Privacy
explained transparently.

1. Controller

Nicolas Glesel
Rosenthaler Weg 15
13127 Berlin
Germany
Email: kontakt@nicolasglesel.de

2. Hosting and infrastructure

This website is provided through ChatGPT Sites. For a website operator established in the European Economic Area, the processor identified in the ChatGPT Sites Data Processing Addendum is OpenAI Ireland Limited, 1st Floor, The Liffey Trust Centre, 117–126 Sheriff Street Upper, Dublin 1, D01 YC43, Ireland. OpenAI uses Cloudflare, Ltd. in particular for content delivery and web hosting.

Technically necessary connection and log data may be processed when the site is requested, including IP address, time, requested address, referrer, browser and device information. The purpose is secure, stable and abuse-resistant delivery under Article 6(1)(f) GDPR. The current OpenAI sub-processor list provides further details.

3. Data location and international transfers

ChatGPT Sites currently does not provide binding data residency for the published site, source code, D1 form data, files and technical logs. Processing may therefore take place outside the EEA. The ChatGPT Sites Data Processing Addendum identifies adequacy decisions or EU Standard Contractual Clauses as transfer mechanisms.

Cloudflare generally processes data at the data centre closest to the visitor. See the ChatGPT Sites Data Processing Addendum.

4. Contact form, AI consultation and secure data transfer

The contact form and guided form assistant process name, email address, optional organisation and telephone number, plus details about the occasion, format, date, number of participants, audience, location, optional budget range, referral source and message. Transmission is encrypted. The enquiry is stored in an access-protected website database and sent by email to a mailbox operated by Proton.

An optional consultation dialogue, clearly identified as AI, can be used before the form and starts only after active consent. Chat messages are transmitted through a server-side interface to the OpenAI API to generate a relevant answer, follow-up question and structured qualification. The assistant is not Nicolas Glesel personally. It has no web search, private-system access, upload feature, microphone access or audio recording and does not make automated decisions.

The AI chat does not ask for names, email addresses or telephone numbers; common contact, account and payment details are technically rejected before an AI request. Nevertheless, do not enter information about applicants or other third parties, special-category data, criminal, investigative or case data, credentials, payment data or confidential documents. Chat messages are not stored in the website inbox or persistent browser storage. Only a summary that you separately transfer, review and submit through the form is stored; the full transcript is not.

According to OpenAI's API data-control information, API content is not used for model training by default. The dialogue uses store: false so that the response object is not retained as application state. Content and related metadata may nevertheless generally be processed in abuse-monitoring logs for up to 30 days unless stronger retention controls are enabled for the API project or longer retention is legally required or reasonably necessary to protect the services. European data residency is not guaranteed for this dialogue.

Transmission to the OpenAI API is based on consent under Article 6(1)(a) GDPR. Consent is voluntary and the structured form remains available without AI. You may withdraw consent at any time with effect for the future, including by closing the dialogue or contacting kontakt@nicolasglesel.de. Withdrawal does not affect the lawfulness of processing before withdrawal.

Form enquiries are delivered through direct SMTP to a mailbox operated by Proton AG, Switzerland. No separate form or transactional-email provider receives the enquiry. Switzerland benefits from an EU adequacy decision. See the Proton privacy policy. Article 6(1)(b) GDPR applies where your enquiry concerns your own contract or pre-contractual steps taken at your request. Enquiries on behalf of an organisation and other professional communications are processed under Article 6(1)(f) GDPR, based on the legitimate interest in responding to business correspondence. Providing information is voluntary. Without the required contact and enquiry details, the form cannot process an enquiry; email remains available as an alternative. There is no statutory duty to use the form. Database cleanup is currently triggered when a new form submission is made or when the protected inbox is accessed. Enquiries older than 180 days are removed by that cleanup. Older entries can therefore remain until the next cleanup; automatic deletion on an exact day is not promised. Earlier manual deletion is possible. Email and contractual correspondence is deleted when no longer needed for its purpose, subject to applicable statutory commercial and tax retention duties.

Secure data transfer after engagement approval

Only after a specific engagement has been discussed or approved may Nicolas Glesel issue a personal, randomly generated and time-limited upload link. The uploaded file, filename, type, size, SHA-256 checksum, timestamp and an internal transfer-space label are processed. The website database stores the secret part of the link only as a non-reversible hash. The complete link is supplied to the authorised recipient and must be kept confidential. The link permits uploads only and cannot reveal files already submitted.

Files are transferred over HTTPS and stored separately from public website assets in access-controlled object storage. Retrieval requires Sign in with ChatGPT, an exact server-side email allowlist and authorisation on every request. Links can be revoked at any time; file count and size are limited. Each transfer space has an access-expiry date, normally within 30 days. Cleanup of expired spaces is triggered by website and administrative requests and runs in limited batches. Files and metadata may therefore remain until the next successful cleanup; deletion at an exact time is not promised. Contractual deletion deadlines must be met independently of this technical cleanup, using manual deletion where necessary. Statutory retention duties and any different periods are documented for the engagement in advance. An optional recipient email address is used only to send the invitation and is not retained in the transfer space. Passwords, credentials, account and payment data are excluded. Special-category or criminal-offence data may be submitted only when this has been legally assessed, is necessary and has been expressly agreed for the engagement.

