Privacy Policy

This English version is a translation provided for convenience only. In the event of any discrepancy between the two versions, the German text of this page is the legally binding one.

This privacy policy describes which personal data is processed when you visit carstenschmider.com, for what purpose and on what legal basis. It names only those services that are actually in use on this website.

Last updated: 26 August 2026

Controller

Carsten Schmider Media Relations Publishing
Schöffenstraße 17
D-50321 Brühl, Germany

Authorised representative: Carsten Schmider
E-mail: info@carstenschmider.com
Telephone: +49 176 702 44 313
VAT identification number: DE 289191140

No data protection officer has been appointed; the statutory conditions of § 38 BDSG do not apply.

Overview

This website uses a web host in Germany, a newsletter delivery service in Germany, two measurement services for audience and advertising effectiveness that collect data only after you have consented, and a contact form. No social media plugins or embedded third-party content are used. Typefaces are served from our own server, not from an external one.

Legal bases

We process personal data on the following bases under the GDPR:

• Consent (Art. 6 (1) (a) GDPR) — for the newsletter and for audience measurement.
• Performance of a contract and pre-contractual enquiries (Art. 6 (1) (b) GDPR) — for answering enquiries.
• Legal obligation (Art. 6 (1) (c) GDPR) — for statutory retention periods.
• Legitimate interests (Art. 6 (1) (f) GDPR) — for the technically secure operation of the website.

For the storing of information on your device and the reading of information from it, § 25 TDDDG applies in addition.

Provision of the website and server log files

The website runs on a server operated by Hetzner Online GmbH, Industriestraße 25, 91710 Gunzenhausen, in a data centre in Germany. The database runs on the same server; no content is passed to third parties in the process. A data processing agreement under Art. 28 GDPR is in place with Hetzner.

Each time the site is accessed, technically necessary data is processed: IP address, date and time, the address requested, the volume of data transferred, browser type and operating system, and the previously visited page. This processing is necessary in order to deliver the page and to fend off attacks; the legal basis is Art. 6 (1) (f) GDPR. The logs are deleted after 30 days at the latest, unless they are required to investigate a specific incident.

The connection is encrypted throughout by TLS, recognisable by the https:// in the address bar.

Typefaces

The typefaces used are downloaded when the website is built and are served from our own server. Visiting the site therefore establishes no connection to Google Fonts or any other external font service, and no IP address is transmitted there.

Getting in touch

If you write to us through the contact form or by e-mail, we process your name, your e-mail address and the content of your message in order to answer your enquiry. The legal basis is Art. 6 (1) (b) GDPR for contract-related enquiries and otherwise Art. 6 (1) (f) GDPR. We delete the data once the enquiry has been dealt with conclusively and no statutory retention obligation stands in the way.

Newsletter

The newsletter is sent only with your express consent (Art. 6 (1) (a) GDPR, § 7 (2) no. 3 UWG). Your e-mail address is all that is required to subscribe.

Double opt-in. After you subscribe you receive an e-mail containing a confirmation link. Only once you click that link do we add you to the distribution list. This means nobody can enter somebody else’s address. To evidence your consent we store the time of the subscription, the time of the confirmation and the IP address used.

Delivery service. For delivery we use rapidmail, rapidmail GmbH, Augustinerplatz 2, 79098 Freiburg im Breisgau, Germany. rapidmail processes the data on our behalf on servers in Germany; a data processing agreement under Art. 28 GDPR is in place. Privacy policy: https://www.rapidmail.de/datenschutz

Withdrawal. You may withdraw your consent at any time. Every newsletter contains an unsubscribe link for that purpose; alternatively a message to info@carstenschmider.com is sufficient. After you unsubscribe we keep your address on a suppression list for up to three years, solely in order to evidence the consent given at the time and to prevent you being contacted again (Art. 6 (1) (f) GDPR).

Audience measurement with Google Analytics

To evaluate visitor numbers we use Google Analytics 4, a service provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland.

Consent. Measurement takes place only if you have agreed to it in the consent banner. Before you agree, all storage categories are set to “denied”: no cookies are set and no identifiers are stored. The legal basis is Art. 6 (1) (a) GDPR and § 25 (1) TDDDG.

What is collected. Once you have agreed, the pages you visit, time spent, approximate location, device type, browser and the referring page are processed, linked to a pseudonymous identifier held in the cookies _ga and _ga_EGYY0PSJYS. Their lifetime is up to 24 months. Google truncates the IP address before storing it.

Note on the United States. Google may transfer data to Google LLC in the United States. Google LLC is certified under the EU-US Data Privacy Framework; the transfer is based on the European Commission’s adequacy decision of 10 July 2023 and, in addition, on standard contractual clauses. We point out that US authorities may under certain conditions gain access to such data.

