This is a convenience translation. The German version is the legally binding text.
1. Controller
Erich Kirsten
Lindenstraße 32 C, 12555 Berlin-Bezirk Treptow-Köpenick
E-Mail: at.vorlauf@hotmail.com
2. What data we process
When you request a regional report we process the business email address you enter, the target region, the optional company name, a random report ID, and the time and scope of the request. If the request arrives through a labelled advertisement, we store the general campaign values of that campaign only once the form is actually submitted, and only if they are one of the pairs we publish here: google_ads with vorlauf_search_de, or meta_ads with vorlauf_meta_de. Any other value is discarded. Passive page views, click identifiers from Google or Meta, and advertising cookies are not stored, and we embed no advertising pixel. Giving a phone number is voluntary and is used only to reach you about a request you started yourself. A voluntary opt-in for email follow-ups is logged with its text version and timestamp. When a requested report is opened we log only the random report ID and the time of the visit, so we can tell whether requested reports are read at all; no IP address, browser identifier or recognition marker is stored. If you choose a service type with your request, we store the corresponding official CPV code in order to sort the signals by it. For password-free sign-in we store a one-time sign-in link (valid 15 minutes) and a session identifier (valid 30 days), both only as hashes, together with the browser and system family at the time of the request. No location is derived from your IP address. To prevent abuse, a transient hash is derived from the requesting IP address; it is removed from memory after at most one hour and is not written to the application database. The hosting provider may process technical connection data in its access logs.
3. Purposes and legal bases
The mandatory fields are used to build the sample report you requested, to link a booking you start to that report, and to deliver the booked service. The legal basis is Art. 6(1)(b) GDPR (pre-contractual measures and performance of a contract). Only if the optional box was actively ticked may we additionally send regional signals and product information by email; the legal basis for that is consent under Art. 6(1)(a) GDPR. Short-term abuse prevention and secure operation rest on Art. 6(1)(f) GDPR; the legitimate interest is protecting the service against automated abuse.
4. Recipients
Render is used as the hosting provider. Where configured, the link to the requested report is delivered to the address you gave through the email service provider Resend. If you start a payment yourself, the data required for that payment is transmitted to Stripe. Official procurement data comes from TED; Vorlauf transmits no form data there. Without the optional opt-in, no marketing email follow-up takes place.
5. Retention
Requests, expressions of interest, report-open timestamps and associated reports that do not convert into paid access are deleted automatically after 90 days. Paying customers' data is stored for the performance of the contract and afterwards only for as long as statutory retention or evidence obligations require. The IP-based rate limit expires after at most one hour. Expired sign-in links and session identifiers are deleted automatically.
6. Necessity
The email address and the region are required to build and assign the regional report. Without them the requested report cannot be provided. The company name is voluntary. No solely automated decision with legal or similarly significant effect takes place.
7. Your rights
Within the statutory conditions, data subjects have the rights to access, rectification, erasure, restriction of processing, data portability and objection. Consent given for email may be withdrawn at any time with effect for the future, without affecting the lawfulness of processing carried out beforehand. There is also a right to lodge a complaint with a data protection supervisory authority. Requests and withdrawals can be sent to at.vorlauf@hotmail.com. Signed-in users can switch the consent for regional updates on and off themselves under “My reports”, and can permanently delete their account there together with all regions, saved contracts and sessions.
8. Cookies and audience measurement
Vorlauf uses no advertising, analytics or tracking cookies and no Google conversion tag. The general advertising source and campaign name are stored only when a regional report request is actually submitted. When the Stripe payment flow is opened, Stripe's own privacy information applies in addition.
9. Advertising and email follow-ups
Vorlauf may appear as an advertisement in search engines. Submitting the report form is independent of that and initially starts only the requested report delivery. Marketing email follow-ups are sent exclusively where the optional consent in the form was actively selected. Email addresses obtained from public sources are never used for unsolicited marketing email.
Status: August 2026