Transparency about your data
Privacy notice
Last updated: October 25, 2026
1. Controller and contact details
The controller responsible for the processing of personal data by CTF-Thermografie is:
Christian Thomas Fleischhacker
CTF-Thermografie
Am Eichelein 10
97230 Estenfeld
Email: info@ctf-thermografie.de
Telephone: +49 176 85971122
Please use these contact details for questions about data protection and to exercise your rights.
2. Website operation and hosting
This website is provided through Codex Sites by OpenAI. It runs on Cloudflare Workers, infrastructure provided by Cloudflare, Inc. (USA). When you visit the website, data required for transmission and operation is processed, particularly your IP address, the requested URL, the time of access, and connection information sent by your browser. The platform and hosting infrastructure also process technical operational and security data. The CTF website’s application code does not create its own access logs.
The hosting infrastructure uses Cloudflare security features to protect against malicious automated access. These include browser checking scripts and the “__cf_bm” cookie. It contains encrypted information used to detect automated access and, according to Cloudflare, expires after 30 minutes of continuous inactivity; it may be renewed with continued use. Details are given in Cloudflare’s cookie documentation. These protection features are provided by the hosting platform and are separate from the form confirmation cookie described below.
Depending on the security check, Cloudflare may also set the technically necessary “cf_clearance” cookie. It stores the result of a browser check or records its successful completion. Cloudflare explains its purpose and operation in the JavaScript detections documentation and the cookie documentation linked above.
Information necessary for secure provision is stored and accessed under Section 25(2), no. 2 TDDDG. Where personal data is processed, the basis is Article 6(1)(f) GDPR and our interest in protecting the website against abusive access.
Our processing to provide and secure the website is based on Article 6(1)(f) GDPR. Our legitimate interest is to provide information through an accessible and secure website. The website can be used without an account or sign-in. For use of the OpenAI platform in the European Economic Area, OpenAI identifies OpenAI Ireland Limited as the responsible entity.
The providers also describe processing outside the European Economic Area, particularly in the USA. OpenAI refers to adequacy decisions and Standard Contractual Clauses for these transfers. Cloudflare refers to the EU–US Data Privacy Framework for transfers to the USA and Standard Contractual Clauses in other cases. Details of the respective processing, retention periods and transfer safeguards are available in OpenAI’s European privacy policy and Cloudflare’s privacy policy. These provider notices also contain contact details for inquiries about the safeguards.
3. Content and integrated features
Images and fonts are delivered with this website’s files. No external media or font providers are integrated for this purpose. Google Ads is integrated for advertising measurement only after you have given your consent; details are set out under “Optional advertising measurement”. Google Analytics, personalized advertising and external CAPTCHA services are not configured in the application code. File uploads are not offered. CTF does not make decisions on this website based solely on automated processing that produce legal or similarly significant effects.
4. Contact and storage of inquiries
If you contact us by email or telephone or through the contact form, we process your contact details and the information you provide to handle your inquiry. Where the inquiry concerns a contract with you or steps before entering into a contract, the basis is Article 6(1)(b) GDPR. We handle other inquiries, including communication with business contacts, under Article 6(1)(f) GDPR on the basis of our interest in business communication.
When you use the contact form, we process your name, email address and message. Details of your company, telephone number, installation type, site location and preferred dates are optional. We need the required information to identify and answer your inquiry; the form cannot be submitted without it. There is no legal obligation to use the form.
Your inquiry is sent to info@ctf-thermografie.de through Resend, a service provided by Plus Five Five, Inc. (USA). The delivery service receives the form contents and the information needed to send and deliver the message. We then handle the inquiry in our email inbox. The application code does not log form contents or store the message in the website database. The delivery service and receiving email service process the message to transmit and deliver it.
Resend describes its principal processing operations as taking place in the USA and provides for EU Standard Contractual Clauses for transfers not covered by an applicable adequacy decision. Details of recipients, storage and transfers are available in Resend’s privacy policy and its Data Processing Addendum.
Contacting us is voluntary. Without sufficient contact details and information about your inquiry, we may be unable to respond. For email and telephone contact, the respective email and telecommunications services are involved in transmission.
Our email inbox is operated through Google Workspace. Google processes message contents, sender and recipient details and technical delivery information. Processing may also take place outside the European Economic Area. Google describes its processing of Workspace customer data and the rules for international transfers, including the applicable Standard Contractual Clauses, in the Cloud Data Processing Addendum.
How long correspondence is retained depends on handling the inquiry and any necessary follow-up questions. Once that purpose no longer applies, data is deleted unless statutory retention obligations or necessary evidence for legal claims prevent this. Technical protection records are separate from correspondence in the email inbox.
5. Contact form protection
The website uses the Cloudflare D1 database to protect against abuse and repeated submissions. To limit frequent inquiries, a cryptographically protected verification value is derived from the connection’s IP address. This value, counters and expiry information are stored for a 15-minute time window. The IP address is not stored in plain text in this database.
