports a violation, I log only the name of the violated rule, the host of the blocked source and the path of the page, without IP address and without browser identifier.

8. Recipients and processors

To operate this website and handle enquiries I use service providers:

  • IONOS SE, Germany: hosting, web server and hosting log data.
  • Zoho group of companies: CRM (storing contact requests as a contact with a note). For customers in Germany, according to Zoho’s current information, Zoho Corporation GmbH is the contracting entity; the EU data center is operated within the Zoho group by Zoho Corporation B.V. in the Netherlands.
  • Email service provider: as far as technically necessary to deliver the request sent via the contact form.

Agreements under Art. 28 GDPR exist, where required, with the service providers I use as processors. Personal data is not passed on beyond this unless there is a legal basis or I am legally obliged to do so.

9. Possible third-country access at Zoho

My Zoho account is operated in the EU region. According to Zoho, service data of EU accounts is generally stored and processed in the EU data center. In certain cases, authorized employees of Zoho companies outside the European Economic Area, in particular in India, may access it for technical support or maintenance purposes. According to Zoho, it bases such access on the European Commission’s standard contractual clauses and supplementary safeguards. You can request further information on the safeguards at Mirko.Kloppenburg@MKBurg.de.

10. Your rights

Where the respective legal requirements are met, you have in particular the following rights: right of access under Art. 15 GDPR, rectification under Art. 16, erasure under Art. 17, restriction of processing under Art. 18, data portability under Art. 20 and objection under Art. 21 GDPR. To exercise your rights, an informal message to Mirko.Kloppenburg@MKBurg.de is sufficient.

11. Right to object

Where I process personal data on the basis of Art. 6 (1) (f) GDPR, you have the right under Art. 21 GDPR to object at any time to this processing on grounds relating to your particular situation.

12. Right to lodge a complaint with a supervisory authority

You have the right to lodge a complaint with a data protection supervisory authority. The authority responsible for me is:

Der Hamburgische Beauftragte für Datenschutz und Informationsfreiheit (HmbBfDI)
Ludwig-Erhard-Straße 22
20459 Hamburg
Germany

13. No automated decision-making

Automated decision-making including profiling within the meaning of Art. 22 GDPR does not take place on this website.

14. Currency and changes

I will adapt this privacy policy if changes to the website or the data processing carried out on it make this necessary. The version published on this website at the time applies.

Last updated: 30 October 2026