Privacy Policy
Last updated: August 2026
This website is a pure information site — no user accounts and no advertising cookies. Reach measurement (Google Analytics) is used only with your consent; without consent no analytics cookies are set. The key notices under the GDPR follow below.
Controller
The controller under the GDPR is Leon Köllerwirth Hlihel, Paracelsusweg 5, 33689 Bielefeld, email: contact@leon-koellerwirth.com.
Hosting
The site is hosted by a webspace provider (Strato AG). When the site is accessed, technically necessary data is processed so the page can be delivered.
Server log files
For delivery and security, the provider automatically collects server log files (e.g. IP address, date/time, requested file, browser type). The legal basis is the legitimate interest in secure operation (Art. 6 (1) (f) GDPR). This data is not merged with other sources. In addition, I run my own cookieless first-party analytics: when you use interactive features (AI Opportunity Signal, contact form, booking) and — where you have consented — on page views, I record anonymised usage data on my own server (a truncated IP address with the final segment removed, the time, the feature/page accessed, the outcome status and the browser type). No cookies are set and no content of your inputs is stored. The legal basis is my legitimate interest in the secure operation and improvement of the website (Art. 6 (1) (f) GDPR), and for page-view collection your consent (Art. 6 (1) (a) GDPR).
Technically necessary storage (web app, preferences)
This website can be used as an installable web app (PWA). For this, your browser stores technically necessary data locally on your device: cached website files (service-worker cache, so the site loads fast and new versions are applied reliably) and your preferences for the colour scheme and cookie decision (localStorage). This storage is required to operate the website (§ 25 (2) no. 2 TDDDG); no personal data is transmitted to me or to third parties, and no tracking takes place. You can delete this data at any time via your browser settings. If you use the instrument at “/systemarchitecture” (Platform Decision Kit), your browser additionally stores what you enter there, plus its settings, locally (localStorage, keys starting “pdk.”), so your work survives a reload. That content is never transmitted to me or to any third party — the instrument makes no network requests. You can delete it via your browser settings. If you use the instruments at “/deployment-order” (AI deployment order) and “/delivery-delta” (Delivery delta report), your browser likewise stores what you enter there, and the state you last read in, locally (localStorage, keys “einsatzordnung.v1” and “lieferstand.letzterStand”), so your work survives a reload. That content is never transmitted to me or to any third party. You can delete it via your browser settings.
Getting in touch
If you reach me by email, phone or — where enabled — the contact form, I process your details solely to handle the request (Art. 6 (1) (b)/(f) GDPR). Your data is only shared insofar as that is necessary to respond.
Online appointment booking
Via the booking feature on this site you can schedule a consultation directly. Booking runs first-party through my own server — no third-party services are loaded in your browser and no third-party cookies are set. The details you provide (name, email address and an optional topic) and the slot you choose are processed solely to arrange and hold the call (Art. 6 (1) (b) GDPR — initiation/performance). To manage availability and the appointment I use Google Calendar (provider: Google Ireland Ltd., Gordon House, Barrow Street, Dublin 4, Ireland). When you book, your name, email address and topic are transmitted server-side to the Google Calendar API, a calendar entry with a video link (Google Meet) is created, and a calendar invite is sent to the email address you provided. Data may be transferred to Google LLC in the USA; Google is certified under the EU-US Data Privacy Framework. An optional confirmation email is sent via my provider's email service (Strato AG). You can cancel an appointment at any time via the calendar invite.
AI Opportunity Signal
Via AI Opportunity Signal on this site you can describe your business (free text), provide your website address, and/or upload a document to receive an initial signal on where autonomous AI could create business value. If you provide a website, it is fetched first-party, server-side, through my own server to understand your business (Art. 6 (1) (f) GDPR — legitimate interest in providing this advisory tool); no third-party services are loaded in your browser. To generate the assessment, your input (your description, the fetched website text, and/or the content of the uploaded document) is transmitted server-side to OpenAI and processed there (provider: OpenAI, L.L.C., 1960 Bryant Street, San Francisco, CA 94103, USA). This may involve a transfer to the USA. The processing serves solely to produce this first assessment; the input is cached briefly (a few minutes), not stored permanently, and not shared with any further third parties. Please do not enter especially sensitive or confidential content. If you then send the result to me by email, the section “Contacting me” applies.
Legal status record (register builder and check)
The register builder at /en/legal-status stores your selection of acts and the reasons you enter solely in your browser (localStorage). This is not transmitted to me and not stored; you can delete it at any time via “Discard draft” on the page itself, or through your browser's site data. This is deliberate: the list of acts a company considers applicable is itself information about the company. When you trigger “Check against the source now”, your browser sends only the CELEX identifiers of the selected acts (e.g. 32023R1230) to my server. Your reasons, the company name and all other input are not transmitted. My server uses them to query the public SPARQL endpoint of the Publications Office of the European Union, because your browser cannot do so directly for technical reasons. To limit abuse, a truncated hash of your IP address is kept as a counter for at most five minutes (Art. 6(1)(f) GDPR, legitimate interest in stable operation); the Office's answers are cached for 24 hours. The IP address itself is not stored for this service.
Decision Ledger records (server storage)
The instrument at “/embedded” (Embedded Decision Ledger) stores a record only when you press “Save record” — before that, nothing leaves your browser. On saving, the content of the record is stored on my server in Germany (Strato, server location Germany). You receive an access key that lives solely in the fragment part of the address, after the hash sign; only a hash of it (SHA-256) is kept on the server. Reading the database opens no record — and I do not see your records in any overview. What is stored is what you enter: question, options, evidence, commercial inputs, names of decision owners and approvers, rationales. The legal basis is my legitimate interest in providing this instrument (Art. 6 (1) (f) GDPR); your click on “Save record” decides whether anything is stored at all. Please do not enter personal data of third parties or confidential content — role names are enough. A record deletes itself 90 days after its last change; with “Delete record” immediately. If you lose the link, the record can no longer be reached and expires when the period ends. Export it as JSON or Markdown if you want to keep it.
Reach measurement (Google Analytics)
On the basis of your consent (Art. 6 (1) (a) GDPR, § 25 (1) TDDDG) I use Google Analytics 4 for anonymous reach measurement — provider: Google Ireland Ltd., Gordon House, Barrow Street, Dublin 4, Ireland. Google Analytics is loaded, and cookies or comparable identifiers are stored on your device, only once you agree in the cookie banner; without your consent this does not happen. Processed data includes a shortened IP address, approximate location (country/region), pages viewed, time on page, and device and browser type. Data may be transferred to Google LLC in the USA; Google is certified under the EU-US Data Privacy Framework (adequacy decision of the EU Commission). You can withdraw or change your consent at any time with effect for the future via the “Cookie settings” link in the footer. After withdrawal, no further analytics cookies are set. Fonts are served locally only (no external font CDN). Measurement ID: G-HHBF6DC9XE.
Your rights
You have the right to access, rectification, erasure, restriction of processing, data portability and objection, as well as the right to lodge a complaint with a supervisory authority.