Privacy policy

Translation for convenience. The German version is the binding one. As of 11 October 2026.

1. Controller

Michael Strohmayer – D365 Audit
Daxerstraße 5a
82140 Olching, Germany
Email: consulting@d365audit.de

We have not appointed a data protection officer because there is no legal obligation to do so.

2. Overview

This privacy policy summarises who is responsible, on which legal basis we process data, who receives it and which rights you have. Exactly which data we store and for how long is described on the page Security & Privacy (section “What is stored?” and the sections on cookies, hosting, partner packages and the reference programme). Those statements form part of this privacy policy.

We process personal data in particular for:

delivering the website and protecting it against abuse,
analysing uploaded solution exports and providing the results,
purchases (reports, partner packages, pipeline subscription), sending reports and invoices and the emails that belong to a purchase,
answering enquiries via the contact form or by email,
measuring reach and advertising success with Google, only with your consent,
anonymous counts and logs to improve the service and to protect our mail domain (as described on the Security & Privacy page).

3. Legal bases

Contract (Art. 6(1)(b) GDPR): analysing an uploaded export, purchases, delivery of reports, the reminder before deletion, the pipeline subscription and enquiries about a contract.
Legal obligation (Art. 6(1)(c) GDPR): retention of invoices and accounting records under commercial and tax law.
Legitimate interest (Art. 6(1)(f) GDPR): secure operation of the website (access data, request counters), anonymous evaluations to improve the service, evaluation of DMARC reports, enquiries without a contract.
Consent (Art. 6(1)(a) GDPR, § 25(1) TDDDG): Google Analytics and Google Ads, the one-time feedback question after a purchase, the voluntary anonymised log for product improvement. The strictly necessary cookie that stores your cookie choice is based on § 25(2) no. 2 TDDDG.

4. Recipients and processors

We use the following service providers. Where they process data on our behalf, we have concluded the agreements required by Art. 28 GDPR with them or accepted their standard terms.

Provider	Purpose	Place of processing, transfer to third countries
Render Services, Inc., San Francisco, USA	Hosting of the server and database	Data centre in Frankfurt am Main (EU). Render is a US company; access from the USA cannot be ruled out. Transfer on the basis of the EU-US Data Privacy Framework or standard contractual clauses.
netcup GmbH, Karlsruhe, Germany	Sending emails, mailboxes	Germany
Cloudflare, Inc., San Francisco, USA	Delivery of the website, DNS, encryption (TLS), protection against attacks	Global network, including the USA. Transfer on the basis of the EU-US Data Privacy Framework.
Stripe Payments Europe, Ltd., Dublin, Ireland	Payment processing, invoices, customer portal of the pipeline subscription	EU; also Stripe, Inc., USA. Transfer on the basis of the EU-US Data Privacy Framework and standard contractual clauses. For payment data Stripe is partly a controller in its own right.
Google Ireland Limited, Dublin, Ireland	Google Analytics and Google Ads, only with your consent	EU; also Google LLC, USA. Transfer on the basis of the EU-US Data Privacy Framework.

5. Server log files

When you visit the website, our hosting provider Render and Cloudflare process technically necessary access data: IP address, time, requested address, status code, amount of data transferred, browser identifier (user agent) and the previously visited page (referrer). This is necessary to deliver the website and to fend off attacks (Art. 6(1)(f) GDPR). How long the providers keep these logs depends on their terms. We do not evaluate these logs on a personal basis; for errors and response times our own server only records the type of page, not your IP address.

6. Storage period

How long we keep which data is described on the page Security & Privacy. Uploaded files are deleted right after the analysis, reports 7 days after the upload or, after a purchase, 7 days after the purchase. Invoices and accounting records are kept for the periods required by commercial and tax law (up to ten years). We delete enquiries by email once they have been dealt with, unless statutory retention obligations apply.

7. Your rights

You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and objection (Art. 21). Where we process data on the basis of legitimate interest, you can object at any time on grounds relating to your particular situation. An email to consulting@d365audit.de is sufficient. Much of what we store is anonymous or only a fingerprint; we cannot assign such data to you (Art. 11 GDPR).

8. Withdrawing consent

You can withdraw consent at any time with effect for the future (Art. 7(3) GDPR); the lawfulness of processing up to the withdrawal remains unaffected. Analytics and ads: use the button below, after which the cookie banner appears again. Feedback question: via the link in the report email or by email. The voluntary log for product improvement contains no reference to you, so a withdrawal only affects future uploads.

9. Right to lodge a complaint

You have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR). The authority responsible for us is the Bavarian State Office for Data Protection Supervision (Bayerisches Landesamt für Datenschutzaufsicht, BayLDA), Promenade 18, 91522 Ansbach, Germany, www.lda.bayern.de.

10. No automated decision-making

The analysis of a solution export is an automatic evaluation of technical metadata, not a decision about persons. There is no automated decision-making including profiling within the meaning of Art. 22 GDPR.

11. Obligation to provide data

You are not obliged to provide personal data. Without an email address, however, we cannot deliver a purchased report, and without your details we cannot answer an enquiry.