To detect duplicate submissions, we also store a random request identifier, a protected verification value derived from the form contents, the processing status and technical timestamps. These records are used for no more than 24 hours after the request identifier is issued. Names, email addresses and message contents are not stored in plain text in these protection records.
Expired records are removed from the active tables on the next submission attempt. If there is no further use, they may remain stored until this clean-up occurs. Cloudflare D1 also retains recovery points that may contain earlier records; the D1 documentation describes a period of up to 30 days for these. The protection windows concern the active use of the data; clean-up and backup copies follow the separate processes described here.
The legal basis is Article 6(1)(f) GDPR. Our legitimate interest is to keep the contact channel available and prevent unintentional duplicate submissions.
6. Delivery confirmation cookie
The website sets the “ctf_contact_receipt” cookie only after the delivery service has accepted the inquiry. It enables the appropriate confirmation page and contains only a cryptographically protected request identifier, an expiry time and a signature. It does not store form contents. The cookie is valid for a maximum of five minutes and is restricted to the relevant confirmation page path (“/anfrage-status” or “/en/request-status”). It is required for delivery confirmation independently of optional advertising measurement. Only with your separate consent is the confirmed inquiry also measured as an advertising conversion, as described below.
This information is stored and accessed for the requested submission and its associated confirmation under Section 25(2), no. 2 of the German Telecommunications Digital Services Data Protection Act (TDDDG). Where personal data is processed, we rely on Article 6(1)(f) GDPR and our interest in reliable delivery confirmation.
7. Optional advertising measurement with Google Ads
We load the Google tag for Google Ads only if you choose “Accept all cookies”. The provider in the European Economic Area is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. We want to understand whether our advertisements lead to actual form inquiries. Without your consent, this tag is not loaded; our integration does not then send so-called cookieless measurement signals to Google either. The website and contact options remain fully usable without consent.
When measurement is enabled, data sent to Google may include your IP address, technical browser and device information, pages visited, referral source, time, and advertising click and cookie identifiers. Only after our delivery service has confirmed acceptance of a form inquiry do we send a conversion event containing a protected request identifier, not derived from your contact details, to prevent duplicate counting. Our measurement does not transmit your name, email address, telephone number or form message contents to Google Ads. Enhanced conversions and personalized advertising are not enabled.
Google may use cookies from the “_gcl_” family in particular to attribute advertising clicks. Google generally specifies a retention period of 90 days for these. We store your decision locally in your browser under “ctf_ads_consent_v1”, together with a timestamp and text version, for a maximum of 180 days; after that, we ask again. Request identifiers already submitted for measurement are held in session storage to prevent repeated transmission. These stores contain no form contents.
The legal bases for optional measurement are your consent under Article 6(1)(a) GDPR and, for storing and accessing information on your device, Section 25(1) TDDDG. Storing your privacy choice allows us to respect that choice (Section 25(2), no. 2 TDDDG; Article 6(1)(f) GDPR). You can change your decision at any time through “Privacy settings” in the website footer and withdraw consent for the future by choosing “Essential cookies only”. We then stop loading the measurement tools and delete the advertising cookies accessible to this website. Withdrawing your consent does not affect the lawfulness of processing carried out before withdrawal; you can manage cookies on other Google domains through your browser or Google settings.
Google may also process data outside the European Economic Area, particularly in the USA. Google describes safeguards including adequacy decisions and Standard Contractual Clauses. Information on purposes, recipients, retention periods, transfer safeguards and your settings is available in Google’s privacy policy, its information on data use on partner websites and its cookie information.
8. Your rights
Subject to the legal requirements, you may request access to your data, rectification, erasure and restriction of processing. Where automated processing is based on a contract or consent, you also have the right to data portability (Articles 15 to 20 GDPR). Please use the contact details above to exercise these rights.
9. Right to object
You may object at any time, on grounds relating to your particular situation, to processing based on Article 6(1)(f) GDPR. We will stop the processing concerned unless we can demonstrate compelling legitimate grounds that override your interests, rights and freedoms, or unless the processing is needed to establish, exercise or defend legal claims (Article 21 GDPR). You can submit your objection using the contact details above.
10. Right to lodge a complaint
Under Article 77 GDPR, you may lodge a complaint with a data protection supervisory authority, particularly in the place where you live or work or where the suspected infringement occurred. For private businesses in Bavaria, the relevant authority is in particular the Bavarian State Office for Data Protection Supervision (BayLDA):
Bayerisches Landesamt für Datenschutzaufsicht
Postfach 1349, 91504 Ansbach, Germany
Visitor address: Promenade 18, 91522 Ansbach, Germany
Telephone: +49 981 180093-0
Contact BayLDA · Online complaint