Privacy policy
Last updated: 25 October 2026
This privacy policy explains how we process personal data when you visit our website favoso.de and when you contact us.
1. Controller
Favoso Consulting GmbH
Flughafenallee 26
28199 Bremen
Germany
Telephone: +49 421 849193-50
Email: info@favoso.de
2. Provision of the website and hosting
The website is hosted by ALL-INKL.COM. When you access our website, technical connection data is processed to deliver the requested content, identify technical errors and protect the operation of the website. This may include, in particular, your IP address, date and time, the requested URL, HTTP status code, volume of data transmitted, browser and device information and, where applicable, the page previously visited, as recorded in server logs.
The legal basis is Article 6(1)(f) of the General Data Protection Regulation (GDPR): our legitimate interest in maintaining a secure and functioning website. Our hosting provider receives this data as part of the technical delivery of the website. Further disclosure may occur where required by law or necessary to prevent or investigate attacks.
Server-log retention depends on the purpose of processing. Log data is deleted or anonymised once it is no longer required for technical operations, error analysis or protection against attacks. Data needed to investigate a specific security incident or protect legal claims may be kept longer, until the relevant investigation is concluded or the purpose no longer applies.
3. Cookies, analytics and advertising
We do not use Google Analytics, Google Ads or reCAPTCHA on our website. There is no newsletter form. Our website does not set analytics or advertising cookies. When you access the contact form, we use a technically necessary session cookie (FAVOSO_CONTACT) to protect the form against abusive submissions. It is not used for traffic measurement or advertising and is deleted when the browser session ends. The cookie is required to provide the requested contact form securely; the applicable provision is section 25(2)(2) of the German Telecommunications Digital Services Data Protection Act (TDDDG).
4. Contact and contact form
You can contact us using the contact form on favoso.de or by telephone. The form requires your email address and message so that we can process and respond to your enquiry. Providing your name and selecting an enquiry category is optional. The form cannot be submitted without an email address and message; alternatively, you can contact us by telephone.
On submission, your details are validated on the server and transmitted as an email using an authenticated, TLS-encrypted SMTP connection from our technical sending account webmailer@favoso.de to info@favoso.de. The email address you enter is used as the Reply-To address so we can respond to you directly. Messages are not additionally stored in a website database. No external form provider or CAPTCHA service is integrated.
To prevent abusive submissions, we use a hidden validation field, a randomly generated session token (CSRF protection) and a short waiting period between repeated submissions. For this purpose, the contact page uses a technically necessary session cookie named FAVOSO_CONTACT. The browser session generally ends when the browser session closes; server-side session data is deleted according to the retention periods of the server configuration.
For technical monitoring of email delivery, we record a random transaction identifier, delivery status and, in the event of an error, a technical error stage and SMTP status code. These separate diagnostic records do not contain message text, names, email addresses or passwords. They are used exclusively for error analysis and operational security and are deleted when no longer required for these purposes. General server logs, as described in section 2, are unaffected.
The legal basis for processing your contact details is Article 6(1)(b) GDPR if your enquiry concerns pre-contractual steps or an existing contractual relationship. For other enquiries, processing is based on Article 6(1)(f) GDPR (our legitimate interest in processing and responding to enquiries). Technical security and delivery logs are processed under Article 6(1)(f) GDPR for abuse prevention, troubleshooting and secure operation.
Recipients of your data include the people responsible for dealing with your enquiry within our company and the hosting and email service providers we use for this purpose, particularly ALL-INKL.COM. Where forwarding is configured for the recipient mailbox, the message is also processed by the email service for the forwarding destination. The actual delivery chain depends on the respective mailbox configuration.
We retain enquiries and related correspondence for as long as necessary to handle the enquiry, maintain the business relationship or protect legitimate claims. Statutory retention requirements may require longer storage. Technical diagnostic records are retained only for the period needed for error analysis and operational security.
5. Fonts and external links
This website uses locally stored PT Sans and PT Sans Narrow font files served from our own web server. Loading our pages does not trigger font requests to Google Fonts or GitHub; our server does not automatically retrieve these files from third parties either.
Our contact page provides a link to Google Maps. No Google map is loaded automatically. Only when you click the link do you leave our website and open Google's service. Google's own privacy information applies to its processing of your data: Google Privacy Policy.
Other external links are likewise only opened when you choose to click them. The respective website operators are responsible for processing data on those sites.
6. Your data protection rights
Subject to the applicable statutory requirements, you have the right of access (Article 15 GDPR), rectification (Article 16), erasure (Article 17), restriction of processing (Article 18), data portability (Article 20) and objection (Article 21). Where processing is based on your consent, you may withdraw that consent at any time with effect for the future (Article 7(3) GDPR).
Where we process data on the basis of legitimate interests, you may object on grounds relating to your particular situation. You can contact us using the email address above.
You also have the right to lodge a complaint with a data protection supervisory authority under Article 77 GDPR. For a controller established in Bremen, the competent authority is generally the State Commissioner for Data Protection and Freedom of Information of the Free Hanseatic City of Bremen (Landesbeauftragte für Datenschutz und Informationsfreiheit der Freien Hansestadt Bremen): www.datenschutz.bremen.de.
7. Required information and automated decision-making
Providing your data through the contact form is not a statutory or contractual requirement. However, your email address and message are necessary if you wish to use this means of contact. We do not use solely automated decision-making within the meaning of Article 22 GDPR or profiling when processing contact-form enquiries.
8. Security and updates
Connections to our website are encrypted using HTTPS. We review the safeguards we use and update this privacy policy when there are material changes to how personal data is processed on our website.