Privacy policy

Controller

Frank Bosch Frank Bosch Financial Consulting Höllstraße 4, 78333 Stockach, Germany Phone: +49 (0)7771 921339 Email: mail@bosch-consulting.de

No data protection officer has been appointed, as there is no legal obligation to do so.

Overview

This is a static website. It sets no cookies, uses no third-party tracking services and embeds no third-party content (such as maps, videos or fonts from external servers). Fonts are served from our own server. For a simple, cookie-free audience measurement on our own server, see "Audience measurement without cookies".

Links to Google Maps and to my profiles on Instagram, Facebook and LinkedIn are simple links. Data is only transmitted to these providers when you click the link; their privacy policies then apply.

Hosting and server log files

The website is hosted by IONOS SE, Elgendorfer Str. 57, 56410 Montabaur, Germany. When the website is accessed, the host automatically processes information in server log files: IP address, date and time, page accessed, data volume transferred, browser type and version, operating system and referrer URL. This data serves to ensure trouble-free operation and system security; the legal basis is my legitimate interest (Art. 6 (1) (f) GDPR).

A data processing agreement is in place with IONOS (Art. 28 GDPR). The log files are only stored for as long as necessary for these purposes and are then deleted or anonymised by IONOS. They are only kept longer while a specific security incident needs to be investigated.

Audience measurement without cookies

To find out which pages are read and how visitors find the website, I count page views with a small script of my own. When a page is accessed, your browser transmits to my web server at IONOS: the page accessed, the language version and – only on entry – the name of the website you came from (e.g. google.com). The browser identifier, which is transmitted anyway, is only used to derive whether you are using a smartphone, tablet or desktop computer.

Only monthly totals are stored (e.g. "Real estate page: 120 views, source Google: 80"). No cookies are set, no information is stored on your device, no identifiers are assigned and no usage profiles are created; individual visits cannot be traced. To protect against manipulation, your IP address is stored briefly in encrypted (hashed) form and is usually deleted automatically after about one hour. No other service providers are involved.

The legal basis is my legitimate interest in evaluating and improving my website (Art. 6 (1) (f) GDPR). If your browser sends a "Do Not Track" or "Global Privacy Control" signal, no counting takes place. You can also object to the processing at any time (see "Right to object").

Contact form

If you use the contact form, your details (name, email address, phone number, topic, message) are transmitted in encrypted form to a script on my web server at IONOS and passed from there via the Microsoft 365 interface as an email to my mailbox (see "Email mailbox"). The content is not stored on the web server. No other service providers are involved.

The legal basis is Art. 6 (1) (b) GDPR insofar as your request is aimed at advice or a contract, otherwise my legitimate interest in answering enquiries (Art. 6 (1) (f) GDPR).

To protect against misuse (automated mass requests), your IP address is stored briefly on the web server in encrypted (hashed) form and is usually deleted automatically after about one hour (Art. 6 (1) (f) GDPR).

Your request is deleted once it has been dealt with and no statutory retention obligations apply.

E-book download

If you request my e-book "Private Equity", I process your name, your email address and – if provided – your phone number in order to provide the e-book and to document the request. As with the contact form, the data is transmitted via the script on my web server by email to my mailbox. The legal basis is Art. 6 (1) (b) GDPR. I will not approach you for advertising purposes without your express consent.

If you also tick the box "I would like to be contacted", you will receive an email with a confirmation link (double opt-in). Until confirmation, name, email address, phone number, time and wording of the consent are stored on the web server. After 72 hours the confirmation link expires and the data is deleted automatically. Only after your confirmation do I use your details to approach you about private equity. The legal basis is your consent (Art. 6 (1) (a) GDPR).

I keep the time of the request, the time of confirmation and the wording of the consent as proof of consent (Art. 7 (1) in conjunction with Art. 6 (1) (f) GDPR).

