Stefan Riemeyer Google Ads Freelancer
DE EN
Back to home

Privacy Policy

Last updated: 3 November 2026

1. Data Controller

Stefan Riemeyer

Kaiserin-Augusta-Allee 88

10589 Berlin, Germany

Email: stefan@stefanriemeyer.com

2. Server Log Files

When you visit this website, the hosting provider automatically records the following data in server log files:

  • IP address
  • Date and time of the request
  • Requested page / URL
  • Browser and operating system used (user agent)
  • Referrer URL

I collect this data to ensure the technical operation and security of the website. It is not combined with other data sources. From the server log files I also build daily totals to see how often pages are requested: per day, domain, page, referring domain, UTM parameters, status code and browser and device class. IP addresses are not included. I delete the totals after 14 months. Nothing is stored on or read from your device for this, no script runs, and I do not recognise anyone. This also applies if you reject in the consent banner. The legal basis is Art. 6(1)(f) GDPR; my legitimate interest is counting reach without touching your device. You may object. Because the totals contain no identifier, I cannot exclude individual requests and will review whether to stop the evaluation. The legal basis is Art. 6(1)(f) GDPR (legitimate interest in the security and technical operation of the website). The hosting provider is Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany, processing exclusively within Germany. Server log files are automatically deleted after 14 days.

3. Contact form and email contact

When you contact me via email, your details (name, email address, message content) are processed to handle your inquiry. The legal basis is Art. 6(1)(b) GDPR (pre-contractual measures) or Art. 6(1)(f) GDPR (legitimate interest in responding to inquiries). Data from email inquiries is deleted after the inquiry has been processed, unless statutory retention obligations apply.

If you submit a request via the contact or audit form on this website, I process the data you provide (name, email address and company or shop URL) solely to handle your request. I also store the IP address of the request to prevent abuse of the form. The data is transmitted to my own server (hosted by Hetzner Online GmbH, Germany). I also receive a notification with these details by email via Google (see below). The legal basis is Art. 6(1)(b) GDPR as well as Art. 6(1)(f) GDPR (interest in responding to inquiries). I delete the data as soon as it is no longer required for processing and no statutory retention obligations apply, and the IP address after 30 days. Providing the data is voluntary. Without a name and email address I cannot handle your request.

My email inbox runs on Gmail, a service of Google (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland). Emails and notifications are processed there, and a transfer to the USA is possible. Google LLC is certified under the EU-U.S. Data Privacy Framework; the transfer relies on the European Commission's adequacy decision (Art. 45 GDPR).

To book an intro call I link to Cal.com (Cal.com, Inc., USA). If you follow that link, the provider's privacy notice applies and Cal.com processes your booking details.

4. Cookies and consent

Analytics services that use your browser run on this website only if you agree in the consent banner. Before you decide they are not loaded, and nothing is read apart from your stored consent status, which does not leave your device. You can choose own statistics, Google Analytics and session recording individually, reject everything, and change or withdraw your decision at any time via Cookie settings, also linked in the footer. Your decision applies per domain (.de, .ch, .com), so withdrawal is needed on each domain you used. Withdrawal takes effect from then on and does not affect the lawfulness of processing up to that point. The website remains fully usable without consent.

I store your decision in your browser's local storage (sr-consent, no user identifier). After 6 months I no longer rely on it, delete it on your next visit and ask again. Under Section 25(2) no. 2 TDDDG this is strictly necessary to respect your choice. The legal basis for the analytics services is your consent under Section 25(1) TDDDG and Art. 6(1)(a) GDPR. Consent is voluntary and refusing it has no disadvantages.

5. Analytics services after consent

Own statistics: To understand where visitors come from and which content is used, I record on my server at Hetzner Online GmbH in Germany: pages viewed and domain, time, time on page, scroll depth, referring domain, UTM parameters, window width, language, browser, operating system and device type as a coarse class, country of origin, as well as clicks on email, phone, booking, LinkedIn and source links, clicks on marked buttons and links with their label, video interactions and form submission without its contents. For counting, I derive a shortened hash from IP address, browser signature and domain using a random daily key. The key is held in memory only and changes every day, so visits on different days cannot be linked. My statistics do not store the IP address. For server log files see Section 2. I delete entries after 14 months. After withdrawal I record nothing further. I cannot attribute existing entries to you and therefore cannot delete them individually.

If you chose own statistics or Google Analytics, I keep in local storage, across several visits, your first entry channel, UTM source and landing page (sr-first) until you withdraw both or I delete it on your next visit after the 6 months have passed. If you agreed to Google Analytics, I also send channel and landing page there. In my statistics the channel also appears on the "form submitted" event, not with your contact details. For own devices, ?tracking=off can store an exclusion from measurement (sr-no-track).

Until 1 November 2026 this measurement ran without prior consent. I have deleted the individual entries from that time from the statistics; they remain in backups for up to 6 months and are deleted after that. Only totals per day and page with no identifier remain in the statistics. They were not shared with third parties.

Google Analytics 4: The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Google processes the data for me as a processor. It records page views with URL, source, interactions and device information so I can understand where visitors come from and which content is used. Google uses your IP address to provide the service and for approximate location and, by its own account, does not store it. Google sets the cookies _ga and _ga_* (6 months from your last visit). User and event data is deleted after 14 months. Google Signals, ad personalisation and data sharing with Google for its own purposes are disabled. Google LLC is certified under the EU-U.S. Data Privacy Framework. Transfers to the USA are possible and rely on the European Commission's adequacy decision (Art. 45 GDPR). Google privacy policy, How Google uses data from sites that use its services.

