Last updated: 31 August 2026
1. Controller and privacy contact
The controller responsible for processing personal data in connection with this website is:
Ajatus GmbH
Wragekamp 7
22397 Hamburg
Germany
Telephone: +49 (40) 30 700 796
Email: info@ajatus-consulting.com
You may also use the above email address for any questions or requests relating to data protection.
2. Scope of this privacy policy
This privacy policy explains how we process personal data when you visit our website, use our contact form, contact us by email, or follow links to third-party services. Personal data is any information relating to an identified or identifiable natural person.
We process personal data only where this is necessary to provide and secure the website, respond to enquiries, take steps at your request before entering into a contract, perform a contract, comply with legal obligations, or pursue a legitimate interest that is not overridden by your interests or fundamental rights and freedoms.
3. Website hosting and delivery
Our website is created and hosted using services provided by Webflow, Inc., 398 11th Street, 2nd Floor, San Francisco, CA 94103, USA ("Webflow"). Webflow processes personal data on our behalf as a processor. Webflow uses infrastructure and content-delivery providers, including Amazon Web Services, Inc. and Cloudflare, Inc.
When you access the website, the hosting and delivery infrastructure may process technical connection data, including your IP address, date and time of access, requested page or file, referrer URL, browser type and version, operating system, device information, HTTP status code and other information required to transmit and secure the website.
The purpose of this processing is to deliver the website, maintain its technical stability and security, prevent misuse and investigate technical faults. The legal basis is Article 6(1)(f) GDPR. Our legitimate interests are the secure, reliable and efficient operation of our website and the protection of our systems.
We do not maintain separate website access logs for marketing purposes. Technical log data is retained only for as long as required for operation, security and fault analysis and is subsequently deleted or anonymised in accordance with the applicable provider settings and contractual arrangements.
Webflow and some of its subprocessors are based in or may process data in the United States. Webflow's data processing terms provide for the use of applicable safeguards for international transfers, including the EU-U.S. Data Privacy Framework where applicable and the European Commission's Standard Contractual Clauses. Further information is available in Webflow's Data Processing Addendum and subprocessor list:
Webflow Data Processing Addendum
Webflow subprocessor list
4. Technically necessary cookie
The website delivery infrastructure currently sets the cookie _cfuvid for Cloudflare rate-limiting and security purposes. It enables Cloudflare's Web Application Firewall to distinguish individual visitors who share the same IP address and helps protect the website against excessive or malicious traffic.
The cookie is a session cookie and is configured with the security attributes HttpOnly and Secure. It is not used by Ajatus for advertising or audience measurement. Its use is necessary to provide and protect the website and is therefore based on Section 25(2) no. 2 TDDDG and Article 6(1)(f) GDPR.
5. Contact form and email enquiries
If you contact us using the contact form or by email, we process the information you provide, in particular your email address and, where supplied, your name, the subject and content of your message. Technical metadata such as the time of submission and the sending IP address may also be processed to transmit the message, maintain security and prevent misuse.
Where your enquiry relates to a potential or existing contractual relationship, the legal basis is Article 6(1)(b) GDPR. For other business communications, the legal basis is Article 6(1)(f) GDPR. Our legitimate interest is to receive and respond to legitimate enquiries and maintain business relationships. Where processing is required to comply with a legal obligation, Article 6(1)(c) GDPR applies.
The contact form is processed using Webflow. Form submissions may be stored in the Webflow account and transmitted to us by email notification. Our business email service is currently provided through Microsoft 365 by Microsoft Ireland Operations Limited, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, Ireland. Webflow and Microsoft act as processors or engage processors under their respective contractual arrangements. International transfers may occur and are protected by applicable adequacy decisions, the EU-U.S. Data Privacy Framework where applicable, and/or Standard Contractual Clauses.
We normally delete contact-form and enquiry data no later than six months after the enquiry has been finally dealt with. If an enquiry results in a contract or if statutory retention requirements apply, relevant correspondence may be retained for the applicable statutory period. Data that is no longer required for those purposes will be deleted.
Please do not use the contact form to send highly confidential information, special categories of personal data or documents containing sensitive personal information. Contact us first if a secure transfer method is required.
6. External links to LinkedIn and Google Maps
Our website contains ordinary links to our LinkedIn company page and to Google Maps. These services are not embedded as social plug-ins, tracking pixels or interactive map frames. Merely visiting our website does not establish a connection to LinkedIn or Google through those links. A connection to the relevant provider is established only when you click a link, at which point that provider processes data under its own responsibility.
LinkedIn Privacy Policy
Google Privacy Policy
7. No analytics or advertising tracking
We currently do not use Google Analytics, Google Ads conversion tracking, Google AdSense, Leadinfo, Meta Pixel or comparable analytics or advertising tracking services on this website. We also do not use third-party cookies for marketing or audience measurement.
If we introduce such services in the future, we will update this privacy policy and, where required, obtain your consent before activating them.
8. Recipients of personal data
Within Ajatus, personal data is accessible only to persons who require it to operate the website, respond to enquiries, maintain business relationships or comply with legal obligations. We may also disclose data to service providers acting on our behalf, professional advisers, public authorities or other recipients where this is necessary, legally required or otherwise permitted by law.
We do not sell personal data.
9. Your rights
Subject to the conditions and limitations of applicable law, you have the following rights:
Where processing is based on consent, you may withdraw that consent at any time with effect for the future. The lawfulness of processing carried out before withdrawal is not affected.
You also have the right to lodge a complaint with a data protection supervisory authority. The supervisory authority responsible for Ajatus is:
The Hamburg Commissioner for Data Protection and Freedom of Information
Ludwig-Erhard-Strasse 22
20459 Hamburg
Germany
Email: mailbox@datenschutz.hamburg.de
10. Automated decision-making
We do not use personal data collected through this website for automated decision-making, including profiling, within the meaning of Article 22 GDPR.
11. Security
We use appropriate technical and organisational measures to protect personal data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure or access. The website is transmitted using TLS encryption. No internet transmission or storage method can, however, be guaranteed to be completely secure.
12. Changes to this privacy policy
We may update this privacy policy if the website, our service providers or the applicable legal requirements change. The version published on this website at the time of your visit applies.