← Back to homepage

Privacy Notice

This page is an English mirror of our privacy information. The legally binding version is the German policy at /datenschutz.html. Last updated: July 2026 (version 2026-07-2).

1. Controller

dcorr GmbH
represented by Managing Director Lukas Widmann
Neue Kirchstr. 30
79282 Ballrechten-Dottingen, Germany
VAT ID: DE350383828
Commercial Register: HRB 725425
Register Court: Amtsgericht Freiburg
Email: info@dcorr.de

2. Hosting and server log files

This website is hosted by Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany. The server location is in the EU (Falkenstein/FSN1 data centre).

When you visit the site, the hosting provider processes technically necessary information (e.g. IP address, date and time of access, browser type) to deliver the website securely. Legal basis: Art. 6(1)(f) GDPR (legitimate interest in reliable operation).

Further details: Hetzner privacy policy.

3. Consent, local storage, and optional technologies

We do not set analytics or marketing cookies without your consent. By default, only necessary features and a cookieless anonymous reach measurement are active (section 3.1). Analytics and marketing can be enabled separately.

3.1 Necessary anonymous reach measurement (no cookies)

To see whether the website is reached and whether campaigns (especially LinkedIn ads with UTM parameters such as utm_source=linkedin) arrive on the site, we process a strictly reduced anonymous event measurement on our EU server. We set no cookies, use no local/session storage IDs for tracking, build no visitor profiles, and do not store IP addresses in the tracking records.

We only process: event type (reach_page; and for explicitly marked CTAs also reach_click), page path, for CTA clicks a technical CTA id (data-reach) plus a coarse target (internal path or external domain, without link text), and UTM parameters from the current URL (utm_source, utm_medium, utm_campaign) if present. There is no full click-path tracking without consent. Referrer URLs, origin/destination histories, and free-text click labels are not stored in this tier. Measurement is first-party via POST /api/event and is separate from Google Analytics and the LinkedIn Insight Tag.

Legal basis: Art. 6(1)(f) GDPR (legitimate interest in secure operation, abuse prevention, and basic proof of campaign reach without third-party tracking). Where no access to end-device storage occurs, Section 25(1) TDDDG does not apply; no tracking cookies are set.

Retention: at most 14 months, then deletion or aggregation without personal reference. Internal analysis. No transfer to LinkedIn or Google via this mechanism. For internal operations we may send anonymised visit alerts (page path, UTM parameters, no IP/name) via a Telegram bot to a closed internal chat (Telegram Messenger Inc., possibly involving third-country transfer). Legal basis: Art. 6(1)(f) GDPR; you may object (see below).

Objection: You may object to this legitimate-interest processing at any time (Art. 21 GDPR), e.g. by email to info@dcorr.de. We will review the objection and stop processing unless compelling legitimate grounds override.

3.2 Consent storage (local storage)

Your consent choices are stored locally in your browser under the key dcorr_cookie_consent_v2, including analytics and marketing flags, a timestamp (consentAt), and the policy version 2026-08-6c. This information is not sent to our server.

Retention: until you withdraw consent or clear browser storage. We re-request consent after at most 12 months (based on consentAt). You can change your choice at any time via “Change consent settings” in the footer.

3.3 Statistics (opt-in)

The analytics category covers extended first-party tracking and Google Analytics 4. We set analytics cookies and comparable storage access only after your active consent. Technically necessary hosting logs and the cookieless reach measurement (section 3.1) are unaffected.

3.3.1 Extended first-party tracking (opt-in)

In addition to necessary reach measurement, and only after your analytics consent, we process extended event data such as referrer domain (for example “google.com”), event type (for example link click with link text), outbound target domain, and funnel events (for example paper request). We do not store full referrer URLs, visitor profiles, or cookie-based identifiers. No first-party analytics cookies are set.

Legal basis: Art. 6(1)(a) GDPR (consent). You may withdraw consent at any time with effect for the future.

3.3.2 Google Analytics 4

We embed the Google tag (gtag.js) for Google Analytics 4. Using Google Consent Mode, storage and access related to analytics cookies or similar identifiers (analytics_storage) are denied by default. Cookie/storage use is enabled only after your active analytics consent (granted). The tag code may load before consent; without consent no analytics cookies are set. In that state Google may still process highly limited cookieless measurement signals (Consent Mode). Google ads-related storage signals (ad_storage, ad_user_data, ad_personalization) remain denied until marketing consent.

Provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland; and where applicable Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA.

Purpose: reach and usage analysis of this website (page views, sessions, device/browser information). The property may be linked to Google Ads to measure campaign performance.

Measurement ID: G-1P44BE88WD.

Roles / processor: For Google Analytics, Google acts as a processor (Art. 28 GDPR) under the Google Ads Data Processing Terms / Google data processing terms.

Legal basis: Art. 6(1)(a) GDPR; Section 25(1) TDDDG (storage/access on your device only after consent).

