DE +49 8022 85 99 18 0 Enquire now

Privacy policy

This English version is provided for convenience. The German version is legally binding.

Last updated: 11 October 2026. This policy explains in plain language what data is generated when you visit www.hierat.de, what we use it for and what rights you have.

1. Controller

Hierat GmbH
represented by the managing director Thomas Hierat
Am Talfeld 1
83703 Gmund am Tegernsee
Phone: +49 8022 85 99 18 0
Email: info@hierat.de

Please send any questions about data protection to this address. No data protection officer has been appointed, as the legal requirements for this are not met.

2. The key points in brief

  • When you open the site, our hosting provider IONOS processes technical access data (Section 3).
  • Data you enter in the enquiry form is used only to answer your enquiry (Section 5).
  • Measurement and advertising (Google Ads, Microsoft Clarity) only run if you agree in the consent window. Without your consent, none of this is loaded (Section 6).
  • Fonts, images and scripts are stored on our own server. Maps, Facebook, Instagram and YouTube are only included as links (Section 7).

3. Hosting and access data

This website is hosted by IONOS SE, Elgendorfer Straße 57, 56410 Montabaur. When a page is opened, IONOS stores server log files on our behalf: the file requested, date and time, the amount of data transferred, browser and operating system, the previously visited page (referrer) and the IP address in anonymised form. The log files are deleted after eight weeks. No data is transferred to countries outside the EU. We have a data processing agreement with IONOS under Art. 28 GDPR.

The legal basis is Art. 6(1)(f) GDPR. Our legitimate interest is the secure and trouble-free operation of the website.

The connection to this website is encrypted (TLS, shown by the padlock in the address bar).

4. Cookies and browser storage

Without your consent, we only set what is technically necessary (Section 25(2) no. 2 of the German Telecommunications Digital Services Data Protection Act (TDDDG)):

  • site_csrf: a cookie containing a random string, set when you open a page with an enquiry form. It protects the form against automated submissions and is deleted when you close your browser.
  • hierat-einwilligung: your decision in the consent window, saved in your browser's local storage so that the window does not appear again on every visit.
  • rezToastZu: if you close the note about our Google reviews, your browser remembers this until you close the tab.

All other cookies come from Google or Microsoft and are only set after you have given your consent (Section 6). You can change or withdraw your consent at any time via the “Cookie settings” link at the bottom of the page; we then delete the Google and Microsoft cookies stored under our address.

5. Enquiry form, email and phone

If you use the enquiry form, we process your name, your phone number and, if provided, your email address, the location of the project, the service selected and your message. We use these details to call you back and answer your enquiry. The enquiry is sent as an email via the mail servers of our hosting provider IONOS to our mailbox info@hierat.de, which is operated by Microsoft (Microsoft 365). If you have provided an email address, you will receive an automatic confirmation of receipt that does not contain the text of your message.

If you reached the website via an advert, the form also transmits the campaign details from the address you opened (for example utm_source or the click identifier gclid) so that we can attribute where the enquiry came from. These details are not stored in your browser. To protect against misuse, we log rejected submissions with the time, a shortened IP address and the reason for rejection; this log is continuously overwritten.

The legal basis is Art. 6(1)(b) GDPR (steps prior to entering into a contract) and otherwise Art. 6(1)(f) GDPR (handling enquiries). We keep the data until your enquiry has been dealt with and no statutory retention obligations remain; if a contract is placed, for the duration of the retention periods under commercial and tax law.

The same applies if you contact us by email, phone or fax: we store your details to deal with your request and do not pass them on without your consent.

Applications: If you apply via the form or by email, we process your details to carry out the application process (Art. 6(1)(b) GDPR, Section 26 of the German Federal Data Protection Act (BDSG)). If no employment results, we delete the documents no later than six months after the process has ended, unless you agree to a longer retention period.

6. Measurement and advertising, only with your consent

On your first visit we ask whether we may use Google Ads and Microsoft Clarity. Both services are only loaded after you have agreed. The legal basis in both cases is your consent (Art. 6(1)(a) GDPR and Section 25(1) TDDDG), which you can withdraw at any time via “Cookie settings” at the bottom of the page. Withdrawal takes effect for the future.

Google Ads conversion measurement

We run adverts on Google. To measure which adverts lead to enquiries, Google sets cookies after you have given your consent (including _gcl_aw, lifetime 90 days) and learns when you submit the form or open the contact page after clicking on an advert. We only see totals, never individuals. We do not use personalised advertising on other websites (remarketing). The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Data may be transferred to Google LLC in the USA; Google is certified under the EU-US Data Privacy Framework. Google processes the data as an independent controller. Further information: https://policies.google.com/privacy and https://business.safety.google/privacy/.

Microsoft Clarity

Clarity shows us in anonymised form how visitors use the site: mouse movements, clicks, scrolling, and the heatmaps and session recordings created from them. Entries in form fields are not recorded but masked. After you have given your consent, Clarity sets cookies that link page views into a session (_clck, _clsk) as well as Microsoft's own cookies (CLID, ANONCHK, MR, MUID, SM). Without your consent, Clarity is not loaded. The provider is Microsoft Ireland Operations Limited, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, Ireland. Data may be transferred to Microsoft Corporation in the USA; Microsoft is certified under the EU-US Data Privacy Framework. Session recordings are deleted by Clarity after 30 days. Further information: https://privacy.microsoft.com/privacystatement.

7. External links

Links to Google Maps (directions and reviews), Facebook, Instagram and YouTube lead to the pages of the respective providers. Only when you click on such a link does the provider process your data under its own rules. No maps, videos or social media elements are embedded on our website.

8. Your rights

  • Access (Art. 15 GDPR) to the data we hold about you.
  • Rectification (Art. 16) and erasure (Art. 17), provided no retention obligations stand in the way.
  • Restriction of processing (Art. 18) and data portability (Art. 20).
  • Withdrawal of consent you have given (Art. 7(3)), with effect for the future.
  • Objection (Art. 21): where we process data on the basis of a legitimate interest, you can object at any time on grounds relating to your particular situation. You can object to direct marketing without giving reasons.
  • Complaint to a data protection supervisory authority. The authority responsible for us is the Bayerisches Landesamt für Datenschutzaufsicht (Bavarian State Office for Data Protection Supervision), Promenade 18, 91522 Ansbach, www.lda.bayern.de.

To exercise your rights, an email to info@hierat.de is all it takes.

9. Disclosure and retention

We only pass on personal data if this is necessary to carry out a contract (for example to partner businesses involved), if we are legally obliged to do so or if you have given your consent. Service providers working on our behalf (hosting, email) are contractually bound by our instructions. Unless stated otherwise above, we delete data as soon as the purpose no longer applies and no statutory retention obligation remains.

10. Changes

We update this policy when the website or the legal situation changes. The version published here applies.

Call Enquire now