Privacy Policy

Please note: In case of conflicting translations, the German version of this Privacy Policy is the authoritative version.

Effective date: 31 August 2026

1. Overview

This page explains what happens to your personal data when you visit ecsocfin.com. We process personal data in accordance with the General Data Protection Regulation (GDPR, EU 2016/679), the German Federal Data Protection Act (BDSG) and the German Telecommunications Digital Services Data Protection Act (TDDDG).

In short: this website is a static site with no contact form and no user accounts. It sets no analytics cookies unless you explicitly consent, it loads no third-party content when you open a page, and its web fonts are served from our own server.

2. Data Controller

The controller responsible for data processing on this website is:

ECSF GmbH
Leutstettenerstr. 12
82319 Starnberg, Germany
Email: office@ecsocfin.com
Phone: +49 89 547678–10

3. Hosting and Delivery

IONOS Deploy Now

This website is hosted by IONOS SE (Elgendorfer Str. 57, 56410 Montabaur, Germany) via their Deploy Now service. The servers are located in Germany. IONOS acts as our processor within the meaning of Art. 28 GDPR under a data processing agreement. The processing is based on our legitimate interest in the secure and efficient provision of our website (Art. 6(1)(f) GDPR). See the IONOS Privacy Policy.

Server log files

Our hosting provider automatically collects and stores information that your browser transmits, in so-called server log files:

  • browser type and version
  • operating system
  • referrer URL
  • hostname of the accessing device
  • time of the server request
  • IP address

This data is not merged with other data sources. Collection is based on Art. 6(1)(f) GDPR — we have a legitimate interest in the technically error-free presentation and the security of our website. Log files are stored for a short period and then deleted; they are kept longer only where necessary to investigate a specific security incident.

SSL/TLS encryption

This site uses SSL/TLS encryption for security and to protect the transmission of confidential content. You can recognise an encrypted connection by the “https://” prefix in the address bar and the padlock symbol in your browser.

GitHub

The source code of this website is managed and published from GitHub (GitHub Inc., 88 Colin P Kelly Jr St, San Francisco, CA 94107, USA), a subsidiary of Microsoft Corporation. No visitor data is transmitted to GitHub when you browse this site — GitHub only processes metadata relating to our own development activity. See GitHub's Privacy Statement.

4. Cookies and Local Storage

This website stores very few entries on your device. The following inventory is complete:

NameTypePurposeDurationLegal basis
cookie-consentLocal storageStores your decision about analytics cookies so you are not asked again on every page.until you delete it§ 25(2) no. 2 TDDDG (strictly necessary); Art. 6(1)(c) GDPR (record of consent)
themeLocal storageRemembers whether you chose the light or dark appearance.until you delete it§ 25(2) no. 2 TDDDG (function you explicitly requested)
horizon_authCookieAccess token for the non-public project area /horizon-proposal. Set only if you enter a password there.24 hours§ 25(2) no. 2 TDDDG (strictly necessary)
_ga, _ga_*Cookie (Google Analytics)Audience measurement. Set only if you have explicitly consented in the cookie banner.up to 24 months§ 25(1) TDDDG and Art. 6(1)(a) GDPR (consent)

As long as you have not consented, no analytics service is loaded and no analytics cookies are set. You can change your decision at any time via “Cookie settings” in the footer of every page. You can also delete or block cookies in your browser settings; this website remains fully functional either way.

5. Analytics

Google Analytics

This website uses Google Analytics 4, provided by Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Ireland), with onward transfer to Google LLC (1600 Amphitheatre Parkway, Mountain View, CA 94043, USA).

Legal basis: Storing cookies on, and accessing information in, your device is based exclusively on your consent under § 25(1) TDDDG. The subsequent processing of your personal data is based on Art. 6(1)(a) GDPR. Google Analytics is only loaded after you have accepted in the cookie banner — no data whatsoever is transmitted to Google before you consent.

Withdrawal: You may withdraw your consent at any time with effect for the future using the “Cookie settings” link in the footer of every page. Alternatively, you can prevent collection with the Google Analytics opt-out browser add-on.

Data processed: truncated IP address, pages visited, time and duration of the visit, approximate location, device type, browser and operating system, and the referral source. IP anonymisation is enabled by default in Google Analytics 4; your IP address is truncated before storage.

Third-country transfer: Google LLC is certified under the EU-US Data Privacy Framework; in addition, we have concluded the EU Standard Contractual Clauses with Google. A data processing agreement under Art. 28 GDPR is in place.

For more information, see Google's Privacy Policy.

6. Other Services and Third-Party Content

Web fonts (self-hosted)

This website uses the “Inter” and “Outfit” typefaces. The font files are stored entirely on our own server and delivered from there. There is no connection to Google servers and no data — in particular not your IP address — is transmitted to Google when you visit this website.

