Privacy Policy

Last updated: 22 October 2026

This policy sets out which personal data we process when you visit this website or contact us, on which legal basis, who receives that data and which rights you have.

1. Controller

MGTI Consulting GmbH, represented by Ioannis Tsarmantidis & Gabriel Mandtler,
Gewerbeparkring 1, 15517 Fürstenwalde/Spree, Germany.
Email: info@mgti-consulting.com

We are not legally required to appoint a data protection officer. Please address any data protection matter to the email address above.

2. Hosting and access logs

This website is hosted by Vercel Inc. and served from the FRA1 region (Frankfurt am Main). When you load a page, Vercel processes the usual request data (IP address, user agent, requested URL, timestamp, referrer) in order to deliver the page and to protect against attacks. Legal basis: Art. 6 (1) (f) GDPR; our legitimate interest is the secure and stable operation of the website. These logs are available to us only briefly for error and security analysis and are deleted automatically, at the latest after 30 days.

The Geist, Inter and JetBrains Mono typefaces are self-hosted. No connection is made to Google Fonts or any other third-party CDN.

3. Cookies, consent and analytics

Beyond strictly necessary cookies (§ 25 (2) no. 2 TDDDG, no consent required), we use non-essential technologies only with your prior consent (§ 25 (1) TDDDG in conjunction with Art. 6 (1) (a) GDPR).

On your first visit you receive a consent banner with equally weighted "Accept all" and "Reject all" buttons and granular per-category settings. We store your choice in a first-party cookie mgti-consent (lifetime 6 months). Without your active consent no analytics service is loaded and no non-essential cookie is set. You can withdraw your consent at any time via "Cookie settings" in the footer.

Record of your choice: We are required to be able to demonstrate a consent that was given (Art. 7 (1) GDPR). For every decision we therefore store one record on our server: a random reference, the choice you made, the version of the consent text shown to you and the time. This record contains no name, no email address and no IP address; it is linked to your browser only through the random reference that is also held in the mgti-consent cookie. Legal basis is our legal obligation to provide evidence (Art. 6 (1) (c) in conjunction with Art. 7 (1) GDPR), and for the period after a withdrawal our legitimate interest in defending against claims (Art. 6 (1) (f), Art. 17 (3) (e) GDPR). Retention: see section 9.

Statistics, Google Analytics 4 (consent-based): If you consent to the "Statistics" category, we use Google Analytics 4 (provider: Google Ireland Ltd.; Google LLC, USA, may be involved in the processing) for pseudonymous audience measurement. This sets cookies (including _ga, _ga_<ID>). Google Analytics 4 does not store IP addresses; the IP address is processed at most briefly for coarse geolocation and is not logged. Legal basis: your consent (Art. 6 (1) (a) GDPR, § 25 (1) TDDDG).

Statistics, Vercel Web Analytics & Speed Insights (consent-based): If you consent to the "Statistics" category, we collect cookieless, pseudonymous usage and performance metrics with Vercel Web Analytics and Vercel Speed Insights (provider: Vercel Inc., USA): page views with the address called up and the referring source, an approximate location derived from the connection (country, region and place; Speed Insights records the country only), device, operating system and browser class and Core Web Vitals measurements. To distinguish visits, a hash value that changes daily is derived from connection data (including a truncated IP address and the user agent); no IP address is stored and no recognition beyond the day is possible. Legal basis: your consent (§ 25 (1) TDDDG in conjunction with Art. 6 (1) (a) GDPR). On the possible transfer to the USA, see section 8.

Details on the cookies we use are set out in our cookie policy.

4. Contact form

When you submit our contact form we process: your name, email address, phone number (optional), company (optional), your message, the topic or offering you selected and the language version of the website. To protect against automated submissions we additionally process your IP address in truncated and pseudonymised form; we do not pass a plain-text IP address on to the downstream systems.

Name, email address and message are required; without them we cannot accept your inquiry. All other entries are optional and omitting them has no disadvantage for you. There is no statutory or contractual obligation to provide your data. The confirmation box in the form records that you have taken note of this policy; it is not a consent, the processing rests on the legal bases below.

