.svg)
English
Thank you for your interest in Heartland Solutions. This policy explains which personal data we process on this website and when you contact us, for what purposes, on what legal basis and for how long – and what rights you have.
The controller within the meaning of Art. 4(7) GDPR is:
Heartland Solutions GmbH
Kleinfeldweg 54, 69190 Walldorf, Germany
represented by its managing directors Inga Auhagen-Schätzle and Bastian Schätzle
Email: myproject@heartland-solutions.com
We are not legally required to appoint a data protection officer (Art. 37 GDPR, Section 38 BDSG). For all data protection questions and to exercise your rights, contact us at myproject@heartland-solutions.com or at the postal address above.
Legal bases. We only process personal data where a legal basis applies. Depending on the purpose, this is:
Recipients. We do not sell your data. We use carefully selected service providers who process data on our behalf and on our instructions (processors, Art. 28 GDPR), with whom we have concluded data processing agreements. Where a provider is an independent or joint controller, we say so for the respective service.
Transfers to third countries. Some providers are based in the USA or access data from there. For the USA, there is an adequacy decision of the European Commission for companies certified under the EU-U.S. Data Privacy Framework (Art. 45 GDPR). Where this does not apply, we use the European Commission’s Standard Contractual Clauses (Art. 46(2)(c) GDPR). You can request a copy of the safeguards.
Retention. We keep data only as long as necessary for the respective purpose or required by statutory retention periods. Specific periods are stated in the individual sections.
Obligation to provide data. You are not legally or contractually obliged to provide data. Without the mandatory fields in the request form, however, we cannot process your request.
No automated decisions. There is no automated decision-making within the meaning of Art. 22 GDPR. Advertising and analytics services that can create usage profiles are only used with your consent (Section 7).
We run our website on Webflow (hosting, content management, forms). The provider is Webflow, Inc., 398 11th Street, 2nd Floor, San Francisco, CA 94103, USA.
With every visit, Webflow processes technically necessary data: IP address, date and time, page requested, referring page, browser and operating system. This serves the delivery, stability and security of the website, e.g. defending against attacks. For fast delivery, Webflow uses content delivery networks (including Amazon CloudFront of Amazon Web Services, Inc.); your IP address is transmitted to the nearest server of these networks. We load fonts and program libraries from Webflow itself, not from Google Fonts or other third parties. The legal basis is Art. 6(1)(f) GDPR; our legitimate interest is a secure and functional website.
Webflow processes the data as our processor and is certified under the EU-U.S. Data Privacy Framework. Webflow deletes server log files automatically according to its own retention periods. We do not analyse them and only access them to investigate a security incident.
What cookies are. Cookies are small text files stored on your device. We treat similar technologies (e.g. local storage, pixels) the same way. We set strictly necessary cookies without consent (Section 25(2) no. 2 TDDDG). All others – for statistics, advertising measurement and optimisation – only with your consent (Section 25(1) TDDDG, Art. 6(1)(a) GDPR).
Cookiebot. We manage your consent with Cookiebot by Usercentrics A/S, Havnegade 39, 1058 Copenhagen, Denmark. When you visit the site, Cookiebot asks for your choice. As proof, we store a random consent ID, date and time, your choice, the page URL, browser information and a truncated IP address. The legal basis is Art. 6(1)(c) in conjunction with Art. 7(1) GDPR (duty to demonstrate consent). Your choice is stored in the “CookieConsent” cookie for 12 months; after that we ask again. Usercentrics is our processor; the data is processed in the EU.
Google Consent Mode. We use Google Consent Mode v2, set to “denied” by default. Google services only set cookies and send data once you have consented.
Changing your choice. You can change or withdraw your consent at any time with effect for the future via the “Cookie settings” link in the footer of every page. Processing carried out before withdrawal remains lawful.
All cookies in detail. The complete, continuously updated list of cookies with provider, purpose and duration:
Contact by email or phone. If you write to us or call us, we process your details (e.g. name, contact details, request) to respond. We process our emails with Microsoft 365 (provider and third-country situation see below). The legal basis is Art. 6(1)(b) GDPR if your request relates to a contract, otherwise Art. 6(1)(f) GDPR (interest in answering enquiries).
Request form. You can request a fixed-price quote for ISO 27001, BSI C5 or NIS-2 via our form. We process your name, business email address, company, company size, desired scope of services, desired standards and tools in use, in order to process your request and prepare a quote. The legal basis is Art. 6(1)(b) GDPR (pre-contractual measures at your request). Mandatory fields are marked.
Campaign data. If you reach us via an ad or a campaign link, the form also transmits the click identifier (gclid, gbraid, wbraid or msclkid) and the campaign parameters (utm_source, utm_medium, utm_campaign, utm_term, utm_content). This shows us which ad led to a request so we can use our advertising budget sensibly. The legal basis is Art. 6(1)(f) GDPR (measuring the success of our advertising). Values read from cookies on your device are only included with your consent (Section 25(1) TDDDG). For this we set the first-party cookie “hl_attr”, and only if you have consented to the “Marketing” category. It stores the click identifier (gclid, gbraid, wbraid or msclkid) and the campaign parameters (UTM parameters) of the landing page so that we can attribute your request to the ad click. It is stored for 90 days. The legal basis for the cookie is your consent (Section 25(1) TDDDG, Art. 6(1)(a) GDPR).
