Privacy Policy
1. Controller
MFQ Consulting UG (haftungsbeschränkt)
Königsallee 19
40212 Düsseldorf, Germany
Email: contact@mfqconsulting.com
2. Hosting and server log files
This website is hosted by Akamai Technologies International AG, Grafenauweg 8, 6300 Zug, Switzerland (Akamai Cloud, formerly Linode). The server that runs it is located in Frankfurt, Germany. Akamai processes the data on this server on our behalf, as our processor (Art. 28 GDPR). For Switzerland, where Akamai's contracting company is based, the European Commission has adopted an adequacy decision (Art. 45 GDPR).
Each time a page or file of this website is requested, our web server records an access entry with your IP address, the time of the request, the host name, the request method and the requested path, the response status, the processing time and an internal route identifier. Apart from the host name, no request headers are recorded (in particular no cookie or authorization headers), and no query parameters (the part of the web address after a question mark). The entry therefore contains no cookies, no login data sent in headers, no referring page and no browser information (user agent).
This data is used only to deliver the website and keep it secure. Your browser has to transmit your IP address for the website to be delivered at all. The legal basis is Art. 6(1)(f) GDPR; our legitimate interest is the reliable and secure operation of the website.
These access logs are readable only by the server's administrators. In normal operation, these access entries are deleted automatically after no more than seven days.
Our server also keeps technical operating logs: start-up and error messages from the website software and from the server's proxy and administration software, as well as the server's system, security and firewall logs. We use them to detect, investigate and fix faults and attacks. They are not used to record page views, but in individual cases they can contain personal data, for example an IP address or a requested web address in an error message. The legal basis is Art. 6(1)(f) GDPR; our legitimate interest is the secure and fault-free operation of the server.
These operating logs have no fixed deletion period. The software logs are overwritten on a rolling basis once a set size is reached (three files of up to 10 MB each) and are otherwise deleted only when the software container concerned is removed; a stopped or replaced container keeps its logs until then. The system, security and firewall logs are rotated weekly, and only the four most recent archives are kept. The server's system journal is deleted on a rolling basis once a size limit is reached; no maximum age is set for it.
3. Akamai's logs and transfers outside the EU
Independently of our server, Akamai logs access to its servers and its cloud environment; according to Akamai, these logs contain, for example, IP addresses and times of access. Akamai processes them partly on our behalf, as our processor, to provide and support the hosting service. The legal basis is Art. 6(1)(f) GDPR; our legitimate interest is the reliable and secure hosting of this website. According to Akamai, it keeps these logs under its data retention policies for as long as necessary for security purposes.
Akamai also uses such logs for its own purposes, for example to apply security rules and block attacks, to improve its knowledge of threats, and for billing and capacity planning. For this, Akamai itself is responsible as a controller; details are given in Akamai's privacy statement (akamai.com/legal/privacy-statement). According to Akamai, it keeps these logs for up to 90 days in most cases and for up to 180 days where specific security events require it, and it keeps aggregated data for traffic analysis and forensics for up to three years.
According to Akamai, these logs are processed on Akamai systems in the USA, and Akamai support teams in other countries, including outside the EU or EEA (for example in the USA and India), can access them to resolve service issues. Akamai states that it safeguards such transfers with the EU Standard Contractual Clauses (Art. 46(2)(c) GDPR) and that it participates in the EU–US Data Privacy Framework, for which the European Commission has adopted an adequacy decision (Art. 45 GDPR). Akamai publishes details and the clauses it offers customers in its Privacy Trust Center (trust.akamai.com).
4. Contacting us
If you contact us by email or via LinkedIn, we process the information you provide, usually your name, email address, company and the content of your message, in order to answer your enquiry and, where applicable, to prepare or carry out an assignment. Providing this information is voluntary, but without it we cannot answer your enquiry.
If your enquiry concerns a contract to which you yourself are or would become a party, for example if you are self-employed, the legal basis is Art. 6(1)(b) GDPR. If you contact us on behalf of a company or another organisation, or about other matters, the legal basis is Art. 6(1)(f) GDPR; our legitimate interest is answering enquiries addressed to us and initiating and maintaining business relationships.
Emails to us are received and stored in our Microsoft 365 mailbox. Microsoft processes them on our behalf, as our processor (Art. 28 GDPR). Microsoft may also process data outside the EU or EEA, in particular in the USA. Under Microsoft's Data Protection Addendum, such transfers are subject to the EU Standard Contractual Clauses (Art. 46(2)(c) GDPR); Microsoft also states that it is certified under the EU–US Data Privacy Framework (Art. 45 GDPR). Microsoft publishes its Data Protection Addendum, which refers to these clauses, in its licensing documentation (microsoft.com/licensing/docs).
If you write to us on LinkedIn, LinkedIn's privacy policy also applies to your message.
We review enquiries manually on the first working day of each month. We delete an enquiry once it has been closed and is no longer needed, and at the latest three months after it was closed. We keep a message for longer only where a documented business, tax or legal retention requirement applies, and only for the applicable period, for example while we need the correspondence to carry out an assignment, or for business letters, which commercial law requires us to keep for six years (Section 257 of the German Commercial Code, HGB). The legal basis for retention required by law is Art. 6(1)(c) GDPR.
Separately, Microsoft 365 keeps emails that we have deleted in a recovery area of the mailbox for a period before they are permanently removed. How long depends on the mailbox settings and on any retention settings or holds that apply.
5. Cookies, tracking and fonts
This website sets no cookies and uses no analytics or tracking tools. Fonts are served from our own server, so no data is sent to third-party font providers.
6. Your rights
You have the right to access, rectification, erasure, restriction of processing and data portability (Art. 15–20 GDPR). You can also lodge a complaint with a data protection supervisory authority (Art. 77 GDPR).
7. Right to object
Where we process your data on the basis of Art. 6(1)(f) GDPR, you have the right to object to this processing at any time on grounds relating to your particular situation (Art. 21(1) GDPR). We will then no longer process the data unless we can demonstrate compelling legitimate grounds for the processing that override your interests, rights and freedoms, or the processing serves the establishment, exercise or defence of legal claims. You can send your objection to the contact details in section 1.
8. Last updated
October 2026