5. Form and AI-chat abuse prevention

Cloudflare Turnstile is loaded immediately when sending public form or chat messages. Cloudflare, Inc. processes technical browser and connection signals, including IP address, TLS characteristics, browser identification, website origin and public widget key. Our server verification transmits only the security token; enquiry content, contact details and chat messages are not sent to Cloudflare for this check. The purpose is preventing spam and automated misuse, based on the legitimate security interest described above. Cloudflare acts as a processor when providing the service and as a controller when improving its bot detection. Its Turnstile Privacy Addendum explains international processing and data protection rights. Turnstile is not used for our reach measurement. Pre-clearance with an additional clearance cookie is disabled.

The requesting IP address is cryptographically pseudonymised with a secret server-side value in order to limit automated misuse and uncontrolled API costs. Only a non-reversible key, attempt counters and timestamps are stored. Later requests to the relevant endpoint trigger cleanup. Records last updated more than 24 hours ago may therefore remain until the next cleanup. The legal basis is Article 6(1)(f) GDPR.

6. Protected enquiry mailbox and statistics

Form enquiries and aggregated site statistics are available only in protected areas authenticated through Sign in with ChatGPT and restricted to an expressly authorised email address. OpenAI may receive the email address and display name needed for authentication. The legal basis is Article 6(1)(f) GDPR.

7. Data-minimised reach measurement

The site records only calendar day, page, a broad source category such as Google, LinkedIn or direct, and a broad device class. No IP address, full referrer URL, visitor identifier or fingerprint is stored. Do Not Track browsers are excluded.

A small number of predefined actions are counted only in aggregate: primary and secondary enquiry actions, service-path choices, speaker one-pager downloads, form starts, successful form submissions, email actions and language changes. Neither link text nor form content nor a visitor identifier is stored. Analytics cleanup is event-driven rather than scheduled, so counters older than 395 days can remain until the next cleanup. They are never used for advertising, profiling or remarketing.

8. Cookies and local storage

The hosting service may set the __cf_bm cookie for technical bot and abuse protection. It is used to assess requests and normally expires after 30 minutes of inactivity. It is not used for this website’s reach measurement. The legal bases are Article 6(1)(f) GDPR and, for technically necessary storage, Section 25(2)(2) TDDDG.

No analytics, marketing or profiling cookies are set on public pages, and reach measurement stores no identifier in the browser. The AI chat likewise uses neither cookies nor persistent browser storage for conversation history. No consent banner for optional cookies is therefore used; voluntary AI processing is requested directly in the dialogue.

The public media information does not require a session. Only the protected high-resolution media portal uses the technically required, domain-only session cookie ng_press_access after successful login. It contains no profile data, is inaccessible to JavaScript and expires after no more than eight hours. It is deleted immediately on logout. Pseudonymised login-attempt records are deleted after successful access. Other records older than 24 hours can remain until a later login attempt triggers cleanup.

9. Screening enquiries

The public form is only for describing the client's own need. Personal data relating to a potential screening subject must not be entered. Before any review begins, purpose, roles, responsibilities, scope, information duties, recipients, safeguards and deletion periods are agreed separately.

Confidential screening material is not accepted through the public form, AI chat or normal email attachment. Once scope and contract are approved, the time-limited secure transfer space described above or a separately agreed access-controlled Proton Drive case folder may be used. Permitted data categories, recipients and deletion dates are documented for the engagement. The supplied data-processing agreement covers only the Proton Drive arrangement. It does not automatically cover the website transfer space: the contract, sub-processors, international transfers and deletion procedure must be assessed and agreed before that space is used.

10. External links

External providers such as LinkedIn, event organisers and source websites receive data only when a visitor chooses to follow the relevant link. Their own privacy terms then apply. Fonts are served locally; external video, maps and social-media feeds are not embedded.

11. Data-subject rights

Subject to statutory conditions, individuals have rights of access, rectification, erasure, restriction, data portability and objection. Complaints may be filed with a data-protection authority, particularly the Berlin Commissioner for Data Protection and Freedom of Information.

Right to object: Where processing is based on Article 6(1)(f) GDPR, you may object at any time on grounds relating to your particular situation. Processing will stop unless compelling legitimate grounds overriding your interests, rights and freedoms are demonstrated, or processing is needed for the establishment, exercise or defence of legal claims.

To exercise your rights, contact kontakt@nicolasglesel.de. Consent may be withdrawn at any time with effect for the future. This website does not make solely automated decisions with legal or similarly significant effects within the meaning of Article 22 GDPR.

12. Currency

Last updated: 3 October 2026. This notice will be updated when hosting, form delivery, retention periods, reach measurement, media or other services change.