Privacy policy

Controller

TSMONDO GmbH, Zum Erlenbusch 41c, 48167 Münster, Germany
Managing Director: Thorsten Schmitz-Hübsch · info@tsmondo.eu · +49 162 9691436

You can contact our data protection officer at security@tsmondo.de.

2.1 Cookies and consent

This website only sets cookies that need your permission once you have given it. The first time you open a page, a banner asks you to decide: decline or agree, both equally easy. Until you decide, nothing is loaded from Google and no analytics or advertising cookie is set. Declining costs you nothing — the site works exactly the same.

Your decision is kept in your browser under the name tsm_consent (local storage, not a cookie, never transmitted to us), so that we do not have to ask again on every page. You can change it at any time via Cookie settings at the bottom of every page. A withdrawal takes effect at once and does not affect the lawfulness of what was processed before it.

Apart from the booking calendar (2.7), everything else on this site comes from tsmondo.eu itself: fonts, images and stylesheets. We load no web fonts from third-party servers and we embed no videos. If your browser sends a Global Privacy Control signal, we treat that as a refusal and do not show the banner at all. The self-check runs without any measurement — see 2.4 below.

2.2 Reach measurement and advertising (Google Analytics 4, Google Ads)

Only with your consent. If you agree in the banner, we load the Google tag and use two services of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland.

Data processed: a randomly generated identifier stored in cookies, the pages you open, the referring page, your device, browser and operating system, an approximate location at country and region level, and the time of your visit. Google uses your IP address to derive that location; it is not stored in the property.

Legal basis: Art. 6 (1) (a) GDPR and § 25 (1) TDDDG — your consent. You may withdraw it at any time via Cookie settings; processing carried out before the withdrawal remains lawful.

Consent Mode v2: before your consent the Google tag is not loaded at all, and if you decline it stays unloaded. No cookieless measurement runs quietly in the background.

Retention: Google deletes the event and user data of this property after 14 months.

Transfer to the USA: your contract partner is Google Ireland Limited, but data may reach Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA. Google LLC is certified under the EU-US Data Privacy Framework, so the European Commission's adequacy decision of 10 July 2023 applies as the basis for the transfer; the EU Standard Contractual Clauses have been agreed in addition. US authorities may under certain conditions be granted access to data held by US providers, and enforcing your rights there may be more difficult than in the EU.

Further information: Google's own privacy notice is at https://policies.google.com/privacy and a browser add-on that blocks Google Analytics at https://tools.google.com/dlpage/gaoptout

2.3 Server log files

When you access this website, your browser automatically transmits data that our hosting provider stores in server log files: IP address, date and time of the request, the page requested, referrer URL, browser type and version, and operating system.

Purpose: operating and securing the website, detecting and tracing attacks.
Legal basis: Art. 6 (1) (f) GDPR — our legitimate interest in a stable, secure service.
Retention: log entries are deleted after 7 days; entries required to investigate a specific security incident are retained until that investigation is complete.

Hosting: the site runs on a server operated by IONOS SE, Elgendorfer Str. 57, 56410 Montabaur, Germany, located in the EU. A data processing agreement pursuant to Art. 28 GDPR is in place.

2.4 NIS2 self-check

The self-check runs entirely in your browser. Your answers are not transmitted to us and are not stored on our servers. If you reload or close the page, the data is gone. We therefore do not process any personal data through the self-check.

2.5 Checklist request (email newsletter)

If you request the NIS2 checklist, we process the following:

Legal basis: Art. 6 (1) (a) GDPR — your consent. You may withdraw it at any time with effect for the future, via the unsubscribe link in every email or by writing to info@tsmondo.eu. Withdrawal does not affect the lawfulness of processing carried out before it.

Double opt-in: after you submit the form we send you a confirmation email. Your address is only added to the distribution list once you click the confirmation link. If you do not confirm, the pending entry is deleted after 30 days.

Processor: we use Mailchimp, a service of Intuit Inc., 2700 Coast Avenue, Mountain View, CA 94043, USA. Mailchimp processes your email address on our behalf under a data processing agreement pursuant to Art. 28 GDPR.

