Privacy policy

Controller and contact

Reynaldo Ilagan, IRY Consulting
Michelberg 8E
96049 Bamberg
Germany

For privacy questions or requests, email reynaldo.ilagan@iry-consulting.com or call +49 162 4022737.

Reynaldo Ilagan is responsible for data protection matters at IRY Consulting and handles privacy requests. No separate Data Protection Officer (DPO) has been appointed.

Hosting, server logs and STRATO statistics

This website is hosted with STRATO GmbH, Otto-Ostrowski-Straße 7, 10249 Berlin, Germany, under the STRATO Hosting für WordPress Basic plan. STRATO processes hosting data to deliver and secure the website. The data-processing agreement (AVV) for the hosting has been concluded. STRATO identifies IONOS SE as a recipient involved in providing and maintaining products. STRATO’s current AVV and subprocessor information describe any additional processors and safeguards applicable to the service.

When a page is requested, the hosting server processes technical connection and request data, which may include the IP address, date and time, requested URL, referrer, browser and operating-system details, response status and transferred data. In its data-protection FAQ, STRATO states that visitor IP addresses used to detect and defend against attacks are kept for no more than seven days. This period concerns STRATO’s security processing; it is not the same as the availability period for customer reports and downloads.

STRATO’s log-file guide describes web-server logs covering the last six weeks as available for download and an error-log display covering the last five days. These are access and display periods, not confirmed deletion deadlines. Its documentation says the client hostname or IP in these customer log files is altered by hashing the first nine bits of the IP address; a transformed address is valid for up to 24 hours, and a hostname may retain its domain part. Because altered network identifiers and request details may still be linkable in context, this notice does not treat the customer logs as necessarily anonymous.

The STRATO hosting control panel also provides server-side statistics. According to STRATO, these do not require browser cookies or tracking scripts. They include hits (server requests, including page elements and failed requests), page views (HTML or text documents), successfully served files, sessions counted by distinct hosts within 24 hours, and transferred data volume. These host-based session figures are estimates and do not identify or count individual people. The date selector allows reports for up to 400 days, while some historical charts may remain viewable longer. This describes report availability; STRATO does not state a deletion deadline for the underlying derived statistics in the information available to the site operator.

These operations are used to deliver the website, maintain security and understand aggregate website usage. The controller’s basis for necessary hosting and security is the legitimate interest in operating a secure, available website (Article 6(1)(f) GDPR). STRATO’s internal aggregate statistics are used for the same website-operation interest. You can object to processing based on legitimate interests on grounds relating to your particular situation; see “Your rights” below. STRATO’s information about IP alteration and statistics, log-file availability, and data-processing agreement is available online.

Hosting is provided in the EU/EEA under the STRATO agreement unless a third-country transfer is needed for the service; in that case STRATO states that the safeguards required by Articles 44 et seq. GDPR apply. For STRATO’s own purposes, STRATO may act as an independent controller. See STRATO’s privacy information for details.

Contact by email or telephone

If you email or call IRY Consulting, the contact details you use and the information you provide are processed to respond to your request and, where relevant, to take steps before entering a contract. For pre-contract requests, the basis is Article 6(1)(b) GDPR; for other enquiries, it is Article 6(1)(f) GDPR, the legitimate interest in handling correspondence.

Business email is handled through Google Workspace (Gmail). Email addresses, sender and recipient details, message contents, attachments and technical delivery data are processed to send, receive and manage correspondence. The Workspace processing and international-transfer information in the appointment-booking section below also applies to this email service.

Enquiries are kept only as long as needed to respond and complete any follow-up. Records that must be retained by law are kept for the applicable statutory period. Please do not send sensitive or confidential information unless it is necessary.

Appointment booking with Google Calendar

The “Book a call” links open a separate Google Calendar appointment schedule. The calendar is not embedded in this website, and no booking details are sent from this site when you simply view a page. If you choose to book, Google’s page asks for your first name, last name and email address. Google Calendar uses those details to create and manage the appointment, send booking communications and add it to the relevant calendar. Booking data is processed to take steps at your request before a possible consulting contract (Article 6(1)(b) GDPR).

The booking service is operated through a Google Workspace business account. Google processes the information under the Workspace terms and privacy documentation; Google entities may act as processor for Workspace services and may separately process limited data for security, support or legal compliance. Google states that its services may process information in countries outside the EEA. Depending on the applicable service terms and transfer, Google relies on an adequacy decision, its EU-U.S. Data Privacy Framework certification, or Standard Contractual Clauses. The applicable Workspace Cloud Data Processing Addendum and transfer safeguards are governed by the account’s terms. Google’s Privacy Policy, appointment schedule information and data-transfer information provide further details. Once you leave this website, Google’s privacy information and terms apply to the booking page.

Providing booking details is necessary only if you want to request an appointment. Booking details are kept in the Workspace calendar for managing the appointment and any follow-up, and are deleted when no longer needed unless a legal retention obligation applies. The website does not receive a confirmation that an appointment was successfully completed.