Microsoft Clarity (session recording): The provider is Microsoft Ireland Operations Limited, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, Ireland. Under the Clarity terms of use, Microsoft and I are independent controllers; I am responsible for embedding it on this website. Clarity records your visit so I can improve usability: displayed page content and structure, clicks, mouse movements, scrolling, input events without their content, window size, errors and load times. Contents of form fields and dropdowns are masked and not uploaded. A user identifier links page views. Microsoft sets the cookies _clck (1 year) and _clsk (1 day) on this domain and the entry _cltk in session storage. Microsoft also lists the third-party cookies CLID, MUID, MR, SM and ANONCHK, which may sit under Microsoft domains and which I cannot delete myself.

Microsoft collects or receives personal data from you to provide Microsoft Advertising and, under the Clarity terms of use, may use it for any purpose in accordance with its privacy statement, including improving its products and creating user profiles, also for advertising. Your consent to session recording covers this use. In addition, I set the Clarity signal for storage for advertising purposes to "denied". According to Microsoft's documentation, Clarity then shares no data with Microsoft Ads. I cannot verify whether this limits Microsoft's use under the terms. Your consent therefore also applies in case this use takes place. On withdrawal I end the recording in your browser and delete the Clarity cookies on this domain. No separate notice is sent to Microsoft. According to Microsoft, recordings are kept for 30 days, individually marked or randomly sampled ones and heatmaps for up to 9 months. I cannot delete individual persons there, only the whole project. Data is stored in the Microsoft Azure cloud. Transfers to the USA and other countries where Microsoft operates are possible. Microsoft Corporation is certified under the EU-U.S. Data Privacy Framework (adequacy decision, Art. 45 GDPR); according to Microsoft, standard contractual clauses also apply between Microsoft Ireland and Microsoft Corporation. For other countries I rely on the information in Microsoft's privacy statement and cannot name them individually. Microsoft privacy statement.

6. Processing of Google Ads Data within Client Engagements

In the course of consulting and management engagements, Stefan Riemeyer is granted access to clients' Google Ads accounts and processes that data exclusively to perform the agreed services, confidentially and in compliance with the Google Ads API Terms of Service and the Google API Services User Data Policy.

7. Contacting companies for marketing purposes (direct marketing)

I approach companies for which my services are professionally relevant: by letter to the business address, via professional networks and by email. I send emails only to business addresses of companies. I do so in countries whose law permits business marketing emails without prior consent, such as Switzerland, or to addresses a company has itself published for a specific matter, such as in a job advertisement, where my message concerns exactly that matter. Every email names me as the sender and can be unsubscribed from with a short reply.

Categories of data: company name, business address, name and role of the authorised representative or responsible person, business email address and other business contact details, and publicly visible company attributes (such as industry, shop system, approximate size, publicly visible advertising and tracking settings of the website).

Source of the data (Art. 14(2)(f) GDPR): the data does not come from you but from publicly accessible sources, in particular imprint details and public pages of the company website, job advertisements, the commercial register and open datasets derived from it, public industry and shop directories, the Google Ads Transparency Center, and public profiles on professional networks. I partly add business email addresses using a service for enriching business contact data.

Service providers: I use La Growth Machine (LGM SAS, France) to send emails and manage contacts, and onlinebrief24.de to send letters. Both process the data on my behalf (Art. 28 GDPR).

Purpose and legal basis: initiating a business relationship in a B2B context. The legal basis is Art. 6(1)(f) GDPR; the legitimate interest is direct marketing towards businesses (Recital 47 GDPR). Only companies are contacted, never consumers.

Retention: the data is deleted once the marketing purpose no longer applies. If you object, your address and contact details are added to a suppression list and retained solely for that purpose, so that you are not contacted again.

Objection: you may object to processing for marketing purposes at any time, informally and at no cost, by email to stefan@stefanriemeyer.com. No further marketing contact will follow.

8. Disclosure to Third Parties

Beyond the recipients named in this policy, personal data is not disclosed to third parties unless this is necessary for the performance of a contract or there is a legal obligation to do so.

9. Your Rights

You have the following rights regarding your personal data:

  • Right of access (Art. 15 GDPR)
  • Right to rectification (Art. 16 GDPR)
  • Right to erasure (Art. 17 GDPR)
  • Right to restriction of processing (Art. 18 GDPR)
  • Right to data portability (Art. 20 GDPR)
  • Right to object (Art. 21 GDPR)
  • Right to withdraw consent with effect for the future (Art. 7(3) GDPR), directly via Cookie settings
  • Right to lodge a complaint with a supervisory authority (Art. 77 GDPR)

Right to object (Art. 21 GDPR), specific notice: Where data is processed on the basis of Art. 6(1)(f) GDPR (legitimate interests), in particular server log files and email communication, you have the right to object to that processing at any time. Please address your objection to stefan@stefanriemeyer.com.

To exercise your rights, please contact: stefan@stefanriemeyer.com.

Competent supervisory authority: Berlin Commissioner for Data Protection and Freedom of Information, Alt-Moabit 59-61, 10555 Berlin, Germany.

I do not carry out automated decision-making including profiling within the meaning of Art. 22 GDPR. Providing your data is not required by law or contract unless stated otherwise in this policy.

For visitors from Switzerland, the Swiss Federal Act on Data Protection (FADP) also applies. Personal data may be disclosed to the recipients named above in Germany, Ireland and the USA and, for Microsoft, in other countries. For the USA I rely on the Swiss-U.S. Data Privacy Framework and the determination of the Federal Council (Art. 16(1) FADP). You may also contact the Federal Data Protection and Information Commissioner (FDPIC).