Spam protection. A field invisible to humans and a simple plausibility check detect automated submissions. We review suspicious requests manually; no automated decision is made about you. The legal basis is Art. 6(1)(f) GDPR (protection against misuse).
How your request is handled. Webflow receives the form as our processor (see Section 4) and forwards it to our Microsoft 365 mailbox. Using Microsoft Power Automate, we send you an email confirmation and file your request in an internal list in Microsoft SharePoint, accessible only to the people at Heartland who handle requests. Requests you send by email to myproject@heartland-solutions.com are filed in the same list in the same way; we notify the responsible people internally via Microsoft Teams. The provider is Microsoft Ireland Operations Ltd., One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, Ireland, as our processor. Data is stored in EU data centres (EU Data Boundary). Access by Microsoft Corporation from the USA is possible in individual cases; Microsoft is certified under the EU-U.S. Data Privacy Framework, supplemented by Standard Contractual Clauses.
Retention. If no contract results, we delete your request no later than 12 months after our last contact. We delete submissions in Webflow’s form storage after 30 days. If your request leads to a contract, we keep the data for the duration of the business relationship and thereafter as required by commercial and tax retention periods (up to 10 years, Section 257 HGB, Section 147 AO).
We only use the following services if you have consented in the cookie banner (Art. 6(1)(a) GDPR, Section 25(1) TDDDG). Without consent they are not loaded or do not send data. You can withdraw your consent at any time via “Cookie settings”. We only use remarketing – advertising to visitors who already know our website – if you have consented to the “Marketing” category (Section 7.4).
With Google Tag Manager by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (“Google”), we integrate the Google services below and control them according to your cookie choice. Tag Manager itself sets no cookies and does not analyse usage data, but your IP address is transmitted to Google when it loads. The legal basis is Art. 6(1)(f) GDPR; our legitimate interest is a data-minimising, consent-compliant control of these services. Transfer to Google LLC in the USA is possible; Google is certified under the EU-U.S. Data Privacy Framework.
With Google Analytics 4 we understand how our website is used – which pages are viewed and which requests are submitted – to improve content and navigation. We process pseudonymous user and device identifiers, page views and events, approximate location (country, region, city), browser and device information, referrer and campaign parameters. Google Analytics 4 does not store IP addresses; we have disabled Google signals and data sharing to improve Google products. If you have also consented to the “Marketing” category, we additionally use Google Analytics to build remarketing audiences (Section 7.4). Google processes the data as our processor. Cookies: _ga and _ga_14NWZNZ613 (2 years each). User and event data is deleted automatically after 14 months. Transfer to Google LLC in the USA is possible (EU-U.S. Data Privacy Framework, supplemented by Standard Contractual Clauses).
We run search ads via Google Ads. To measure whether a request follows a click on an ad, the click identifier is stored in the _gcl_aw cookie (90 days) and reported to Google Ads via the link with Google Analytics. We only see aggregated figures, not individuals. Google is an independent controller for measurement and billing of ads (Google Ads Controller-Controller Data Protection Terms). More information: policies.google.com/privacy. Transfer to Google LLC in the USA is possible (EU-U.S. Data Privacy Framework).
Only if you have consented to the “Marketing” category do we add you to audience lists – e.g. “visitors to our fixed-price pages who have not yet submitted a request”. Google Analytics transmits your pseudonymous identifier to Google Ads for this purpose. Google may then show you our ads on other websites, on YouTube or in Google Search, or weight our search ads more highly for you. We only see the size of the lists, not individuals.
We process the pseudonymous identifier from the _ga and _gcl_au cookies, pages visited, time and device information. You remain on a list for no longer than 180 days after your last visit. The legal basis is your consent (Art. 6(1)(a) GDPR, Section 25(1) TDDDG); Google is an independent controller for selecting and serving the ads. You can withdraw your consent via “Cookie settings” and manage personalised advertising by Google at myadcenter.google.com. Transfer to Google LLC in the USA is possible (EU-U.S. Data Privacy Framework).
With the LinkedIn Insight Tag by LinkedIn Ireland Unlimited Company, Wilton Plaza, Wilton Place, Dublin 2, Ireland, we measure the success of our LinkedIn advertising and receive aggregated, anonymous reports on visitors (e.g. industry, company size, job function). We cannot identify individuals. LinkedIn processes, among other things, IP address, device and browser information, pages viewed and timestamps; if you are logged in to LinkedIn, LinkedIn may associate the visit with your profile. We are joint controllers with LinkedIn for collection and transmission (Art. 26 GDPR); the agreement is available at linkedin.com/legal/l/jca. LinkedIn pseudonymises direct identifiers after 7 days and deletes the remaining data after 180 days. Transfer to LinkedIn Corporation in the USA is possible (EU-U.S. Data Privacy Framework). Cookies as listed in the Cookiebot declaration.