Data processed (examples): truncated or full IP address (depending on Google settings), device and browser information, visited page URL, referrer, timestamps, client/session identifiers, and interaction events.

Cookies (examples, may vary): _ga, _ga_*, _gid.

Retention: depends on Google Analytics settings and Google; see the Google privacy policy and Google Analytics help pages.

International transfers (USA): Google may transfer data to the USA, relying among other things on the EU-US Data Privacy Framework and/or Standard Contractual Clauses. Further details are in Google’s privacy policy.

Withdrawal: (1) Disable analytics in this website’s consent settings. We then remove the tag where possible and delete first-party cookies for this domain. (2) You may also clear cookies in your browser settings or restrict Google services via Google Analytics opt-out options. Cookies on Google third-party domains cannot be fully removed from this website.

3.4 UI function storage (local storage, necessary)

Some UI states are stored locally via local storage (for example, whether a banner was dismissed). These values are used only for website functionality, remain on your device, and do not require separate consent.

3.5 Marketing: LinkedIn Insight Tag

If you consent to marketing, we load the LinkedIn Insight Tag. The tag is loaded only after your active consent and is disabled by default.

Provider: LinkedIn Ireland Unlimited Company, Wilton Place, Dublin 2, Ireland (part of Microsoft Corporation).

Purpose: conversion measurement, remarketing, and optimisation of LinkedIn advertising campaigns related to visits to this website.

Legal basis: Art. 6(1)(a) GDPR; Section 25(1) TDDDG (storage/access on your device only after consent).

Data processed (examples): truncated IP address, device and browser information, visited page URL, referrer, timestamps, and cookie identifiers.

Cookies (examples, may vary): li_sugr, bcookie, AnalyticsSyncHistory, UserMatchHistory.

Retention: determined by LinkedIn; see the LinkedIn privacy policy.

Transfers to the USA: LinkedIn may transfer data to the USA and relies, among other mechanisms, on the EU-US Data Privacy Framework and standard contractual clauses.

Joint controllership: in the context of the Insight Tag, joint controllership under Art. 26 GDPR may apply. See LinkedIn’s privacy policy for details.

Partner ID (transparency): 9396754

Withdrawal: (1) disable marketing in consent settings; (2) optionally use LinkedIn’s retargeting opt-out. Withdrawal stops reloading the tag and future measurement. LinkedIn cookies already set on third-party domains (e.g. .linkedin.com) cannot be removed via first-party JavaScript — use LinkedIn’s opt-out or delete cookies in your browser settings.

4. Contact form and private lead inbox

If you contact us by email or via the contact form on this website, we process the data you provide (in particular name, email address, subject, message content, for research requests optionally company and role, and technical context such as page URL, language and, where applicable, UTM/referrer domain) to handle your request.

The contact form submits your details to our own form endpoint on our EU server (hosted by Hetzner). The data is stored in a private file store that is not publicly reachable and is used only to process your request. Access via the website or a download URL is not provided; retrieval is limited to authorised persons.

Legal basis: Art. 6(1)(b) GDPR where your request relates to a contract or pre-contractual steps; otherwise Art. 6(1)(f) GDPR (legitimate interest in handling enquiries). We generally review and delete general or unanswered enquiries within 12 months, unless statutory retention obligations apply.

After a successful submission you see a confirmation (“thank you”) page. Analytics tracking there (including Google Analytics) occurs only with analytics consent (section 3.3); advertising/LinkedIn tracking only with marketing consent (section 3.5).

We use technical abuse protections (including input validation, honeypot fields and rate limiting). Full IP addresses are not stored in the lead inbox.

5. Whitepaper requests and dcorr Quant Monitor

Whitepaper/research requests: If you request a whitepaper or research material via a form, we store your details server-side as described in section 4 (including company and role) to process the request. Legal basis: Art. 6(1)(b) or (f) GDPR. If you additionally opt in to the Quant Monitor, we store that opt-in and rely on Art. 6(1)(a) GDPR for sending those updates.

dcorr Quant Monitor: If you subscribe, we store in particular your name and email address in our private lead inbox. There is no automatic newsletter sending. Before any regular updates, we will personally ask once more whether you want to receive these emails (manual double opt-in). Regular mailings start only after your explicit confirmation. Legal basis: your consent under Art. 6(1)(a) GDPR. You may withdraw consent at any time with effect for the future (e.g. by email to info@dcorr.de).

Form submissions are a necessary website function and do not require cookie/marketing consent. Optional analytics and marketing remain separate (see section 3).

6. Your rights

Subject to GDPR, you have rights of access, rectification, erasure, restriction, portability, objection (where applicable), and complaint to a supervisory authority. You may withdraw consent at any time via consent settings or by email to info@dcorr.de.

7. Changes

We may update this notice when the website or legal requirements change. For material changes (for example a new tracking service), we increase the policy version and may request consent again.