Privacy policy

1. General information

The following information explains the nature, scope and purposes of the processing of personal data when you visit this website. Personal data is any data that can be used to identify you personally.

2. Controller

Managing directors: Patrick Schulze, David Schulze, Jörg Schulze Greiving

3. Data Protection Officer

No Data Protection Officer has been appointed, as the legal requirements for doing so are not met. For data protection questions, please contact the controller named in Section 2, or email us directly at datenschutz@aupos-iq.de.

4. Categories of data processed and purposes of processing

4.1 Categories of personal data

• Access data/server logs (e.g. IP address, date and time of the request, referrer URL, user agent)
• Communication data (e.g. email address, phone number), if provided by you via the contact form
• Content data (e.g. entries in forms), if provided by you
• Usage data (e.g. pages visited), insofar as recorded in server logs

4.2 Purposes of processing

• Providing the website, its stability and security
• Communication and processing of enquiries
• Fulfilment of legal obligations

5. Hosting and server log files

This website is hosted with a hosting provider based in Germany, on a rented server (VPS). A data processing agreement pursuant to Article 28 GDPR is in place with the hosting provider.

When you access our website, information transmitted by your browser is automatically recorded in server log files:

• IP address
• Date and time of the server request
• Content of the request (specific page)
• Access status/HTTP status code
• Amount of data transferred
• Referrer URL
• Browser type and version, operating system

Processing takes place on the basis of Article 6(1)(f) GDPR. Our legitimate interest lies in the technically error-free presentation and the security of our website. Server log files are continuously and automatically overwritten; there is no technically fixed retention period in days – it depends on the storage allocated to log rotation.

6. Use of cookies and local storage

6.1 Technically necessary cookies

This website uses the following cookies:

6.2 Local storage (localStorage)

Only your colour-scheme preference (light/dark) is stored in your browser's localStorage – key auposiq-theme. This entry is only set if you explicitly choose “Light” or “Dark”; in the default “System” mode, the site follows your device setting and writes nothing to local storage. This information never leaves your device.

Legal basis for storing this entry on your device: Section 25(2) no. 2 TDDDG (German Telecommunications Digital Services Data Protection Act) – the storage is strictly necessary to provide the service you have explicitly requested (the display you have chosen).

6.3 Tracking and marketing cookies

No tracking, analytics or marketing cookies are used.

Legal basis: Article 6(1)(f) GDPR (legitimate interest in a functional and user-friendly website).

7. External resources

The website loads all static resources (stylesheets, JavaScript, fonts) exclusively from its own server. No external CDN services are used. The Inter typeface is self-hosted (no calls to external font servers).

8. YouTube videos

On some pages we embed videos from the YouTube platform. Provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland.

We use the privacy-friendly domain youtube-nocookie.com and a two-click mechanism: YouTube content is only loaded after your explicit consent. Without consent, only a placeholder image is shown and no data is transmitted to Google.

After you consent, Google may set cookies and collect usage data. Legal basis: Article 6(1)(a) GDPR (consent). Further information: Google's privacy policy.

9. Contact form

If you contact us via the contact form, the data you enter (company, salutation, first and last name, email address, optionally phone number, message) is processed for the purpose of handling your enquiry. Legal basis: Article 6(1)(b) GDPR (pre-contractual measures) or Article 6(1)(f) GDPR (legitimate interest in responding to enquiries).

Processing path: Incoming enquiries are, in addition to the email notification, stored in a local SQLite database (App_Data/aupos.db) on the same (rented) web server. Our internal ERP system then retrieves these enquiries via a signed API (HMAC-SHA256), imports them for processing, and marks them as processed. Once imported, the data is permanently deleted from the local inbox. At no point is data transmitted to any external services beyond the hosting provider named in Section 5.

10. Legal bases for processing (Article 6 GDPR)

• Article 6(1)(a) GDPR – Consent: For loading YouTube videos after consent.
• Article 6(1)(b) GDPR – Performance of a contract / pre-contractual measures: Where processing is necessary for the performance of a contract with you (e.g. contact enquiries).
• Article 6(1)(f) GDPR – Legitimate interests: For the technically necessary provision, security and optimisation of our website (server logs, cookies).

11. Duration of data storage

• Server logs: no fixed retention period, continuous automatic overwriting as part of log rotation
• Contact enquiries in the local inbox: until collected by the internal ERP system (collection sets a ProcessedAt marker), but no later than 30 days after receipt – entries are then deleted automatically.
• Contact enquiries in the ERP system after being taken over: until processing is complete, for a maximum of 12 months.
• Preview cookie aupos_intern: 7 days

12. Recipients of data & transfers to third countries

As a general rule, personal data is not transferred to third parties unless this is necessary to fulfil legal obligations.

Through the use of YouTube (see Section 8), IP addresses may be transmitted to servers outside the EU, in particular in the USA. This transfer is based on your explicit consent pursuant to Article 49(1)(a) GDPR, which you give by loading the video. Please note that the USA may not provide a level of data protection equivalent to that under EU law; in particular, US authorities may be able to access the data without you having effective legal remedies against this.

In addition, Google relies on the EU–US Data Privacy Framework (adequacy decision pursuant to Article 45 GDPR) and on the European Commission's Standard Contractual Clauses pursuant to Article 46(2)(c) GDPR.

13. Your rights

Under the applicable statutory provisions, you have the following rights:

• Right of access to the data we hold about you (Article 15 GDPR)
• Right to rectification of inaccurate or completion of incomplete data (Article 16 GDPR)
• Right to erasure of your data (Article 17 GDPR)
• Right to restriction of processing (Article 18 GDPR)
• Right to data portability (Article 20 GDPR)
• Right to object to processing based on Article 6(1)(f) GDPR (Article 21 GDPR)
• Right to withdraw consent already given, with effect for the future (Article 7(3) GDPR)

To exercise your rights, please contact us using the contact details given in Section 2.

Right to lodge a complaint: You have the right to lodge a complaint with a supervisory authority (Article 77 GDPR). The supervisory authority responsible for us is:

14. Obligation to provide data

The provision of personal data is neither legally nor contractually required, nor is it necessary to enter into any contract. You are not obliged to provide personal data. However, failure to provide it may mean you are unable to use our contact form.

15. Data security

We take technical and organisational measures to protect your data against loss, destruction, alteration and unauthorised access. Transmission takes place via a TLS-encrypted connection (HTTPS). Our security measures are continuously improved in line with technological developments.

16. Contact for data protection enquiries

For questions about data protection, to exercise your data-subject rights, or to raise a complaint, please contact:

17. Validity and updates of this privacy policy

Last updated: September 2026. We reserve the right to amend this privacy policy in the event of changes to the law or to the services we use.