Controller

Sonnen Stark GmbH, Morsestraße 6, 48432 Rheine, Germany. Managing director: Bastian Kuhlmann. Privacy enquiries: info@vlamshield.nl.

Hosting and connection data

The website and enquiry service are hosted by ALL-INKL.COM – Neue Medien Münnich, Hauptstraße 68, 02742 Friedersdorf, Germany. Requests involve necessary data such as IP address, time, requested URL and browser information. Our legitimate interest is a secure, reliably available website (Article 6(1)(f) GDPR). Service providers receive data as needed for hosting, email and technical operation.

Cookies and local storage

We store your statistics choice for 70 days in the necessary vlamshield_consent cookie (Article 6(1)(f) GDPR: our legitimate interest in respecting your choice; technically necessary storage). Acceptance and refusal are stored for the same period. You can change your choice at any time using “Privacy settings” in the footer. Without consent we do not load Google Analytics or send cookieless measurement signals to Google. Fonts and images are served locally. The AI adviser uses neither cookies nor Local Storage: the conversation remains in the open page’s working memory, can be removed using “Clear chat” and is reset when the page is reloaded. The language choice is in the URL.

Google Analytics – only with consent

With your consent we use Google Analytics 4 by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, to analyse page views, sources of visits and use of our content. The legal basis is Article 6(1)(a) GDPR; non-essential cookies require prior consent. Data includes visited pages, timestamps, pseudonymous cookie identifiers and basic browser/device information. Your IP address is technically transmitted to Google; Google states that GA4 does not log or store it. Query parameters and fragments are removed from page URLs; referrer information is restricted to the source domain. Chat text and contact form entries are not sent to Analytics. Google signals, advertising personalisation and automatic form-interaction measurement are disabled. Cookies _ga and _ga_VGZXW50R50 are configured for up to 70 days from creation, without automatic renewal on each visit. Event-level data is deleted in Analytics after two months; aggregated standard reports may remain longer. Processing by affiliated companies, particularly in the USA, is possible. Google’s processing terms provide for adequacy decisions or standard contractual clauses as applicable to the transfer. You can withdraw consent at any time in privacy settings; further measurement stops and Analytics cookies are removed. Withdrawal does not affect the lawfulness of earlier processing. We use Google Search Console separately for aggregated search performance data; it does not load visitor tracking code on this website.

AI project adviser

Only when you submit a question does our server send the text, limited conversation context and relevant public technical information to the OpenAI API. The provider for EEA customers is OpenAI Ireland Ltd. and its affiliates. Processing serves your requested response and project guidance (Article 6(1)(b) GDPR for pre-contractual enquiries; otherwise Article 6(1)(f), our interest in answering business questions). Please do not put confidential or contact information in chat. The contact form is separate. Selected images and PDF pages are converted into reduced page images in your browser; a bounded text extract from PDFs is also processed. TXT files are read as bounded text. Only when you send a question are this content and filenames sent through our server to OpenAI. Attachments stay selected in browser memory until removed, the chat is cleared or the page is left, and are sent again with follow-up questions. Our server does not create a file archive. Attachments are not automatically included in project enquiries or imported into the CRM. Remove personal and confidential details first.

OpenAI: retention and international processing

We use the API with response storage disabled (store=false). This does not mean OpenAI retains no data: the provider may generally keep security logs containing content for up to 30 days, or longer for legal or security reasons. API content is not used for model training by default. EU-only processing and Zero Data Retention are not configured for this service. Processing may take place in the US in particular. OpenAI’s data processing agreement provides for standard contractual clauses or applicable adequacy decisions for necessary transfers.

Project enquiries and email

Submitting an enquiry in the adviser sends us your email address, message and optional details such as name, company and phone number. The enquiry is stored with restricted access on our hosting and passed to our mailbox for handling. Chat transcripts are not attached automatically; contact form details are not sent to OpenAI. The contact form also submits your enquiry directly to us. Your details and source website are brought together in our shared customer management system (Twenty) to handle the enquiry. The legal basis is Article 6(1)(b) GDPR for preparing and performing a contract, or Article 6(1)(f) for business contacts and other enquiries. We need an email address to reply in writing. Other details are optional.

Retention and abuse prevention

Our chat service does not maintain a permanent conversation archive. To limit abuse, it uses daily changing pseudonymous identifiers derived from IP addresses and request counters; daily identifiers are overwritten on the next day the service is used. A monthly cost total without personal linkage remains for budget control. The purpose is preventing abuse (Article 6(1)(f) GDPR). Project enquiries are retained for handling and necessary follow-up. Data no longer needed is deleted, subject to statutory retention duties for relevant business and contractual records. Technical hosting logs serve operation, troubleshooting and security only and are deleted when no longer needed for these purposes.

Your rights

Subject to the GDPR, you have rights of access, correction, erasure, restriction and portability. You may object to processing based on legitimate interests for reasons relating to your particular situation. Where processing relies on consent, you may withdraw it for the future. You may complain to a supervisory authority such as LDI Nordrhein-Westfalen or the Autoriteit Persoonsgegevens. Contact info@vlamshield.nl to exercise your rights. No solely automated decision with legal or similarly significant effects is made. The AI adviser provides non-binding information; quotations and technical project decisions are handled separately.

Further information

OpenAI Data Processing Addendum
OpenAI API · Data controls
LDI Nordrhein-Westfalen
Autoriteit Persoonsgegevens