Newsletter

If you wish to receive our newsletter, we need your email address and confirmation that you are the owner of that address and consent to receiving the newsletter. Sign-up uses the double opt-in procedure: after submitting the form you receive an email in which you must confirm your subscription.

Processing of the data entered in the newsletter form is based exclusively on your consent (Art. 6(1)(a) GDPR). You may withdraw your consent at any time, for example via the “unsubscribe” link in every newsletter. The data is stored with our newsletter provider until you unsubscribe, and is then deleted from the distribution list. The record of your original consent is retained for up to three years after the end of the year of unsubscription in order to defend against potential claims (Art. 6(1)(f) GDPR).

Mailchimp

Our newsletter is distributed via Mailchimp (Intuit Inc. / The Rocket Science Group LLC, 675 Ponce De Leon Ave NE, Suite 5000, Atlanta, GA 30308, USA). When you sign up on our website, the data you provide is transferred to Mailchimp and stored there. Mailchimp manages our subscriber list and sends the newsletters; it can also record whether a newsletter was opened and which links were clicked.

Mailchimp is certified under the EU-US Data Privacy Framework, supplemented by the EU Standard Contractual Clauses. A data processing agreement under Art. 28 GDPR is in place. See Mailchimp's Privacy Policy.

Contacting us by email

This website has no contact form. If you contact us by email, your enquiry and all personal data it contains are stored and processed by us for the purpose of handling your request. The legal basis is Art. 6(1)(b) GDPR where your enquiry relates to the performance of a contract or pre-contractual measures, and otherwise our legitimate interest in dealing effectively with enquiries addressed to us (Art. 6(1)(f) GDPR). We do not pass this data on without your consent. It remains with us until your request has been fully dealt with and no statutory retention obligations apply.

External links

This website links in places to third-party offerings such as project websites, publications or registration forms operated by our project partners. This content is not embedded in our pages — simply opening our pages transmits no data to those providers. Only when you actively click such a link do you reach the provider's site, where their own privacy policy applies.

7. Your Rights

You have the following rights regarding your personal data:

  • Right of access (Art. 15 GDPR) — to request information about the personal data we process.
  • Right to rectification (Art. 16 GDPR) — to request correction of inaccurate or completion of incomplete data.
  • Right to erasure (Art. 17 GDPR) — to request deletion of your data, unless statutory retention obligations apply.
  • Right to restriction (Art. 18 GDPR) — to request that your data only be processed in a restricted manner.
  • Right to data portability (Art. 20 GDPR) — to receive the data you provided on the basis of consent or a contract in a structured, commonly used and machine-readable format.
  • Right to withdraw consent (Art. 7(3) GDPR) — to withdraw a consent you have given at any time with effect for the future.
  • Right to lodge a complaint (Art. 77 GDPR) — see below.

Right to object (Art. 21 GDPR)

Where processing is based on Art. 6(1)(e) or (f) GDPR, you have the right to object at any time, on grounds relating to your particular situation, to the processing of your personal data; this also applies to profiling based on those provisions. The legal basis for each processing operation is set out in this Privacy Policy. If you object, we will no longer process the personal data concerned unless we can demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms, or the processing serves the establishment, exercise or defence of legal claims.

Right to lodge a complaint

In the event of infringements of the GDPR, you have the right to lodge a complaint with a supervisory authority, in particular in the EU member state of your habitual residence, place of work or the place of the alleged infringement. The authority competent for us is:

Bayerisches Landesamt für Datenschutzaufsicht (BayLDA)
Promenade 27
91522 Ansbach, Germany
www.lda.bayern.de

8. Retention, Security and Minors

Where no more specific retention period is stated in this Privacy Policy, your personal data remains with us until the purpose for processing ceases to apply. If you make a legitimate request for erasure or withdraw a consent, your data will be deleted unless we have other legally permissible grounds for storing it (such as retention periods under tax or commercial law); in that case, deletion follows once those grounds cease to apply.

We implement appropriate technical and organisational measures under Art. 32 GDPR to protect your data against loss, destruction, manipulation and unauthorised access. These measures are improved on an ongoing basis in line with technological developments.

Our service is not directed at persons under the age of 16 and we do not knowingly collect personal data from children under 16. If you are a parent or guardian and become aware that a child has provided us with personal data, please contact us and we will delete it promptly.

9. Changes to This Privacy Policy

We update this Privacy Policy whenever changes to the services we use or to the legal framework make it necessary. The version published on this page, bearing the effective date above, is the applicable one.

10. Contact

For questions about this Privacy Policy or to exercise your rights, contact us:

  • By email: office@ecsocfin.com
  • By post: ECSF GmbH, Leutstettenerstr. 12, 82319 Starnberg, Germany