Privacy policy

1. General

With this privacy policy I inform you which personal data are processed when you visit this website. You will learn for which purposes and on which legal basis this happens, to whom the data may be passed on, how long they are stored and which rights you have. This website is a personal website on which I introduce myself. No client relationships come about through it. I do not use cookies, analytics or tracking services, advertising services or social media plugins. Only if you use the AI assistant Eora does your browser store your consent for the duration of the session; you will find details on this in section 7. I process personal data only insofar as this is necessary for the functions described below.

2. Controller

The controller for the data processing on this website within the meaning of the General Data Protection Regulation (GDPR) is Tobias Reinhardt, Bonner Wall 126, 50677 Köln. You can reach me by email at online [at] tobias-reinhardt.com or via the contact form on this website. Further details can be found in the legal notice.

3. Hosting and server log files

This website is hosted by IONOS SE, Elgendorfer Straße 57, 56410 Montabaur. IONOS acts for me as a processor pursuant to Art. 28 GDPR; a data processing agreement is in place. Each time a page is called up, the IONOS server automatically processes the data transmitted by your browser. These include your IP address, the date and time of access, the address called up, the page previously visited, the volume of data transferred, the status code and details of your browser and operating system. These data are stored in what are known as server log files. They serve to deliver the website, to ensure its stability and security and to fend off and investigate attacks. The legal basis is Art. 6 (1) (f) GDPR. My legitimate interest lies in providing this website in a technically faultless and secure manner. All visitors to the website are affected. The recipient of the data is IONOS as processor; no transfer to third countries takes place. The server log files are stored for a maximum of eight weeks and then deleted automatically. Providing these data is technically necessary; without them the website cannot be displayed.

4. SSL/TLS encryption

For security reasons this website uses SSL/TLS encryption. It protects the transmission of confidential content, such as the messages you send me via the contact form. You can recognise an encrypted connection by the fact that your browser's address bar begins with “https://” and shows a padlock symbol. Data you transmit to me then cannot be read by third parties.

5. Contact form and enquiries as a speaker and author

You can send me a message via the general contact form, which is available on all pages, and via the “Speaker” and “Author” enquiry forms on the home page. All three forms work in the same way. In doing so I process your first name, your surname, your email address and your message. You may voluntarily state your company, your law firm, your event, your organisation or your publishing house. For enquiries as a speaker or author, the details you select in the window are added, such as the type of event or publication, the format, the topic and the audience. These details are included as text in your message. The purpose is to handle and answer your enquiry. I also ensure that the message actually comes from the person stated and that the form is not misused. Your details are transmitted in encrypted form to my server at IONOS. The server immediately sends your message to me by email. At the same time, you receive an email via the IONOS mail server with a copy of your message and a confirmation link. This link is valid for seven days. It contains a random identification number, your name, your email address, the type of enquiry, the time of receipt and the expiry date, but not your message. These details are signed and thus protected against forgery, but they are not encrypted. Until confirmation, the server stores your name, your company or organisation, your email address, the time of receipt and your message in a directory that cannot be accessed from the internet. If you click the confirmation link, I receive a second email with your complete enquiry, and the temporarily stored file is deleted immediately. If you confirm only after the seven days have elapsed, I receive only your name, your email address and the time of receipt. To protect against misuse, the server also stores checksums for a short time from which the underlying details cannot be reconstructed. A checksum formed from your IP address, together with the times of submission, is stored for a maximum of one hour. A checksum formed from your email address, together with the times, is stored for 24 hours, as is a checksum formed from your email address and message, so that a message sent twice by mistake is processed only once. The server stores the identification numbers of links already confirmed, together with the time, for 30 days, so that a confirmation does not reach me more than once. When the form is submitted, the server also checks whether the message comes from this website, whether the domain of your email address can receive emails, whether a time-limited form key issued when the form was opened is present and whether a field invisible to humans has been left empty. It does not store the results of these checks. It rejects messages with more than three links or with HTML or forum formatting. The legal basis is Art. 6 (1) (b) GDPR insofar as your enquiry is aimed at concluding a contract or carrying out pre-contractual measures, for example in the case of an enquiry as a speaker or author. Otherwise the legal basis is Art. 6 (1) (f) GDPR. My legitimate interest lies in answering the enquiries addressed to me, in ensuring that a message actually comes from the sender stated and that no one misuses other people's names or email addresses, and in protection against mass automated sending. The persons affected are those who write to me via the forms. The recipient of the data is IONOS as processor for hosting and email dispatch. No disclosure to third parties, no use for advertising or newsletters and no transfer to third countries takes place; no cookies are set in this context. The temporarily stored message is deleted immediately after confirmation, or without confirmation after eight days at the latest. I delete the emails in my mailbox and in the mailbox from which the confirmation emails are sent as soon as your enquiry has been conclusively dealt with and no statutory retention obligations stand in the way. First name, surname, email address and message are mandatory because without them I cannot answer your enquiry. All other details are voluntary.

6. Contact by email

If you write me an email, I process your email address, your name insofar as it appears in the email, the content of your message and the date and time of receipt. The purpose is to handle and answer your enquiry. The legal basis is Art. 6 (1) (b) GDPR insofar as your enquiry is aimed at concluding a contract, otherwise Art. 6 (1) (f) GDPR. My legitimate interest lies in answering the messages addressed to me. The persons affected are those who send me an email. The recipient of the data is IONOS as processor, via whose mail server I receive and send emails. No transfer to third countries takes place. I delete the emails as soon as your enquiry has been conclusively dealt with and no statutory retention obligations stand in the way. Providing your email address is necessary so that I can reply to you.

