Controller and contact
ESAVEST UG (haftungsbeschränkt), Juliushof 5, 12051 Berlin, Germany, is the controller. Online Agentur Berlin is a business division of ESAVEST. Contact info@esavest.de for privacy matters and info@online-agentur-berlin.de for project communication. This notice covers our website, enquiries and customer and partner workspaces.
Enquiries and communication
You can submit an enquiry without an account. We process your business and contact details, email address, project description, goals, scope, budget, timeframe, region and optional information to assess and answer your request, prepare an offer and organise a possible engagement. We send a receipt with a request ID and notify our internal team. Submission, registration and the receipt do not create a paid project contract or payment obligation.
Article 6(1)(b) GDPR applies to pre-contractual steps and contracts with you. For contacts representing a business, Article 6(1)(f) applies: our legitimate interest is handling business communication and the requested collaboration. Legal record-keeping relies on Article 6(1)(c). Mandatory fields are labelled; without sufficient details and a contact address we cannot properly handle a request. You have no statutory obligation to make an enquiry. Acknowledging this notice is not consent to marketing.
Accounts and project workspaces
An optional account stores your company, contact name, email, region, account identifier, hashed password and the time and version of the portal terms and privacy notice acknowledged at registration. Passwords are not stored in plain text. Account emails support access verification and password setup or recovery. Use the same email as your enquiry to link it after signing in. A request ID alone does not grant access.
Project data includes documents, messages, agreed offers, approvals and published progress updates. The project screen periodically requests the current status from our own server; this is not analytics. Actions may record the time and responsible account. Customers see their own projects. Partners receive assigned briefs and explicitly shared files, not customer budgets, internal calculations or competing offers.
The legal bases are Article 6(1)(b) for the requested account or contract, and Article 6(1)(f) for communication with business representatives, access security and traceable project administration. Upload only necessary data. Do not place passwords, identity documents, health records or other particularly sensitive information in general project fields.
Partner profiles and selection
We also process partner service profiles, rates, capacity, offer validity, quotations, delivery updates and messages to assess potential cooperation, select suitable providers and manage expressly commissioned work. Profiles and price lists are not a public directory. Our team decides assignments; calculations do not constitute solely automated decisions producing legal or similarly significant effects. Article 6(1)(b) or (f) applies according to the contact’s role. Project briefs should omit unnecessary personal information; any release of customer documents is task-specific.
Hosting, email and security
Website delivery processes IP address, requested URL, time, response status, data volume, browser and device details and, where provided, the referring page. Hosting and email infrastructure providers support delivery, troubleshooting and protection against abuse. Our legitimate interest under Article 6(1)(f) is a secure and available service. HTTPS protects transmission. Access to project records and files is account-restricted.
Backups contain copies of website and database data for recovery, not additional use. Technical logs and backups are retained according to their security and recovery purpose; specific incident evidence may be kept until the incident is resolved. For security we use Wordfence by Defiant, Inc., USA. Technical access and security data, including IP addresses and necessary request details from suspicious activity, may be transmitted to Defiant. The basis is Article 6(1)(f). See Defiant’s privacy notice and its GDPR and standard contractual clause information.
Cookies and privacy choices
The current website uses only functions necessary to deliver the site, provide the sign-in you request and protect access. Analytics and advertising tracking are not enabled. Privacy settings open an information panel; they do not grant blanket consent to future services or save an additional choice in your browser.
Strictly necessary storage or access for a digital service you expressly request relies on section 25(2) TDDDG. Subsequent personal-data processing relies on Article 6(1)(b) or (f) GDPR according to purpose. Any future optional cookies or similar device access require prior information and valid consent under section 25(1) TDDDG.
Sign-in cookies generally last for the session or up to 14 days when you select “Remember me”; security cookies may verify sign-in status. Signing out ends usable portal access. Technical logs and short-lived abuse limits are explained under retention. You may delete cookies in your browser, which may require signing in again.
The previous Cookiebot connection is no longer loaded in this release. Earlier consents do not activate analytics or advertising services. You can remove cookies from earlier visits through your browser settings.
Local media and external contacts
The website’s design fonts and explanatory video are served locally; they do not require Google Fonts, YouTube or an external video player. Language versions are separate pages. Selecting a language does not send your text to a translation service.
The WhatsApp contact is an external link. Merely displaying it does not connect to WhatsApp or record click statistics. Opening it takes you to the service of WhatsApp Ireland Limited, which processes information under its own rules and may involve associated companies outside the EEA. Read WhatsApp’s privacy notice. Email and website forms remain alternative contact channels. Do not send particularly sensitive project files via WhatsApp.
Google Analytics, Google Ads tracking and newsletter sign-ups are not integrated into the described forms in the current website release. New services require appropriate privacy information and, where necessary, separate consent. We do not sell contact details; registration is not a newsletter subscription.
Recipients, processors and international transfers
Information is available to responsible staff and necessary hosting, email, IT and security providers. Selected delivery partners receive only information required for their tasks. Advisers, authorities and courts receive information only for a relevant purpose and legal basis. Providers processing information on our instructions require appropriate Article 28 GDPR arrangements.
When a customer instructs us to process personal data on its behalf, the project’s processing agreement and access rules must be settled before access. Sub-processors are subject to the agreed authorisation and information requirements. The customer must still have its own lawful basis.
Security services and WhatsApp communication you choose may involve processing outside the EEA, particularly in the USA. Transfers require the safeguards of Articles 44 onwards GDPR, such as an applicable adequacy decision or standard contractual clauses with necessary supplementary measures. Contact info@esavest.de for information or a copy of the safeguards used for a particular transfer. Visiting the website does not amount to consent to an unlawful transfer.
Retention and deletion
Retention depends on purpose, contract duration, statutory record-keeping and the establishment or defence of legal claims. An account does not by itself justify keeping enquiries permanently. Completed enquiries without a resulting order and unused partner profiles require deletion review. Tell us if your project is no longer current or you wish to close an account.
Relevant contractual and accounting records remain subject to applicable commercial and tax retention periods; not every project file has the same period. Where deletion is not yet possible, processing is limited to the remaining purpose. Backups are overwritten in their backup cycle, and deleted information must not return to ordinary use after recovery.
Portal rate limits use a cryptographically derived IP identifier for one hour after the last relevant action. Temporary form notices expire after five minutes. The delivery overview retains at most 50 subject and status records. Successfully handed-off internal notifications no longer retain their message body in the outbox; failed notifications remain in the protected queue pending handling.
Your rights
Subject to legal requirements, you may request access (Article 15), rectification (16), erasure (17), restriction (18) and portability (20 GDPR). You may withdraw consent for the future. We normally respond within one month, subject to statutory exceptions. If there are reasonable doubts about identity, we may request necessary additional information, without collecting unnecessary identity data.
Right to object: You may object to processing under Article 6(1)(e) or (f) on grounds relating to your particular situation. Processing stops unless legally overriding grounds apply. You may object to direct marketing at any time without giving a reason; your data will then no longer be used for that purpose.
You may complain to a supervisory authority, particularly where you live, work or where an alleged infringement occurred. The authority for our registered office is Berliner Beauftragte für Datenschutz und Informationsfreiheit, Alt-Moabit 59–61, 10555 Berlin, Germany, mailbox@datenschutz-berlin.de, www.datenschutz-berlin.de.
Sources and updates
Most information comes directly from you. Your employer or project contact may provide business contact details and your project role. We use these for the relevant collaboration on the basis of our legitimate interests; any further Article 14 information is supplied in the particular contact. Changes to services and processing are reflected in this notice. Updating this page does not replace required fresh consent or automatically amend existing contracts.