Legal basis: Art. 6 (1) (b) GDPR where you are or intend to become our contractual partner yourself (pre-contractual measures at your request). If you enquire on behalf of a company and will not personally be a party to the contract, we process your contact data on the basis of Art. 6 (1) (f) GDPR; our legitimate interest is answering your inquiry and initiating the business relationship. The pseudonymised IP address is processed on the basis of Art. 6 (1) (f) GDPR to protect against misuse.

Recipients: your inquiry is processed in our self-operated workflow environment, filed in a spreadsheet in Google Workspace and triggers an internal notification as well as an automatic acknowledgement to you. If a technical error occurs, we receive an internal message for troubleshooting which may contain your name and email address. See section 7 for the recipients and section 9 for retention.

5. AI-Audit questionnaire

On our "AI-Audit" page and at individual entry points you can voluntarily complete a guided questionnaire to receive an initial assessment of where the use of AI is worthwhile in your company. We process:

• company details (name, industry, size bracket, previous AI experience);
• details on up to five processes (name, sequence, systems used, frequency, manual share, pain points, target metrics, estimated savings potential) as free text;
• details on your technical starting position (existing automation, data export, interfaces);
• details on implementation and budget (ownership, team size, readiness to innovate, budget range);
• your contact details (name and email address; phone number optional) and the language version.

Name and email address are required; without them we cannot get back to you. All substantive answers are optional; the less you provide, the coarser the assessment. Please do not enter personal data of third parties in the free-text fields, such as names of employees or customers. To protect against automated submissions we process your IP address as described in section 4.

Legal basis: section 4 applies accordingly to your contact details and to the answers needed for the assessment (Art. 6 (1) (b) or (f) GDPR). Answers that only concern a later implementation (in particular budget range, readiness to innovate and team size) are processed on the basis of Art. 6 (1) (f) GDPR; our legitimate interest is preparing a suitable proposal.

Internal prioritisation: from your answers we automatically calculate an internal score and a recommendation on a sensible audit depth. This mainly draws on the budget range, company size, AI experience and readiness to innovate as well as technical feasibility and process potential. Its sole purpose is to prioritise inquiries internally and prepare our response; legal basis is Art. 6 (1) (f) GDPR, our legitimate interest being the economical use of our limited consulting capacity. The score is not shown to you. This does not amount to an automated decision in an individual case producing legal effects or similarly significantly affecting you: every contact and every proposal is decided by a human. On your right to object to this processing, see section 11.

Recipients and processing sequence correspond to section 4; for retention see section 9.

6. Contact outside this website

If you contact us by email, by phone or in a meeting, we process the data arising in that context (name, contact details, role in the company, content of the correspondence) in order to deal with your request and to conduct the business relationship. Legal basis is Art. 6 (1) (b) GDPR where you are or become a contractual partner yourself, otherwise Art. 6 (1) (f) GDPR with our legitimate interest in communicating with our business partners. Emails are processed via Google Workspace (section 7). For retention see section 9.

6a. Personal customer link

For individual contacts at our customers and prospects we set up a personal page. It can only be reached with a personal access link. Anyone without access sees an ordinary error page.

Access. We keep an approval list with your name, your business email address and the end date of the approval. When you enter your address on the access page, we check it against this list. If it is approved, we send you a link that is valid for 2 hours and works only in the browser in which you requested it. To limit abuse we store your person ID, the time of the request and a non-reversible value of your IP address formed with a secret key. After you open the link we record the time and person of the redemption. The legal basis is our legitimate interest in protecting the page from unauthorised access (Art. 6 (1) (f) GDPR). For your role as a contact the business relationship or its initiation is the basis (Art. 6 (1) (b) or (f) GDPR).

Cookies. We set two cookies, both technically necessary so that the page can be shown to you and only to you (section 25 (2) no. 2 TDDDG). __Host-mgti-zugang-anfrage (135 minutes) binds the link you requested to your browser and holds random values only. __Host-mgti-zugang (30 days at most) holds your approval. It contains your person ID, the customer, the expiry date and your choice on measurement.

