Privacy policy

Controller

TSMONDO UG (haftungsbeschränkt), Zum Erlenbusch 41c, 48167 Münster, Germany
Managing Director: Thorsten Schmitz-Hübsch · info@tsmondo.eu · +49 162 9691436

We have not appointed a data protection officer; we are not required to do so.

2.1 Cookies and consent

This website only sets cookies that need your permission once you have given it. The first time you open a page, a banner asks you to decide: decline or agree, both equally easy. Until you decide, nothing is loaded from Google and no analytics or advertising cookie is set. Declining costs you nothing — the site works exactly the same.

Your decision is kept in your browser under the name tsm_consent (local storage, not a cookie, never transmitted to us), so that we do not have to ask again on every page. You can change it at any time via Cookie settings at the bottom of every page. A withdrawal takes effect at once and does not affect the lawfulness of what was processed before it.

Everything else on this site comes from tsmondo.eu itself: fonts, images and stylesheets. We load no web fonts from third-party servers and we embed no videos. If your browser sends a Global Privacy Control signal, we treat that as a refusal and do not show the banner at all. The self-check runs without any measurement — see 2.4 below.

2.2 Reach measurement and advertising (Google Analytics 4, Google Ads)

Only with your consent. If you agree in the banner, we load the Google tag and use two services of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland.

Data processed: a randomly generated identifier stored in cookies, the pages you open, the referring page, your device, browser and operating system, an approximate location at country and region level, and the time of your visit. Google uses your IP address to derive that location; it is not stored in the property.

Legal basis: Art. 6 (1) (a) GDPR and § 25 (1) TDDDG — your consent. You may withdraw it at any time via Cookie settings; processing carried out before the withdrawal remains lawful.

Consent Mode v2: before your consent the Google tag is not loaded at all, and if you decline it stays unloaded. No cookieless measurement runs quietly in the background.

Retention: Google deletes the event and user data of this property after 14 months.

Transfer to the USA: your contract partner is Google Ireland Limited, but data may reach Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA. Google LLC is certified under the EU-US Data Privacy Framework, so the European Commission's adequacy decision of 10 July 2023 applies as the basis for the transfer; the EU Standard Contractual Clauses have been agreed in addition. US authorities may under certain conditions be granted access to data held by US providers, and enforcing your rights there may be more difficult than in the EU.

Further information: Google's own privacy notice is at https://policies.google.com/privacy and a browser add-on that blocks Google Analytics at https://tools.google.com/dlpage/gaoptout

2.3 Server log files

When you access this website, your browser automatically transmits data that our hosting provider stores in server log files: IP address, date and time of the request, the page requested, referrer URL, browser type and version, and operating system.

Purpose: operating and securing the website, detecting and tracing attacks.
Legal basis: Art. 6 (1) (f) GDPR — our legitimate interest in a stable, secure service.
Retention: log entries are deleted after 7 days; entries required to investigate a specific security incident are retained until that investigation is complete.

Hosting: the site runs on a server operated by IONOS SE, Elgendorfer Str. 57, 56410 Montabaur, Germany, located in the EU. A data processing agreement pursuant to Art. 28 GDPR is in place.

2.4 NIS2 self-check

The self-check runs entirely in your browser. Your answers are not transmitted to us and are not stored on our servers. If you reload or close the page, the data is gone. We therefore do not process any personal data through the self-check.

2.5 Checklist request (email newsletter)

If you request the NIS2 checklist, we process the following:

Legal basis: Art. 6 (1) (a) GDPR — your consent. You may withdraw it at any time with effect for the future, via the unsubscribe link in every email or by writing to info@tsmondo.eu. Withdrawal does not affect the lawfulness of processing carried out before it.

Double opt-in: after you submit the form we send you a confirmation email. Your address is only added to the distribution list once you click the confirmation link. If you do not confirm, the pending entry is deleted after 30 days.

Processor: we use Mailchimp, a service of Intuit Inc., 2700 Coast Avenue, Mountain View, CA 94043, USA. Mailchimp processes your email address on our behalf under a data processing agreement pursuant to Art. 28 GDPR.

Transfer to the USA: this involves a transfer of personal data to a third country. Intuit Inc. is certified under the EU-US Data Privacy Framework; the European Commission's adequacy decision of 10 July 2023 therefore applies as the basis for the transfer pursuant to Art. 45 GDPR. In addition, the data processing agreement includes the EU Standard Contractual Clauses. Please note that US authorities may, under certain conditions, be granted access to data held by US providers, and that enforcing your rights there may be more difficult than within the EU.

Reach measurement in emails: our emails contain a counting pixel and link tracking that record whether an email was opened and which links were clicked. This helps us judge whether the content is useful. Legal basis: Art. 6 (1) (a) GDPR — your consent, which also covers this measurement. You can prevent it by blocking images in your email client or by unsubscribing.

Retention: until you withdraw your consent. After withdrawal we keep your address on a suppression list so that we do not contact you again — legal basis Art. 6 (1) (f) GDPR.

2.6 Contact by email

If you write to us, we process your address and the content of your message in order to answer it. Legal basis: Art. 6 (1) (b) GDPR where your enquiry relates to a contract, otherwise Art. 6 (1) (f) GDPR. Business correspondence is retained for the statutory periods (6 or 10 years under German commercial and tax law).

Our mailboxes are hosted by Microsoft Ireland Operations Ltd. (Microsoft 365) in the EU, under a data processing agreement pursuant to Art. 28 GDPR.

2.7 Your rights

You have the right to information (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20), and the right to object to processing based on legitimate interests (Art. 21). Where processing is based on consent, you may withdraw it at any time (Art. 7 (3)).

To exercise these rights, write to info@tsmondo.eu.

You also have the right to lodge a complaint with a supervisory authority. The authority responsible for us is:
Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen, Kavalleriestr. 2–4, 40213 Düsseldorf, Germany. You may also complain to the supervisory authority in your own country of residence — for example the Autoriteit Persoonsgegevens (NL), the Gegevensbeschermingsautoriteit / Autorité de protection des données (BE), or the Datenschutzbehörde (AT).

2.8 Obligation to provide data

There is no statutory or contractual obligation to provide personal data. If you do not give us your email address, we simply cannot send you the checklist.

2.9 No automated decision-making

We do not use automated decision-making or profiling within the meaning of Art. 22 GDPR.

Version: 3 August 2026.