Consent is voluntary, not required for the download and can be withdrawn at any time with effect for the future, e.g. by email to mail@bosch-consulting.de. Your data is deleted as soon as it is no longer required for these purposes or you withdraw your consent, unless statutory retention obligations apply.

Contact by email or phone

If you contact me by email or phone, your details are stored for the purpose of handling the request and in case of follow-up questions (Art. 6 (1) (b) and (f) GDPR). The section "Storage period" applies.

My profiles on social networks

I maintain profiles on Facebook and Instagram (Meta Platforms Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland) and on LinkedIn (LinkedIn Ireland Unlimited Company, Wilton Place, Dublin 2, Ireland). The website only links to these profiles. If you visit a profile or interact with me there, the operators process your data in accordance with their own privacy policies, including by means of cookies and possibly also in the USA. Meta and LinkedIn are certified under the EU-US Data Privacy Framework.

For the page statistics ("Insights") of my Facebook page and Instagram profile, I am jointly responsible with Meta (Art. 26 GDPR). In an agreement, Meta has assumed primary responsibility for this processing and for fulfilling your rights: www.facebook.com/legal/terms/page_controller_addendum. I only receive aggregated, anonymous statistics.

The legal basis for my profiles is my legitimate interest in contemporary communication with prospective and existing clients (Art. 6 (1) (f) GDPR). If you send me a message there, I process it in order to reply (Art. 6 (1) (b) or (f) GDPR). You can exercise your rights most effectively directly with the respective operator, but you can of course also contact me at any time.

Privacy policies of the operators: www.facebook.com/privacy/policy, privacycenter.instagram.com/policy, www.linkedin.com/legal/privacy-policy.

Storage period

I only store personal data for as long as is necessary for the respective purpose. Enquiries that do not lead to a business relationship are kept for as long as they are needed for handling, possible follow-up questions or the defence of any claims; they are then deleted as part of a regular review. At your request I will delete your data earlier at any time, unless statutory obligations prevent this.

If your enquiry leads to advice or a contract, the statutory retention periods apply: six years for business correspondence and ten years for accounting records (§ 257 HGB, § 147 AO), as well as the professional retention obligations for intermediaries. Each period begins at the end of the calendar year. The data is then deleted.

Email mailbox (Microsoft 365)

My email mailbox, which also receives the messages from the forms, is operated via Microsoft 365 of Microsoft Ireland Operations Limited, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, Ireland. Microsoft processes the data as a processor on the basis of the Microsoft Products and Services Data Protection Addendum (Art. 28 GDPR).

A transfer to Microsoft Corporation in the USA cannot be ruled out. Microsoft is certified under the EU-US Data Privacy Framework (adequacy decision of the EU Commission, Art. 45 GDPR); standard contractual clauses also apply (Art. 46 GDPR).

Obligation to provide data

Providing your data is neither legally nor contractually required. Without the details marked as mandatory, however, I cannot process your request or provide the e-book. There is no automated decision-making, including profiling.

Your rights

You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18) and data portability (Art. 20 GDPR). You may withdraw consent at any time with effect for the future (Art. 7 (3) GDPR); this does not affect the lawfulness of processing carried out before withdrawal.

You also have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR). The competent authority is: Der Landesbeauftragte für den Datenschutz und die Informationsfreiheit Baden-Württemberg, Lautenschlagerstraße 20, 70173 Stuttgart, Germany, www.baden-wuerttemberg.datenschutz.de.

Right to object (Art. 21 GDPR)

Where I process your data on the basis of my legitimate interest (Art. 6 (1) (f) GDPR), you may object to this processing at any time on grounds relating to your particular situation. I will then no longer process your data unless I can demonstrate compelling legitimate grounds that override your interests, or the processing serves the establishment, exercise or defence of legal claims.

You may object to the processing of your data for direct marketing purposes at any time without giving reasons. An informal note to mail@bosch-consulting.de is sufficient.

Encryption

For security reasons this website uses TLS encryption (https). Data you transmit to me cannot be read by third parties.

Version

This privacy policy is dated September 2026.