Privacy policy

How KWMS Consulting processes personal data on this website and in its services.

This English version is provided for convenience. The German version is legally binding.

1. Controller

Markus Winter, freelance activity under the name “KWMS Consulting”, Saarlandstraße 53, 78050 Villingen-Schwenningen, Germany (further details in the legal notice). E-mail: markus.winter@kwms-consulting.com

A data protection officer is not required by law. Please address data protection enquiries to the address above.

2. Hosting and server log files

When you access the website, the hosting provider IONOS SE, Elgendorfer Straße 57, 56410 Montabaur, Germany, processes technically necessary data on our behalf (Art. 28 GDPR): IP address, date and time, requested page, referrer, browser and operating system information. The legal basis is Art. 6 (1) (f) GDPR (secure and stable operation). Log files are deleted after 7 days.

3. Cookies, consent and cookie policy

A consent dialog appears on your first visit. Without your decision, only technically necessary storage technologies are used (Section 25 (2) no. 2 TDDDG). Statistics and media services are only loaded after your consent (Art. 6 (1) (a) GDPR, Section 25 (1) TDDDG). Consent is voluntary, can be withdrawn at any time via “Cookie settings” in the footer and is stored locally with a timestamp for evidence purposes.

• kwms_consent (necessary, local storage, 12 months): your selection in the consent dialog.
• kwms_theme (necessary, local storage, until revoked): your choice between light and dark design – only if you use the switch; not transmitted to our server.
• kwms_lang (necessary, local storage): selected language.
• KWMSKI (necessary, cookie, session): login to the AI selection portal and licence management.
• KWMSINT (necessary, cookie, session): login to the internal area – for the operator only.
• _ga, _ga_* (statistics, cookie, up to 2 years): Google Analytics, see section 4.
• NID, CONSENT and others (external media, cookie, up to 6 months): Google Maps, see section 5.

4. Google Analytics 4 (only with consent)

Provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Google Analytics is only loaded after consent (Consent Mode). IP addresses are processed in shortened form; Google Signals and advertising features are deactivated. Data may be transferred to the USA; Google LLC is certified under the EU-US Data Privacy Framework, and standard contractual clauses also apply. Retention of usage data: 14 months. Legal basis: Art. 6 (1) (a) GDPR. You can withdraw consent at any time via the cookie settings.

5. Google Maps (only with consent)

We use Google Maps (Google Ireland Limited) to display the location map. The map is only embedded after you click “Load map” or consent to the “External media” category. In doing so, your IP address and device information are transmitted to Google, possibly also to the USA. Legal basis: Art. 6 (1) (a) GDPR.

6. Contact form, e-mail and phone

We process the information from the contact form (name, e-mail, optionally company and phone, message) to handle your enquiry and follow-up questions. Legal basis: Art. 6 (1) (b) GDPR (pre-contractual measures) or (f) (answering general enquiries). The data is deleted once the enquiry has been completed, unless statutory retention obligations apply.

Enquiries from the contact form are additionally created as a contact in our internal CRM (www.kwms-consulting.com/crm, operated by IONOS in Germany) so that we can process them traceably. Only authorised persons with two-factor login have access.

7. AI selection portal: orders, licences, user accounts

To order a package in the AI selection portal we collect company, contact person, business e-mail address, optionally phone, billing address, VAT ID and your order reference. After receipt of payment we generate a licence key, which is stored exclusively as a cryptographic hash and bound to your company’s e-mail domain. On activation we create a user account; further users of your company are invited by your administrator.

In the portal we store your answers in the selection chat, the information in the work packages, weightings, messages to us and a change history with user and time. The data is separated per company and stored on IONOS servers in Germany. Passwords are stored only as hashes. Data is not passed on to providers of AI solutions without your express consent. Legal basis: Art. 6 (1) (b) GDPR (performance of contract) and (f) (protection of licences against misuse). Retention: for the term of the licence plus 30 days read-only mode; order and invoice data in accordance with commercial and tax retention periods (6 or 10 years).

8. Research function

The research function in the header searches exclusively the content of this website. It runs entirely locally in your browser: your input is neither transmitted to our server nor to third parties or AI services, and it is not stored.

9. PDF download of consulting services

To download a service description we collect name, company, business e-mail address and optionally your phone number. The purpose is to provide the document and to contact you about the requested topic. The legal basis is your consent (Art. 6 (1) (a) GDPR), which you can withdraw at any time with effect for the future by e-mail to markus.winter@kwms-consulting.com, and Art. 6 (1) (b) GDPR (pre-contractual measures). The data is stored in the CRM and deleted no later than 24 months after the last contact unless a contractual relationship arises.

10. Registration of interest for platforms

If you register your interest in a platform, we process name, company, e-mail address and the selected platform in order to inform you about availability (Art. 6 (1) (a) GDPR). The data is deleted as soon as you object, but no later than twelve months after the platform becomes available.

11. Insights, LinkedIn and external links

On the Insights page we link to posts on LinkedIn and to external websites. No data is transferred to these providers when you visit our page; this only happens when you click a link. A LinkedIn post is only embedded directly if you trigger this by clicking and thereby consent to the “External media” category (Art. 6 (1) (a) GDPR, Section 25 (1) TDDDG). The provider is LinkedIn Ireland Unlimited Company, Wilton Place, Dublin 2, Ireland; data may be transferred to the USA, and LinkedIn is certified under the EU-US Data Privacy Framework.

12. CRM and internal processing

Contact enquiries, download requests and registrations of interest are stored and processed in our internal CRM. The CRM and the internal maintenance area of this website are not publicly accessible, are operated by IONOS in Germany and are protected by individual access credentials. Stored credentials are kept in encrypted form. Data is not passed on to third parties unless this is necessary for the performance of a contract and has been communicated to you beforehand.

13. Your rights

• Access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction (Art. 18), data portability (Art. 20) and objection (Art. 21 GDPR).
• Withdrawal of consent with effect for the future (Art. 7 (3) GDPR).
• Complaint to a supervisory authority, e.g. the State Commissioner for Data Protection and Freedom of Information Baden-Württemberg, Lautenschlagerstraße 20, 70173 Stuttgart, Germany.

14. Data security and changes

The website is delivered via TLS (HTTPS). We adapt this policy when services or the legal situation change; the version published here applies.

Open cookie settings

Last updated: 22 October 2026