Transfer to the USA: this involves a transfer of personal data to a third country. Intuit Inc. is certified under the EU-US Data Privacy Framework; the European Commission's adequacy decision of 10 July 2023 therefore applies as the basis for the transfer pursuant to Art. 45 GDPR. In addition, the data processing agreement includes the EU Standard Contractual Clauses. Please note that US authorities may, under certain conditions, be granted access to data held by US providers, and that enforcing your rights there may be more difficult than within the EU.

Reach measurement in emails: our emails contain a counting pixel and link tracking that record whether an email was opened and which links were clicked. This helps us judge whether the content is useful. Legal basis: Art. 6 (1) (a) GDPR — your consent, which also covers this measurement. You can prevent it by blocking images in your email client or by unsubscribing.

Retention: until you withdraw your consent. After withdrawal we keep your address on a suppression list so that we do not contact you again — legal basis Art. 6 (1) (f) GDPR.

2.6 Checklist and online check results by e-mail

Our online checklists keep your ticks in your browser's local storage only; nothing is sent to us while you fill them in. Only when you request the detailed results by e-mail does the checklist send your details to our server; the checklists on tsmondo.eu send the request directly. Our German-language checklists on projektmanagement.tsmondo.de pass the request on server-side to our server tsmondo.de, which calculates and sends the results; both servers are operated by us on the same machine, and your IP address is handed over so that the misuse protection (rate limit) applies per sender. We then process the following:

Our request log contains your email address, name, company, the checklist, the language, the overall result in percent, the number of open high-priority items, the time of the request and whether you opted in to the mailing list – not the individual items you ticked. The results themselves and a copy with the results by area are kept as emails in our mailbox. To block automated requests, our server keeps a counter per IP address for a few seconds and for up to one hour (rate limit); it does not contain the IP address itself, only a check value derived from it with a secret key. This data is not passed on to anyone.

EU AI Act check. For the EU AI Act check (tsmondo.eu/en/ai-act-check, and its Italian version at tsmondo.eu/it/verifica-ai-act) the above applies with these differences. Your answers (your role, the AI use cases, four questions about your organisation and its size) stay in your browser's working memory until you request the assessment; the short result is calculated by your browser and nothing about your answers is sent to us. To display the check, the page loads the list of questions from our server tsmondo.eu. When you request the full assessment, the page sends your details directly to tsmondo.eu; only identifiers of your answers are transmitted, and the texts of the assessment are generated by our server. Instead of an overall result and open items, our request log stores the risk class determined, your role, the selected use cases and the size of your organisation; your answers on the status of your organisation appear only in the copy of the request sent to info@tsmondo.de. We tag your mailing-list entry with the check and the language. If you have consented to analytics, the page reports only the event “assessment requested” to Google Analytics after a successful request, without your details.

Legal basis: Art. 6 (1) (b) GDPR for calculating and sending the results you requested with the mandatory checkbox in the form. We only add you to our mailing list if you also tick the separate, optional checkbox for it; the legal basis is then your consent under Art. 6 (1) (a) GDPR. Sending the results does not depend on this consent – you receive them even if you do not join the mailing list. The shortened IP network and the rate-limit counter are processed under Art. 6 (1) (f) GDPR; our legitimate interest is protecting the form against misuse.

Sending: the results are calculated by our server and emailed to you straight away via Microsoft 365 (see 2.8). We do not send reminder emails after a checklist or online check request.

Mailing list: only if you tick the separate, optional checkbox for the mailing list do we add you — subject to your confirmation (double opt-in) — to the same Mailchimp distribution list described in 2.5, where you will also find the processor, the transfer to the USA and how to withdraw. We use it to keep you posted on NIS2, the AI Act and data protection and to ask how you liked the assessment. The checkbox is not pre-ticked; without it, we do not pass your data to Mailchimp. We tag your entry with the checklist and language you used and with the fact that you signed up via the checklist, so that we only send you related information. We do not pass your results or ticked items to Mailchimp.

Retention: entries in the request log are deleted no later than 90 days after the request. The emails with your results are kept as long as needed to handle your request and deleted at your request unless statutory retention obligations apply. For the mailing list, the retention described in 2.5 applies. Rate-limit counter files are deleted once they hold no entries from the last hour; files older than one hour are removed automatically on later requests.