Privacy choices and local storage

This website uses a first-party privacy panel to ask for your optional analytics consent. It stores your choice in local storage in this browser for up to 180 days so the choice can be remembered. The entry iry-privacy-choice-v4 contains your privacy choice, the consent version, the time of your decision and an expiry time. It is not sent to a consent-management provider. This necessary storage is used to honour your privacy settings under Section 25(2)(2) TDDDG; the associated processing is based on the legitimate interest in implementing and respecting your choices (Article 6(1)(f) GDPR). You can reopen “Privacy settings” in the footer at any time to change or withdraw your choice. When you withdraw analytics consent, the page reloads to stop the previously loaded tags and apply your new choice. Accessible first-party Google cookies for analytics are removed. Withdrawal does not affect the lawfulness of processing based on consent before its withdrawal.

The Google Analytics tag is not loaded until you allow analytics. If you reject or make no choice, it remains off. The legal basis for the optional tag and related access to information on your device is your consent (Article 6(1)(a) GDPR and, where applicable, Section 25(1) TDDDG).

Cookies and similar technologies

The necessary local-storage entry iry-privacy-choice-v4 is provided by IRY Consulting and remembers your privacy choice for up to 180 days from your decision. It does not track visits and is not shared with a consent-management provider.

Only after analytics consent, Google Analytics sets first-party cookies on this website: _ga distinguishes browsers, and _ga_XXRBDRPZR8 maintains session state. Both are configured to expire after 180 days; their expiry is renewed on return visits while consent remains valid. Your browser may apply a shorter lifetime. These cookie identifiers and related visit data are processed by Google for the analytics purposes described below. Cookie lifetime is separate from Google’s server-side data-retention settings.

Rejecting analytics prevents these cookies from being set by this website. Withdrawing consent through “Privacy settings” removes accessible first-party Analytics cookies and stops the tag. The external Google Calendar booking page can use its own cookies and storage, governed by Google’s information once you open that page. See Google’s Analytics cookie information.

Google Analytics

If you allow analytics, Google Analytics 4 measures page views and website use. This includes cookie and session identifiers, interaction times, page titles and URLs, referrers, browser and operating-system information, language, screen resolution and approximate location derived from the IP address. The current site code records clicks on website buttons and links, including navigation, FAQ controls and filters, as the event button_click. Each element has a fixed identifier and label so clicks can be compared separately by page and placement, including buttons with identical wording. No free text or contact details are included in these click parameters. Consent-panel actions are not recorded. A click on the external appointment link is additionally recorded as booking_click. Google’s enhanced measurement is enabled for this stream and can also record interactions such as scrolling, outbound link clicks and file downloads. The booking-click event indicates a click only; it is not proof that an appointment was requested or completed. No completed-booking conversion is configured. No names, email addresses or appointment details are intentionally included in the event parameters. Page URLs and referrers sent by the site code exclude query strings and fragments. Google Signals, user-provided data collection and advertising personalisation are disabled. This website does not load a Google Ads tag.

Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Ireland) provides Analytics; Google LLC in the United States and Google’s subprocessors may also process data. Google processes Analytics data under the accepted data-processing terms. Optional account-level data sharing for Google products, benchmarking, technical support and business recommendations is disabled. Google says that for users in the EU, IP addresses are used to derive approximate location and are then discarded rather than logged or stored. Google states that it relies on applicable adequacy decisions, its EU-U.S. Data Privacy Framework certification, or Standard Contractual Clauses for international transfers as applicable. This property is configured to retain event data for two months and user data for fourteen months. The option to reset retention on new user activity is enabled: each new event from a user restarts the fourteen-month retention period for that user’s identifier, so recurring activity can extend this period. Google deletes data that has reached the end of its retention period during its monthly deletion process. These settings do not determine cookie lifetimes and do not apply to standard aggregated reports, which can remain available for longer. See Google’s data-retention information, EU data processing information and data-transfer information.

Your rights

Subject to the legal requirements, you may request access to your personal data, correction, erasure, restriction of processing and data portability. Where processing is based on legitimate interests, you may object for reasons relating to your particular situation. If your personal data is processed for direct marketing, you may object at any time without giving reasons, including to profiling related to that marketing. Where processing is based on consent, you may withdraw consent at any time for the future. To exercise a right, contact the controller using the email address above.

You may lodge a complaint with a data protection authority. The supervisory authority for private-sector organisations and self-employed professionals in Bavaria is the Bavarian State Office for Data Protection Supervision (BayLDA), Promenade 18, 91522 Ansbach, Germany.

Other information

Data is provided voluntarily except where it is technically required to deliver a page or necessary to make an appointment request. Not providing booking details means that an appointment cannot be requested through Google Calendar. Optional analytics is not required to contact IRY Consulting or book an appointment. IRY Consulting does not use solely automated decision-making that produces legal effects or similarly significantly affects you within the meaning of Article 22 GDPR.

This notice may be updated when the website, services or legal requirements change. Last updated: 1 October 2026.