Imprint

Information pursuant to Section 5 of the German Digital Services Act (Digitale-Dienste-Gesetz – DDG).

Contact

Email: alex.fenkiw@gmail.com

Responsible for editorial content

Responsible pursuant to Section 18(2) of the German State Media Treaty (Medienstaatsvertrag – MStV):

Alexander Thiele, address as stated above.

Liability for content and links

The content of this website is prepared with care and is intended for general educational purposes. It does not constitute legal, certification, audit, or professional advice. Despite careful review, no guarantee is given that content is complete, current, or suitable for a particular organization.

This website may contain links to external websites. The respective providers are responsible for their content. If an infringement becomes known, the relevant link will be reviewed and removed where appropriate.

Intellectual property

Unless otherwise indicated, content created for this website is protected by applicable copyright law. Reproduction, adaptation, distribution, or commercial use beyond statutory permissions requires prior authorization. ISO and ISO/IEC designations are trademarks or protected identifiers of their respective owners. This website is independent and is not affiliated with or endorsed by ISO or another standards organization.

Privacy Policy

Last updated: 5 September 2026

1. Controller

The controller responsible for processing personal data on this website is:

2. General information

Personal data means information relating to an identified or identifiable person. This Privacy Policy explains what data is processed when you visit this website, use the ISO 27001 assessment, download resources, or contact the website operator.

3. Hosting and server logs

This website is hosted by IONOS SE, Elgendorfer Str. 57, 56410 Montabaur, Germany. When the website is accessed, the hosting infrastructure may process server log data such as IP address, date and time, requested page or file, referrer, browser, operating system, response status, and transferred data volume.

The processing is necessary to deliver the website, maintain security, diagnose faults, and prevent misuse. The legal basis is Article 6(1)(f) GDPR. The legitimate interests are secure and reliable website operation. Log data is deleted or anonymized when it is no longer required for these purposes, unless longer retention is necessary to investigate a security event or comply with a legal obligation.

Further information: IONOS Privacy Policy.

4. Cookies, local storage and consent management

This website uses technically necessary storage technologies to provide requested functions, maintain security, and remember privacy choices. Where access to or storage of information on your device is strictly necessary, it is based on Section 25(2) of the German Telecommunications Digital Services Data Protection Act (TDDDG). Related personal-data processing is based on Article 6(1)(f) GDPR or, where required to provide a requested service, Article 6(1)(b) GDPR.

Optional technologies, including optional statistics functions, are used only where the required consent has been obtained. The legal bases are Section 25(1) TDDDG and Article 6(1)(a) GDPR. You may withdraw consent at any time with effect for the future through the “Manage consent” control on the website.

The consent-management component stores your choices so that they can be respected and documented. This is necessary to meet data-protection obligations and is based on Article 6(1)(c) GDPR and Article 6(1)(f) GDPR.

5. Website statistics

Subject to your consent where legally required, this website may use a statistics function provided in connection with the WordPress/Jetpack environment. This can process information such as shortened or full IP address, visited page, referrer, date and time, browser and device information, approximate location, and interactions with the website. The purpose is to understand aggregated website usage and improve content and performance.

The provider involved may be Automattic Inc., 60 29th Street #343, San Francisco, CA 94110, USA, together with its relevant group companies. Processing outside the European Economic Area may occur. Where required, such transfers must be protected by an applicable adequacy decision or safeguards under Article 46 GDPR. The legal basis for optional statistics is Article 6(1)(a) GDPR. Consent may be withdrawn through the consent settings.

Further information: Automattic Privacy Notice.

6. ISO 27001 assessment and Proof of Competence

When you voluntarily take the ISO 27001 assessment, the website processes the information entered in the assessment and the generated result. Depending on the fields presented, this may include your name, email address, answers, score, completion status, date and time, and technical information required to operate and protect the assessment.

The data is used to conduct the assessment, calculate the result, prevent misuse, and generate a downloadable Proof of Competence. The legal basis is Article 6(1)(b) GDPR where processing is necessary to provide the service requested by you. Where a specific consent is requested for an additional purpose, the legal basis is Article 6(1)(a) GDPR.

Assessment information is retained only while it is required to provide and document the requested service, respond to related requests, protect the service against misuse, or comply with applicable obligations. It is then deleted or anonymized unless continued storage is legally permitted or required.

7. Free downloads

Policy templates and other resources can be downloaded without creating a user account. The technical request for a file is recorded in the server logs described above. If download statistics are measured using an optional analytics function, this takes place in accordance with Section 5 and the applicable consent choice.

8. Contact by email

If you contact the website operator by email, the submitted information is processed to handle and respond to your request. The legal basis is Article 6(1)(b) GDPR where your message relates to steps before entering into an agreement or an existing service relationship. In other cases, it is Article 6(1)(f) GDPR, based on the legitimate interest in answering correspondence. Communication is deleted when it is no longer required, subject to statutory retention duties and the need to establish, exercise, or defend legal claims.

9. Recipients and processors

Personal data is disclosed only where this is necessary for the purposes described in this Privacy Policy, permitted by law, based on consent, or required by a legal obligation. Recipients may include hosting and technical service providers, providers supporting website security and statistics, professional advisers, and public authorities where legally required. Service providers acting as processors are contractually bound in accordance with Article 28 GDPR where applicable.

10. International data transfers

Some technical providers may process data outside the European Economic Area. Where this occurs, the transfer is based on an adequacy decision under Article 45 GDPR or appropriate safeguards under Article 46 GDPR, such as the European Commission’s standard contractual clauses, unless a statutory exception applies. Information about relevant providers is included in the sections above.

11. Retention

Personal data is retained only for as long as necessary for the respective purpose. The applicable period is determined by the purpose, security requirements, limitation periods, legal retention obligations, and whether consent has been withdrawn or an objection has been made. Data is deleted or anonymized when no legal basis for continued processing remains.

12. Your rights

Subject to the conditions of the GDPR, you may have the following rights:

• access to your personal data (Article 15 GDPR);
• rectification of inaccurate data (Article 16 GDPR);
• erasure (Article 17 GDPR);
• restriction of processing (Article 18 GDPR);
• data portability (Article 20 GDPR);
• objection to processing based on Article 6(1)(e) or (f) GDPR (Article 21 GDPR); and
• withdrawal of consent at any time with effect for the future (Article 7(3) GDPR).

To exercise your rights, contact alex.fenkiw@gmail.com. You also have the right to lodge a complaint with a supervisory authority. The competent authority for a private-sector controller in Bavaria is generally the Bavarian State Office for Data Protection Supervision (BayLDA), Promenade 18, 91522 Ansbach, Germany: www.lda.bayern.de.

13. Right to object

14. Security

Appropriate technical and organizational measures are used to protect personal data against accidental or unlawful destruction, loss, alteration, unauthorized disclosure, and unauthorized access. Data transmitted between your browser and this website is protected using TLS encryption. No internet transmission or storage method can guarantee absolute security.

15. Automated decision-making

The assessment automatically calculates a score and completion result based on the answers provided. This result does not produce legal effects or similarly significantly affect you within the meaning of Article 22 GDPR. No other solely automated decision-making with such effects is used through this website.

16. Changes to this Privacy Policy

This Privacy Policy may be updated when the website, processing activities, or legal requirements change. The version published on this page applies.