Privacy Policy

Controller (Art. 4 GDPR)

• Name:xxx
• Address:xxx
• Email:xxx
• Phone:xxx
• Data protection officer (if appointed):xxx (Name, Anschrift, E-Mail)

General information and mandatory details

Protecting your personal data is important to us. We process your data solely in accordance with statutory provisions (GDPR, German BDSG) and to the extent necessary for the provision of our services. Personal data means any information relating to an identified or identifiable natural person.

Hosting

This website and its associated backend are hosted by an external service provider (e.g. Lovable / Supabase). When you access the website, server data (e.g. IP address, time of access, browser type, referrer URL) is therefore processed within the hosting infrastructure. Please refer to the documentation of the respective provider for further details (xxx).

Data collection on this website

Contact form / contact by email

If you contact us via the contact form or by email, the information you provide (e.g. name, email address, company, phone number, project description) will be stored for the purpose of processing your enquiry and subsequent communication.

Legal basis: Processing is carried out for the performance of pre-contractual measures or for the fulfilment of a contract (Art. 6 para. 1 lit. b GDPR), where applicable. For any further processing that is not required for the contract (e.g. newsletters, marketing), the legal basis is your consent (Art. 6 para. 1 lit. a GDPR) or our legitimate interest in responding to your enquiry (Art. 6 para. 1 lit. f GDPR).

Retention period: Your data will be stored for as long as necessary to process your enquiry, but for a maximum of 6 months if no contractual relationship is established. For client engagements, statutory retention periods apply.

Processors and services used

Email delivery (Brevo): To deliver the information submitted via the project enquiry form we use the service Brevo (Brevo GmbH, Köpenicker Str. 126, 10179 Berlin, Germany). Brevo processes the data provided in the form (including name, email address, company, phone number, project description) solely on our behalf and in accordance with our instructions. Messages are delivered to contact@rivalerra-consulting.com; sender and recipient are the same company address, and your email address is only set as the reply-to address. The legal basis is Art. 6 para. 1 lit. b or lit. f GDPR; a data processing agreement pursuant to Art. 28 GDPR is in place with the provider. Provider privacy policy: https://www.brevo.com/legal/privacypolicy/

Storage of enquiries (database): The form data is additionally stored in a database of our hosting backend so that no enquiry is lost if email delivery fails. Storage and access are technically secured and limited to authorised persons.

Hosting: The website and backend, including the database mentioned above, are operated by the provider named in the “Hosting” section (xxx).

Client portal

A password-protected area is available for registered clients and customers. To use the portal, an account is created with an email address and password. Within the protected area, project data, status information and provided documents (e.g. analyses, reports, presentations) can be viewed and downloaded.

Legal basis: The processing of data in the client portal is carried out for the performance of the advisory or service contract (Art. 6 para. 1 lit. b GDPR). Access to project data and documents is strictly limited to the respective user and secured by technical access controls and row-level policies.

Retention period: The data is stored for the duration of the contractual relationship and beyond for the legally required retention periods. After the contract ends, data is deleted once statutory retention obligations no longer apply.

Rights of the data subject

You have the right to obtain free information about the personal data stored by us at any time. In addition, you are entitled to the following rights under the GDPR:

• Right of access (Art. 15 GDPR)
• Right to rectification (Art. 16 GDPR)
• Right to erasure / ‘right to be forgotten’ (Art. 17 GDPR)
• Right to restriction of processing (Art. 18 GDPR)
• Right to data portability (Art. 20 GDPR)
• Right to object (Art. 21 GDPR)
• Withdrawal of consent (Art. 7 para. 3 GDPR)
• Right to lodge a complaint with the competent supervisory authority (Art. 77 GDPR), e.g. [supervisory authority name, address, xxx]

SSL/TLS encryption

This website and the client portal use SSL/TLS encryption to protect transmitted data and prevent unauthorised access by third parties. You can recognise an encrypted connection by the fact that the browser address bar changes from ‘http://’ to ‘https://’ and by the padlock icon.

Retention period

We process and store personal data only for as long as necessary for the purpose in question or as required by statutory retention obligations. Once the data is no longer required for the purposes pursued and statutory retention obligations no longer apply, the data is deleted or anonymised.

Currency and changes to this privacy policy

This privacy policy is currently valid as of xxx. Changes may arise due to technical or legal developments. We recommend visiting this page regularly to stay informed of the current status.