Withdrawal: you may withdraw your consent to the mailing list at any time with effect for the future, via the unsubscribe link in every email or by writing to info@tsmondo.eu. Withdrawal does not affect the sending of your results. Your other rights under 2.9 remain unaffected.

2.7 Requesting a demo (NIS2 Manager, AI Manager)

If you request a demo by email via a product page on tsmondo.eu (NIS2 Manager or AI Manager), we process:

Legal basis: Art. 6 (1) (b) GDPR applies to sending the requested demo — a pre-contractual measure taken at your request; the required checkbox "privacy policy read" is sufficient for this. For the up to three hint emails about it (after about 3, 7 and 10 days, with tips about the demo and an offer for a free consultation) Art. 6 (1) (a) GDPR applies instead — your separate, voluntary consent via the second checkbox in the form. Without this additional consent you receive only the requested demo, no hint emails. Requesting the demo does not sign you up to a newsletter or mailing list.

Sending: We send the demo email and the hint emails via Microsoft 365 (processor: Microsoft Ireland Operations Limited, see 2.8 "Contact by email"). For our own mailbox info@tsmondo.de we additionally generate an internal notification for every request, with email address, company name, product and country — without any IP address or IP network.

Withdrawal: You may withdraw your consent to the hint emails at any time with effect for the future: via the automatic, personal unsubscribe link in every hint email, by replying "STOP" to one of the emails, or informally to info@tsmondo.de. After a withdrawal we keep your email address on a suppression list so that we do not send you any further hint emails — legal basis Art. 6 (1) (f) GDPR. Withdrawal does not affect the sending of the requested demo itself.

Retention: We delete the log data from the demo form (email address, company, product, language, country, timestamp and — if given — the timestamp and wording version of your consent to the hint emails) automatically at the latest 90 days after the request. We delete the internal notification to info@tsmondo.de at the latest 90 days after the request as well.

Booking a call: The demo email, the hint emails and the thank-you page link to Microsoft Bookings (Microsoft 365, processor Microsoft Ireland Operations Limited, see 2.8). If you book, Bookings processes your name, email, phone, company, notes and the chosen time (Art. 6 (1) (b) GDPR). The calendar on the thank-you page is embedded only after you click ‘Choose a time’, which sends technical data such as your IP address to Microsoft (Art. 6 (1) (a) GDPR). A transfer to Microsoft Corporation (USA) cannot be ruled out (EU-US Data Privacy Framework, Standard Contractual Clauses). Booking data is kept for the duration of the business relationship or statutory retention periods.

2.8 Contact by email

If you write to us, we process your address and the content of your message in order to answer it. Legal basis: Art. 6 (1) (b) GDPR where your enquiry relates to a contract, otherwise Art. 6 (1) (f) GDPR. Business correspondence is retained for the statutory periods (6 or 10 years under German commercial and tax law).

Our mailboxes are hosted by Microsoft Ireland Operations Ltd. (Microsoft 365) in the EU, under a data processing agreement pursuant to Art. 28 GDPR.

2.9 Your rights

You have the right to information (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20), and the right to object to processing based on legitimate interests (Art. 21). Where processing is based on consent, you may withdraw it at any time (Art. 7 (3)).

To exercise these rights, write to info@tsmondo.eu.

You also have the right to lodge a complaint with a supervisory authority. The authority responsible for us is:
Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen, Kavalleriestr. 2–4, 40213 Düsseldorf, Germany. You may also complain to the supervisory authority in your own country of residence — for example the Autoriteit Persoonsgegevens (NL), the Gegevensbeschermingsautoriteit / Autorité de protection des données (BE), or the Datenschutzbehörde (AT).

2.10 Obligation to provide data

There is no statutory or contractual obligation to provide personal data. If you do not give us your email address, we simply cannot send you the checklist.

2.11 No automated decision-making

We do not use automated decision-making or profiling within the meaning of Art. 22 GDPR.

Version: 26 September 2026 (section 2.7 requesting a demo added).