This notice explains how Hardtstein processes personal data under the GDPR and applicable German data-protection law.
1. Controller
Hardtstein UG (haftungsbeschränkt), Hilpertstraße 31, 64295 Darmstadt, Germany. Managing directors: Gabor Bernhardt and Silas Schlehenstein. Commercial register: Local Court of Darmstadt, HRB 107549. VAT ID: DE452969180.
Contact: kontakt@hardtstein.de · +49 151 41630297.
2. Hosting
The website is delivered through Vercel Inc., 340 S Lemon Ave #4133, Walnut, CA 91789, USA. Technical request data such as IP address, time, URL, status code, referrer, user agent, and data volume may be processed in server logs for delivery, security, and abuse prevention. Logs are generally deleted or anonymized within 30 days. Transfers to the USA are based on an applicable transfer mechanism such as the EU-US Data Privacy Framework or standard contractual clauses. See Vercel’s privacy policy.
3. Analytics and advertising
DataFast loads its standard analytics script only after Statistics consent, measuring website reach and consented actions such as CTA clicks and checkout initiation. Google Ads and Microsoft Advertising UET load for advertising measurement only after Marketing consent. Optional tracking is controlled via Cookie settings. The reviewed website source does not contain an X Pixel. No Google Ads conversion event is sent merely because a visitor grants consent.
Depending on consent, processed data may include page views, timestamps, referrer, browser and device information, pseudonymous identifiers, and configured conversion events. Relevant providers may process data in the EU and the USA. See DataFast, Google, and Microsoft for provider details.
4. Business Security Review
When you buy the review through Stripe or contact us about it, we process the information needed to provide the service and communicate with you. The legal basis is pre-contractual measures and contract performance under Article 6(1)(b) GDPR. We retain the information only as long as needed for the request and any applicable legal obligations.
The website links to Stripe's hosted checkout and does not collect review intake details through a local contact form.
5. Stripe payments
Review payments are processed by Stripe Payments Europe Limited, 1 Grand Canal Street Lower, Grand Canal Dock, Dublin D02 H210, Ireland; parent company Stripe, Inc., USA. Stripe receives payment and checkout information such as name, email, billing details, payment method, transaction metadata, IP address, device information, and fraud-prevention signals. We do not receive full card or bank details.
The website links directly to Stripe's hosted checkout. Stripe may process data in the USA or other countries using applicable safeguards. See Stripe’s privacy notice.
6. Contact and scheduling
If you contact us by email or phone, we process your details to answer your request and handle follow-up. Appointments may be arranged through Cal.com. Booking data can include name, email address, selected time, and any additional information voluntarily supplied. The booking destination after Stripe checkout still needs to be verified. See Cal.com’s privacy notice.
7. Security review access and confidentiality
Client information is treated confidentially, and access is limited to what is necessary for the agreed review. Never send passwords by ordinary email or through general-purpose forms. Before assessment, customers must confirm that they own or are authorized to request review of the specified accounts and systems. Where we process personal data on behalf of a client, the parties must determine whether a data-processing agreement under Article 28 GDPR is required.
8. Cookies and local storage
The site stores the necessary key hardtstein-consent-v1 locally to remember your cookie choice. The optional analytics and marketing categories are controlled in Cookie settings. Payment information is handled through Stripe's hosted checkout.
You can delete local storage by clearing the website data in your browser.
9. Recipients and retention
Depending on the feature used, recipients can include Vercel, DataFast, Google, Microsoft, Stripe, and Cal.com. We share data only when needed for the stated purpose, required by law, or permitted by consent. Data is deleted when the purpose ends unless statutory commercial or tax retention rules require longer storage.
10. Your rights
Subject to the legal requirements, you may request access, correction, deletion, restriction, and data portability, and object to processing based on legitimate interests. You may withdraw consent at any time for the future through Cookie settings. You also have the right to complain to a supervisory authority:
Hessian Commissioner for Data Protection and Freedom of Information (HBDI)
Postfach 3163, 65021 Wiesbaden, Germany
Phone: 0611 1408-0 · Email: poststelle@datenschutz.hessen.de
datenschutz.hessen.de
11. Managing consent
Use Cookie settings in the footer to enable or disable Statistics and Marketing. Necessary processing for hosting, security, and storing your choice remains active.
Last updated: October 9, 2026