Measurement. Regardless of your choice in the cookie banner, we only record when you open the page and how long it is visible if you expressly agree on the confirmation page. For this, your browser reports a random visit ID to us every 30 seconds while the page is visible. We store the visit ID, person ID, name, start, time of the last report and the duration in minutes. We store no IP address and no device data for this. The legal basis is your consent (Art. 6 (1) (a) GDPR, section 25 (1) TDDDG). You can change it at any time on the page with effect for the future. As proof we record the time and kind of the change under your name and person ID (Art. 6 (1) (c) in conjunction with Art. 7 (1) GDPR). If you do not agree, we use no measurement. The page remains fully usable.

Answers. If you answer the questions on the page, we transmit your answers to our workflow environment. They end up in an email to us and in a table. The legal basis is the initiation of the business relationship (Art. 6 (1) (b) or (f) GDPR). You can send answers again, the latest version counts for us. If you tick “copy of my answers by email to me” in the summary, we send a copy to the address you were approved with, never to an address that was typed in.

Recipients and retention. Section 7 (Vercel, Hostinger, Google) and section 8 apply. We delete entries in the approval list and in the access, measurement and answer tables at the latest 12 months after the approval ends. We keep the proof of your measurement choice for three years (as in section 9). We delete the counting entries used for rate limiting in the workflow environment after 2 days. The host's access logs (section 2) remain unaffected.

On these pages we load no statistics services and show no cookie banner. Your entries stay in the memory of this browser tab (sessionStorage) until you submit, so that they are not lost on reload. They are deleted after submitting or when you close the tab. We only receive them when you submit. In addition we store your progress (answers, current question, time of the last change and of the last submission) in our workflow environment under your person ID, so that you can continue there on a later visit. It is deleted together with the other data in this section at the latest 12 months after the approval ends.

7. Recipients and processors

• Vercel Inc., USA: hosting of the website, served from the FRA1 region. If you consent to the "Statistics" category, Vercel additionally processes cookieless, pseudonymous usage and performance data via Vercel Web Analytics and Speed Insights.
• Hostinger International Ltd., Larnaca, Cyprus: virtual server for our self-operated workflow environment, server location Frankfurt am Main.
• Google Ireland Ltd., Ireland: Google Workspace for filing inquiries in a spreadsheet and for sending email. If you consent to the "Statistics" category, Google Ireland Ltd. / Google LLC additionally processes pseudonymous usage data via Google Analytics 4 for audience measurement.

Beyond this we disclose your data only where we are legally obliged to do so, for instance to public authorities, or where it is necessary to establish, exercise or defend legal claims.

8. International data transfers

Vercel Inc. and Google LLC are US companies; their processing may involve a transfer of personal data to the USA. Both state that they are certified under the EU-US Data Privacy Framework, for which the EU Commission adopted an adequacy decision under Art. 45 GDPR on 10 July 2023. Hostinger International Ltd. is established in the European Union (Cyprus) and operates the server we use in Frankfurt am Main.

9. Retention

• Contact form inquiries and AI-Audit answers that do not lead to a business relationship: deleted from the spreadsheet and the mailbox at the latest 12 months after the last interaction.
• Technical execution data of our workflow environment and internal error notifications belong to the respective case and are deleted together with it, and therefore no later than 12 months after the last interaction.
• Access logs of the host: see section 2. Consent cookie: 6 months (section 3).
• Metrics from Vercel Web Analytics and Speed Insights: the hash used to distinguish visits is discarded after 24 hours. The metrics themselves remain available for the reporting window of our Vercel plan; the provider does not guarantee deletion beyond it. Once you withdraw your consent we collect no further metrics.
• Record of your cookie choice (section 3): three years after the respective decision, then deleted. That period covers the regular limitation period for claims arising from the processing concerned.
• Records arising from a business relationship are subject to statutory retention periods: books, financial statements and accounting records 10 years, accounting vouchers 8 years, commercial and business letters sent and received 6 years (§ 147 AO, § 257 HGB). The period starts at the end of the calendar year in which the record was created or received. Only records actually covered by those obligations are retained, not every answer from a questionnaire.

10. Your rights

Under the GDPR you have the right of access, rectification, erasure, restriction of processing and data portability. You also have the right to lodge a complaint with a supervisory authority; ours is the Landes­beauftragte für den Datenschutz und für das Recht auf Akteneinsicht Brandenburg. Where processing rests on consent (cookies, section 3) you may withdraw it at any time with effect for the future, without affecting the lawfulness of processing carried out until then.