Privacy notice

Controller

Ingenieurbüro Dr. Thomas Bischof
Eichendorffstr. 2
76676 Graben-Neudorf
Germany
E-mail: info@acoustics-consulting.com

The short version

This website sets no cookies, loads no fonts, scripts, maps or videos from third-party servers, and contains no analytics or tracking of any kind. Nothing you do here is measured. Two things do process data: the web server log, and the contact form if you choose to use it. Signing in to our analysis platform and our training courses at login.acoustics-consulting.com follows its own rules; they are set out in the section “User account and sign-in”.

Language selection

When you open the address without a language prefix, the language preference your browser sends with the request (the Accept-Language header) decides whether you are forwarded to the German or the English version. That header is evaluated for this one decision and not stored; your IP address is not used for it. Both language versions remain reachable directly, and the switch in the header overrides the choice at any time.

Server log files

Each request is recorded by the web server in a log file: IP address, date and time, the page requested, HTTP status, referrer and browser identification. The legal basis is Art. 6 (1) (f) GDPR; the legitimate interest is operating the site securely and diagnosing faults. Log entries are deleted after seven days. This data is not merged with other sources and is not used to identify individuals.

Contact form

If you send an enquiry, the data you enter — name, e-mail address, and optionally company, subject, the kind of enquiry and your answers to its questions, together with your message — is transmitted to us by e-mail and stored in our mailbox. For an enquiry about training, expertise or analysis, your answers are also attached to the e-mail as an HTML file. The "Save as file" button creates that file in your browser only; nothing is sent to us. It is used solely to process your enquiry. The legal basis is Art. 6 (1) (b) GDPR where the enquiry concerns a contract or its preparation, otherwise Art. 6 (1) (f) GDPR together with your consent under Art. 6 (1) (a) GDPR. The form is protected against automated submissions by a hidden field and a submission-rate limit; no captcha service is used, so no data is passed to a third party for this purpose. Enquiries that do not lead to a collaboration are deleted at the latest twelve months after the last contact. Where an enquiry leads to an engagement, the correspondence falls under the statutory retention periods of six and ten years under German commercial and tax law (§ 257 HGB, § 147 AO) and is deleted once those expire.

User account and sign-in (login.acoustics-consulting.com, analysis platform, training)

You sign in to our analysis platform and our online training courses at login.acoustics-consulting.com. This sign-in service is run by the same controller on the same server as this website (see “Hosting”); requests appear in the server log as described above and are deleted after seven days. There is no public access: every account is reviewed and approved by an administrator after registration.

For your account we store your name, e-mail address, your password solely as a hash, the reason given in your registration request, the time of approval, and the roles assigned to you and, where applicable, your company.

Two-factor authentication is mandatory for every approved account, including training participants. For this we store a TOTP key, in encrypted form. It is sent to you by e-mail as a QR code on approval so that you can add it to your authenticator app.

When you sign in, we create a session: a session token together with the IP address and browser identification (user agent) with which the session was started. A session is valid for seven days. Only technically necessary cookies are set for this, valid for the domain acoustics-consulting.com and its subdomains: the session cookie (HTTP-only, valid for seven days, shared by the analysis platform and the training courses), a cookie for the intermediate step of two-factor sign-in, and “auth_return” (HTTP-only, valid for ten minutes, on login.acoustics-consulting.com only), which keeps the return address across the two-factor step. No cookies are used for tracking, analytics or advertising. The legal basis for these cookies is § 25 (2) no. 2 TDDDG (German Telecommunications Digital Services Data Protection Act) and Art. 6 (1) (b) GDPR; no consent is required.

If you register through the link to a training course, we store the address you should return to afterwards until your account is approved; the activation e-mail links to that address, after which it is deleted.

In connection with your account we send e-mails: a link to confirm your e-mail address (valid for 24 hours), on request a link to reset your password (valid for 60 minutes), confirmations to the old and the new address when you change your e-mail address, and the activation e-mail after approval. The administrators are notified of a new registration and after a password reset. The e-mails are sent through the mail server of STRATO GmbH, which receives your name and e-mail address.

For the training courses we additionally store your enrolments (which course, enrolled until when, by whom and when it was entered), which version of the terms of use you accepted and when, and the active device. Only one device can be used per account; for this the training platform sets the cookie “tr_device” (HTTP-only, valid for one year, on training.acoustics-consulting.com only) and stores its device ID, the browser identification and the time of last use. Another device is admitted only once the previous one has been idle for ten minutes. Every slide, video and PDF carries your name and e-mail address as a visible watermark. Each opening of a slide deck is logged with time, course, deck, IP address and browser identification; the log serves to investigate unauthorised distribution, is accessible to administrators only and is deleted twelve months after your enrolment ends. Enrolments, device and acceptance of the terms of use are deleted together with your account.

An administrator can reserve access to a course for an e-mail address before an account exists for it, and invite you by e-mail. We store the e-mail address, the course, the end of access, the validity of the invitation (30 days), who sent the invitation and when it was sent. As soon as an account with this confirmed e-mail address exists, the reservation becomes an enrolment and is deleted; an invitation that is not taken up is deleted once its validity has expired.

Certain actions, including sign-ins, are recorded in an activity log that is deleted automatically after six months. Incomplete registrations — the e-mail address was not confirmed or the account was not approved — are deleted automatically after 30 days, including the reason given. We delete the data of an approved account at your request unless statutory retention obligations prevent this.

The legal basis for the account, sign-in, access to training, the terms of use, the device binding and invitations is Art. 6 (1) (b) GDPR; for the cookie “tr_device” additionally § 25 (2) no. 2 TDDDG, as binding to one device is part of the licence of use. Two-factor authentication, the activity and access logs, the watermark and the notification of administrators are based on Art. 6 (1) (f) GDPR; the legitimate interest is secure operation and protecting accounts against unauthorised access.

Hosting

This website and the sign-in service are hosted on a server of STRATO GmbH, Otto-Ostrowski-Straße 7, 10249 Berlin, Germany, in a data centre in Germany. The provider processes the data described above on our behalf as a processor under Art. 28 GDPR.

Your rights

You have the right of access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and objection (Art. 21). Where processing is based on consent, you may withdraw it at any time with effect for the future. You also have the right to lodge a complaint with a supervisory authority, in particular in the Member State of your residence, place of work or the place of the alleged infringement.

Encryption

All traffic to this site is encrypted with TLS. Requests to the unencrypted address are redirected automatically.