7. AI assistant Eora

Eora is an AI assistant that answers questions about me, my experience and my topics. For this I use the AI model Claude, which is provided to me as a processor by Anthropic Ireland, Limited, 6th Floor, South Bank House, Barrow Street, Dublin 4, Ireland. Before you can ask Eora a question, the chat window asks for your consent. If you give it, my server sends the text of the current conversation to Anthropic with every question so that an answer can be generated there. Your IP address is not transmitted to Anthropic. The purpose is to give you quick information about me and my topics at any time. The legal basis is your consent pursuant to Art. 6 (1) (a) GDPR. So that Eora does not ask you for your consent again before every question, your browser stores it in the session storage (sessionStorage) of the open tab. When the tab is closed, this entry is deleted, and on a later visit Eora will ask for your consent again. The legal basis for this storage is § 25 (2) no. 2 TDDDG, because it is strictly necessary for the service you have requested. The content of your questions and of Eora's answers is processed, and thus all information you enter yourself. Please therefore do not enter any confidential, sensitive or specially protected information, such as health data or details of a legal case. For a personal concern, please use the contact form; no legal advice is provided via Eora. The persons affected are those who use Eora and those whom they mention in their questions. The recipient is Anthropic Ireland as processor. The processing itself, however, takes place on servers of the parent company Anthropic, PBC in the USA, which is engaged as a sub-processor. Your inputs are therefore transferred to the USA. As Anthropic is not certified under the EU-US Data Privacy Framework, the European Commission's adequacy decision for the USA does not apply here. The transfer therefore takes place on the basis of the EU standard contractual clauses pursuant to Art. 46 (2) (c) GDPR, which form part of the data processing agreement with Anthropic. The conversations are not stored on this website. I have no insight into the content; only the number of questions per day is counted. According to its own statements, Anthropic does not use inputs via the programming interface to train its AI models and deletes them automatically within 30 days. Anthropic stores them for longer only if inputs are flagged for a possible breach of the usage policies or if there is a statutory retention obligation. Using Eora is voluntary and not necessary for visiting this website. Without consent, Eora is simply not available. You can withdraw your consent at any time with effect for the future by closing the tab or by notifying me of your withdrawal by email to online [at] tobias-reinhardt.com or via the contact form. The lawfulness of the processing carried out up to the withdrawal remains unaffected.

8. Law Firm Quick Check and quizzes

The Law Firm Quick Check, the quizzes on the home page and the other interactive elements of this website run entirely in your browser. Your answers, your inputs and your result are transmitted neither to me nor to third parties and are not stored. The result of the Law Firm Quick Check as a PDF is also created exclusively in your browser. Beyond the retrieval of the website described in section 3, no personal data are processed in this context.

9. Visitor statistics

So that I know how often the individual pages are called up, your browser reports only the page's address to my server when a page is called up. The server then increases a counter by one for the respective day and the respective page. Only these figures are stored, neither your IP address nor details of your browser, your device or your origin. No cookies are set and no information is stored on your device or read from it. The page views therefore cannot be attributed to any person, and the statistics contain no personal data within the meaning of the GDPR. I point out this procedure voluntarily and for the sake of transparency.

10. Link to LinkedIn

On this website I refer to my personal LinkedIn profile with a simple link. No LinkedIn plugin is embedded, so no data are transmitted to LinkedIn when you call up this website. Only when you click the link do you leave this website. The privacy policy of LinkedIn Ireland Unlimited Company then applies to the processing of your data on LinkedIn.

11. Your rights

You have the right to request information about the data stored about you (Art. 15 GDPR) and to have inaccurate data corrected (Art. 16 GDPR). You can request the erasure of your data (Art. 17 GDPR) or the restriction of its processing (Art. 18 GDPR) and receive your data in a structured, commonly used and machine-readable format (Art. 20 GDPR). You can withdraw consent you have given at any time with effect for the future (Art. 7 (3) GDPR). To do so, please contact online [at] tobias-reinhardt.com or the address stated in section 2.

Right to object under Art. 21 GDPR: Insofar as I process your data on the basis of Art. 6 (1) (f) GDPR, you have the right to object at any time, on grounds relating to your particular situation, to this processing. I will then no longer process your data unless I can demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms, or the processing serves the establishment, exercise or defence of legal claims. You can send your objection informally to online [at] tobias-reinhardt.com.

12. Right to lodge a complaint with the supervisory authority

Without prejudice to other remedies, you have the right under Art. 77 GDPR to lodge a complaint with a data protection supervisory authority if you consider that the processing of your personal data infringes the GDPR. The authority responsible for me is the State Commissioner for Data Protection and Freedom of Information of North Rhine-Westphalia, Kavalleriestraße 2–4, 40213 Düsseldorf. However, you may also contact the supervisory authority of your place of residence or workplace.

13. Obligation to provide your data

You are under no statutory or contractual obligation to provide me with personal data. Only the technical data that your browser transmits when you access the website is required (section 3); without it, the website cannot be displayed. All other information, for example in the contact form, by email or in a conversation with the AI assistant Eora, is provided voluntarily. Without this information, however, I cannot answer your enquiry, or cannot answer it in full. With the Law Firm Quick Check and the quizzes, your answers remain in your browser; they are not transmitted to me or to third parties and are not stored.

14. No automated decision-making

No automated decision-making, including profiling, within the meaning of Art. 22 GDPR takes place on this website, nor through the AI assistant Eora or the Law Firm Quick Check.

15. Changes to this privacy policy

I adapt this privacy policy whenever the functions of this website, the services used or the legal requirements change. The version published here, with the date stated above, applies in each case.

Last updated: 17 October 2026