Controller
The controller responsible for processing personal data on this website is PoW24, Christian Pittroff, Friedhofstraße 5c, 96515 Sonneberg / Neufang, Germany. Telephone: +49 (0) 3675 42946-23. Email for privacy enquiries: impressum@pow24.org.
Principles and legal bases
We process personal data only where this is necessary to provide the website securely, respond to your inquiry or comply with legal duties. Depending on the circumstances, processing is based on Article 6(1)(b) GDPR for steps prior to entering into a contract or contract performance, Article 6(1)(f) GDPR for secure and efficient operation and for responding to other enquiries and, where expressly requested, Article 6(1)(a) GDPR. Our legitimate interests include IT security, abuse prevention, reliable communication and accountable handling of incoming inquiries.
IONOS web hosting and database; email services
The website, PHP interface and associated MySQL/MariaDB database are operated by IONOS SE, Elgendorfer Straße 57, 56410 Montabaur, Germany. The web server hands form notifications to its local mail function. Under the domain's current mail-server configuration, the primary recipient mailbox webmaster@pow24.de is reached through systems operated by freenet.de GmbH, Deelbögenkamp 4, 22297 Hamburg, Germany. The fallback mailbox mobile@erstebdw.de is reached through IONOS mail servers. During transfer and storage of a notification, the email services involved may process connection and delivery metadata as well as message content. Where a service provider processes personal data on our behalf, this processing is governed by Article 28 GDPR. These services are used to provide our online presence securely and efficiently and to communicate reliably with prospective clients under Article 6(1)(b) and (f) GDPR.
Server log files
When the website is accessed, IONOS processes technically necessary access data. According to the current IONOS product information, this includes the referrer, requested page or file, browser type and version, operating system, device type, time of access and an anonymised IP address. This data is used to provide the service securely, reliably and without errors. IONOS states that this visitor data is retained for up to eight weeks. PoW24 does not combine these logs with project inquiries or use them to create personal usage profiles. No analytics or marketing trackers are embedded in the website itself.
Local content and external links
Fonts, images, stylesheets and scripts are served locally from the IONOS webspace. Merely visiting a page therefore does not load content from Google Fonts, social-media platforms, analytics providers, advertising networks or external CAPTCHA services. External project or source-code websites are contacted only when you deliberately follow the relevant link. From that point onwards, the operator of the destination website processes data under its own responsibility.
Strictly necessary session and cookie
The strictly necessary “pow24_session” session is used only on the inquiry form. The cookie contains a random session identifier, must be transmitted securely, cannot be read by JavaScript (HttpOnly), is restricted to the website and uses SameSite=Strict. It provides CSRF protection and binds the security question to that specific form session. The cookie expires with the browser session; the CSRF token is renewed after no more than two hours and is discarded after a successful submission. Storage is necessary to provide the form service expressly requested by the visitor and is permitted under Section 25(2)(2) TDDDG; subsequent processing is based on Article 6(1)(b) and (f) GDPR. A consent banner is not required for this strictly necessary storage.
Project inquiry and form fields
For a project inquiry, we process customer type, name, email address, preferred contact method, requested service, project description, budget range and desired timeline. Company, telephone number and postal address are optional; a telephone number is required only if you choose a callback as your preferred contact method. We also store the time of your privacy declaration and the processing status of the inquiry. The information is used solely for personal review, responding, preparing a proposal and, where applicable, entering into or performing a contract. The legal basis is Article 6(1)(b) GDPR and, for other enquiries, Article 6(1)(f) GDPR; where the form confirmation is relied upon as consent, Article 6(1)(a) GDPR also applies. Recipients are authorised PoW24 personnel, IONOS for web hosting, database and mail hand-off, and Freenet for the primary recipient mailbox. Required fields are marked with an asterisk. Without them, we cannot transmit or meaningfully answer the inquiry.
Local CAPTCHA and spam prevention
The security check is generated and evaluated entirely on the PoW24 webspace. No external CAPTCHA service is embedded and no form data is transmitted to a CAPTCHA provider. The arithmetic question is valid for ten minutes, bound to the session and CSRF token and can be used only once. Only a cryptographic verification value for the answer is held on the server. After eight failed attempts, the session is temporarily locked. We additionally use a field hidden from human users, a minimum interaction time, server-side field validation and rate limiting. For rate limiting, the IP address is irreversibly hashed with a secret key; the plain IP address is not stored in the inquiry database. No more than five successful inquiries per hash per hour are accepted. Rate-limit entries are deleted after no more than two days. This processing protects the website against automated attacks and maintains availability under Article 6(1)(f) GDPR.
Storage and email notification
A valid inquiry is first stored transactionally in the IONOS database. The web server then creates a notification email containing the inquiry ID, customer type, name, company, email, telephone number, preferred contact method, service, budget, timeline and project description. The primary recipient is webmaster@pow24.de; the domain is currently routed through Freenet mail servers. If the local mail function immediately rejects the hand-off, one attempt is made to use mobile@erstebdw.de as the fallback recipient through IONOS mail servers. The optional postal address remains in the inquiry database and is not included in the notification email. Acceptance by the local mail function confirms only technical hand-off, not final delivery. Replies and subsequent correspondence are processed as normal business communication.
Retention and deletion
Inquiries that do not result in a contract are deleted from the inquiry database twelve months after the last professionally relevant contact. Associated processing events are deleted at the same time. Notifications and correspondence in the mailboxes are assigned to the same process and deleted once they are no longer required for handling the inquiry or for evidence. If an inquiry becomes a contract, the necessary data is processed separately as contractual and business records and deleted after the applicable commercial, tax or civil-law retention and limitation periods have expired. Statutory duties and the establishment, exercise or defence of legal claims may require longer retention.
Security of processing
The website uses TLS encryption. The form uses measures including secure session parameters, CSRF protection, a one-time challenge, server-side validation, prepared database statements, size limits, rate limiting and restrictive security headers. Credentials and cryptographic keys are stored outside the public web directory. Despite these measures, transmission over the internet cannot be guaranteed to be absolutely secure.
Your rights
Subject to the conditions of the GDPR, you have rights of access, rectification, erasure, restriction of processing and data portability. You may object, on grounds relating to your particular situation, to processing based on legitimate interests. You may withdraw consent at any time with effect for the future; this does not affect the lawfulness of processing carried out before withdrawal. To exercise your rights, email impressum@pow24.org. You also have the right to lodge a complaint with a data protection supervisory authority.
Competent supervisory authority
The supervisory authority for private-sector organisations in Thuringia is the Thüringer Landesbeauftragte für den Datenschutz und die Informationsfreiheit: Häßlerstraße 8, 99096 Erfurt, Germany; PO box 90 04 55, 99107 Erfurt, Germany; telephone +49 (0) 361 57-3112900; email poststelle@datenschutz.thueringen.de. You may also contact another supervisory authority competent under Article 77 GDPR.
Recipients, international transfers and automated decisions
We do not disclose inquiry data for advertising purposes. No transfers to recipients in third countries are intended for the website processes described here. According to the current IONOS information, the stated web-hosting visitor data is not transferred to third countries. We do not make decisions based solely on automated processing that produce legal or similarly significant effects from your project inquiry, and we do not carry out profiling.
Changes to this notice
We update this privacy notice if functions, recipients, legal bases or retention rules change. The current version is permanently available at /en/privacy/. The German version at /de/datenschutz/ describes the same processing and is authoritative for legal interpretation in Germany.