Withdrawal. You can change your consent at any time through the consent banner. Google’s privacy policy: https://policies.google.com/privacy

Advertising measurement with Google Ads

To measure and target advertisements we use Google Ads, likewise a service of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland.

Consent. Google Ads shares the loading of gtag.js with Google Analytics and is subject to the same settings: before you consent in the consent banner all storage categories are set to „denied“, no cookies are set and no identifiers are stored. The legal basis is Art. 6(1)(a) GDPR and § 25(1) TDDDG.

What is collected. After your consent, we record whether you reached this website via one of our advertisements and whether you then perform one of the measured actions: a newsletter sign-up or copying a securities identifier on a campaign page. This allows an action to be attributed to an advertisement. The attribution uses the events already collected by Google Analytics; no additional tracking pixel is embedded.

Enhanced conversions. When a newsletter sign-up takes place, the Google tag additionally transmits the email address you entered to Google Ads so that the sign-up can be attributed to an ad click. To that end the address is converted into a hash value using SHA-256 in your browser; it does not leave your device in plain text, and the address cannot be reconstructed from the hash. This transmission likewise requires your consent: it is tied to the „ad_user_data“ category, which is set to „denied“ until you consent in the consent banner.

Note on the United States. The same applies as for Google Analytics: Google may transfer data to Google LLC in the United States, relying on the adequacy decision on the EU-US Data Privacy Framework and, in addition, on standard contractual clauses.

Withdrawal. You can change your consent at any time with effect for the future via the consent banner.

Advertising measurement with the Meta pixel

To measure the effectiveness of advertisements we use the Meta pixel, a service of Meta Platforms Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland.

Consent. The pixel is loaded only once you have consented in the consent banner. As long as you have neither consented nor declined, Meta’s script is not loaded, no connection to Meta’s servers is established and no cookies are set. The legal basis is Art. 6(1)(a) GDPR and § 25(1) TDDDG.

What is collected. After your consent, your IP address, information about your browser and device, the pages you visit and the time of access are processed. In addition, individual events are recorded: „Lead“ when you submit the sign-up form; „CompleteRegistration“ when you complete the sign-up via the link in the confirmation email; and „KennungKopiert“ when you use the copy button for a securities identifier on a campaign page — the identifier in question (WKN or ISIN) is transmitted with it. The cookie _fbp is also set, with a lifetime of 90 days.

Joint controllership. For the collection and transmission of data by means of the pixel, we and Meta are joint controllers pursuant to Art. 26 GDPR. The essence of the arrangement between us is available at https://www.facebook.com/legal/controller_addendum. Under it, we are responsible for informing users and for obtaining consent, and Meta is responsible for the subsequent processing under its own responsibility. You may assert data subject rights regarding the data held by Meta directly against Meta; Meta has assumed sole responsibility for this. You may also contact us and we will forward your request.

Note on the United States. Meta also processes data in the United States. The transfer relies on the European Commission’s adequacy decision on the EU-US Data Privacy Framework and, in addition, on standard contractual clauses. We point out that US authorities may under certain conditions gain access to such data.

Withdrawal. You can change your consent at any time with effect for the future via the consent banner. Meta’s privacy policy: https://www.facebook.com/privacy/policy

No social media plugins. Beyond the pixel described above, this website embeds no buttons or content from social networks. No videos, maps or other content are loaded from external servers. References to social networks are plain links; only when you click one do you leave this website.

Recipients of data

The recipients are the service providers named above: Hetzner Online GmbH (hosting), rapidmail GmbH (newsletter delivery), Google Ireland Limited (audience measurement and advertising measurement with Google Ads) and Meta Platforms Ireland Limited, Dublin, Ireland (advertising measurement by means of the Meta pixel, only where consent has been given; joint controllership pursuant to Art. 26 GDPR).

Apart from the processors named above, we pass on personal data only where you have consented, where we are legally obliged to do so, or where it is necessary to enforce our rights. Data is not sold.

Your rights

You have the right of access (Art. 15 GDPR), to rectification (Art. 16), to erasure (Art. 17), to restriction of processing (Art. 18), to data portability (Art. 20) and to object to processing based on legitimate interests (Art. 21). You may withdraw consent once given at any time with effect for the future (Art. 7 (3) GDPR).

Please contact info@carstenschmider.com to exercise these rights.

Independently of this, you have the right to lodge a complaint with a supervisory authority (Art. 77 GDPR). The authority responsible for us is the State Commissioner for Data Protection and Freedom of Information of North Rhine-Westphalia, Kavalleriestraße 2–4, 40213 Düsseldorf, Germany.

Changes

We will amend this privacy policy whenever the processing changes — for instance because a service is added or discontinued. The version published on this page at any given time is the one that applies.