We run ads in ChatGPT. To measure their success, we use a measurement pixel by OpenAI Ireland Limited, 1st Floor, The Liffey Trust Centre, 117–126 Sheriff Street Upper, Dublin 1, Ireland. IP address, browser and device information, the page visited, timestamp and, where applicable, a click identifier are transmitted so that OpenAI can report to us, in aggregated form, whether a request followed an ad click. We do not receive the content of your ChatGPT conversations. The legal basis is your consent (Art. 6(1)(a) GDPR, Section 25(1) TDDDG). OpenAI processes this data as an independent controller under the OpenAI Ad Tools Data Processing Terms; how long OpenAI retains it is governed by OpenAI’s privacy policy (openai.com/policies). For onward transfers outside the EU, OpenAI uses recognised transfer mechanisms such as the Standard Contractual Clauses.
With Webflow Optimize by Webflow, Inc. (address see Section 4), we test variants of our pages to find out which presentation visitors understand best. We process a pseudonymous visitor identifier, page views and interactions, referrer and campaign parameters, device information and approximate location. Webflow is our processor and certified under the EU-U.S. Data Privacy Framework. Cookies as listed in the Cookiebot declaration.
We run search ads via Microsoft Advertising, including in the Bing search engine. The provider is Microsoft Ireland Operations Ltd., One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, Ireland (“Microsoft”). Only if you have consented to the “Marketing” category do we load Microsoft’s Universal Event Tracking (UET). It records whether you visit our website and submit a request after clicking one of our ads. It processes a pseudonymous identifier, IP address, device and browser information, pages viewed, time, the click identifier (msclkid) and the event “request submitted”. We only see aggregated figures, not individuals. Cookies: _uetsid, _uetvid and _uetmsclkid on our domain and MUID from bing.com, lifetime up to 13 months; details in the Cookiebot declaration. The legal basis is your consent (Art. 6(1)(a) GDPR, Section 25(1) TDDDG). Microsoft is an independent controller for measuring, billing and improving its advertising services; how long Microsoft stores the data is set out in Microsoft’s privacy statement (privacy.microsoft.com). Data may be transferred to Microsoft Corporation in the USA; Microsoft is certified under the EU-U.S. Data Privacy Framework. You can withdraw your consent via “Cookie settings”; you can control personalised advertising from Microsoft overall at account.microsoft.com/privacy/ad-settings.
For initial calls, workshops and project meetings we use Microsoft Teams by Microsoft Ireland Operations Ltd. (address see Section 6). We process name, email address, attendance times and device information and – only during the meeting – audio, video and chat messages if you use your camera, microphone or chat. We only create recordings, transcripts or AI summaries (e.g. Microsoft Copilot) after prior notice and with your consent. The legal basis is Art. 6(1)(b) GDPR where the meeting relates to a contract or its preparation, otherwise Art. 6(1)(f) GDPR (interest in efficient communication). Microsoft is our processor; for third-country transfers see Section 6. We delete chats and meeting data once they are no longer needed for our cooperation, at the latest after statutory retention periods expire.
For quotes and projects we process the contact details of your contact persons and project-related information to perform the contract (Art. 6(1)(b) GDPR) and to meet legal obligations (Art. 6(1)(c) GDPR). We retain invoice-relevant documents for up to 10 years under Section 257 HGB and Section 147 AO. We only send existing customers occasional information on similar services of our own in accordance with Section 7(3) UWG; you can object at any time.
We maintain a company page on LinkedIn. On our website, social networks are only included as simple links; data is only transmitted when you click them. When you visit our LinkedIn page, we are joint controllers with LinkedIn for page statistics (“Page Insights”) (Art. 26 GDPR; Page Insights Joint Controller Addendum). For details on LinkedIn’s processing, see the LinkedIn Privacy Policy.
You have the following rights regarding your personal data:
An informal message to myproject@heartland-solutions.com is sufficient. We respond within one month (Art. 12(3) GDPR).
Right to object (Art. 21 GDPR). Where we process your data on the basis of legitimate interests (Art. 6(1)(f) GDPR), you may object at any time on grounds relating to your particular situation. We will then no longer process the data unless we demonstrate compelling legitimate grounds or the processing serves the establishment, exercise or defence of legal claims. You may object to processing for direct marketing purposes at any time without giving reasons.
You may lodge a complaint with a data protection supervisory authority (Art. 77 GDPR). The authority responsible for us is the State Commissioner for Data Protection and Freedom of Information Baden-Württemberg, Lautenschlagerstraße 20, 70173 Stuttgart, Germany, www.baden-wuerttemberg.datenschutz.de. We would appreciate it if you contacted us first.
Our website is fully TLS-encrypted, indicated by the padlock symbol and “https://” in the address bar. Internally, we protect your data with technical and organisational measures under Art. 32 GDPR, including role-based access rights, multi-factor authentication and regular reviews of our security measures.
We update this privacy policy when our website, our services or the law change. The version published here applies.
Last updated: 28 October 2026
.svg){kind=icon}
