Privacy Policy

How we process personal data when you visit or contact German Sherpa India.

1. Controller and contact

The controller responsible for the processing described in this policy is:

Marcel Plum · German Sherpa
Bardenberger Straße 56
52146 Würselen
Germany
Email: marcel.plum@germansherpa.com
Telephone: +49 151 27727722

For questions about personal data or requests to exercise your rights, please use the above email address.

2. Who this policy covers

This policy applies to www.germansherpa.in, an editorial information portal for people in India preparing to move, study or work in Germany. This website does not provide insurance brokerage, financial product distribution, immigration legal services or job placement. Separate financial consulting for eligible residents earning income in Germany is described at GermanSherpa.com; its own privacy notice applies to processing on that website.

3. Website hosting and server logs

Our website is hosted through united-domains GmbH, Gautinger Straße 10, 82319 Starnberg, Germany. United Domains states that its webspace is hosted in Germany. According to the provider’s published information for its webspace product, its infrastructure involves IONOS SE and potentially further service providers. For details, please see United Domains’ privacy information and information about its webspace services.

When you visit our website, connection data may be processed to provide the requested content, maintain availability and security, and investigate technical problems. Such data may include IP address, requested domain or URL, time of access, request method, referrer, browser-related information and server response information. United Domains states that it retains certain Apache access log data (destination domain, IP address, date/time, request method and referrer) for 14 days for security purposes.

Legal basis: Article 6(1)(f) GDPR (our legitimate interest in a secure and reliable website); Article 6(1)(b) GDPR may additionally apply where processing is required to provide a specifically requested service.

The stated 14-day retention relates to the specified Apache access logs; other technical logs may follow different retention periods.

4. Cookies and consent management (Complianz)

We use Complianz to administer visitor choices concerning non-essential technologies. Strictly necessary technologies may be used to provide the website and remember your privacy choices. Optional statistics technologies such as Google Analytics must not be activated without the required consent. The technical configuration is still being checked.

Legal basis: Article 6(1)(c) GDPR where needed to demonstrate compliance with legal obligations, Article 6(1)(f) GDPR for necessary website functionality where applicable, and Article 6(1)(a) GDPR for consent-based services. Storage of or access to information on your device is also subject to Section 25 TDDDG and its exceptions.

Where the consent banner and preferences control are available, you can refuse non-essential cookies or change or withdraw consent through those controls. Withdrawing consent does not affect the lawfulness of processing before withdrawal.

Before publication: Finish the Complianz wizard, publish its Cookie Policy, add a visible “Cookie Settings” link/button, and verify the actual consent implementation. A banner by itself does not establish that Google Analytics is correctly blocked. This statement must match the final tested setup.

5. Google Analytics 4 (GA4) and Google Site Kit

We use Google Site Kit within WordPress to manage Google services. Google Analytics 4 (GA4) helps us understand aggregated site usage, for example which pages are visited, interactions and general traffic patterns. Depending on the configuration, technical information such as device/browser properties, approximate location, pseudonymous identifiers and website interaction data may be processed by Google.

Provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland; relevant group entities and subprocessors may be involved. Information on Google’s handling of data is available at Google’s partner-sites information and Google Privacy Policy.

Legal basis for optional analytics: your consent under Article 6(1)(a) GDPR and, where relevant, Section 25(1) TDDDG. Analytics consent may be withdrawn using the site’s cookie preferences.

International transfers: Google services may involve access to data outside the EEA. The applicable transfer safeguards, including any adequacy mechanism or contractual safeguards, must be verified against the actual Google contractual setup.

Analytics settings to verify: GA4 measurement ID and property, retention period for event/user-level data, Google Signals / advertising features, cross-domain measurement, IP/data-sharing settings, Google’s data-processing terms and Consent Mode behaviour. If Consent Mode sends consent-denied pings before acceptance, describe that actual data flow accurately rather than stating that no requests are made before consent.

6. Google Search Console and Site Kit administration

Google Search Console and other administrative tools made available through Site Kit help us monitor search performance and maintain the website. These administration tools do not necessarily place tracking cookies on public visitors merely because the plugin is installed. We assess each enabled public-facing Google feature separately.

7. Contact by email

When you contact us via email or by selecting a mailto link, we process the information you send, such as your name, email address, message and any voluntarily provided details, to respond to your enquiry and manage subsequent correspondence.

Legal basis: Article 6(1)(b) GDPR where necessary to take steps at your request before entering into a contract, or Article 6(1)(f) GDPR for ordinary enquiries and communications. Where a legal retention duty applies, Article 6(1)(c) GDPR may also apply.

We do not ask website visitors to submit passports, client financial records or other sensitive documents via the general contact route. Please avoid sending unnecessary sensitive information.

8. External websites, images and video links

Our articles contain links to official external resources, GermanSherpa.com and video content, including links to YouTube. If you click an external link, the receiving website is responsible for its own data processing. A normal link is different from an embedded video: embedded players may transfer data when the page loads.

Important: Our currently prepared pages use ordinary links to YouTube. Embedded players or other third-party elements must be assessed individually. If embeds, Google Fonts from third-party servers, maps, social media widgets or other external services are added, this policy and the consent configuration must be updated.

9. Recipients, processors and transfers

Personal data may be handled by service providers necessary for hosting, website maintenance, email and consent management, and by Google for the specifically enabled services. Processing agreements under Article 28 GDPR must be checked and concluded where legally required.

Providers outside the EEA may receive or access data in circumstances governed by GDPR Chapter V; applicable safeguards must be reviewed for the actual providers. We do not claim that all website data remains exclusively in Germany.

10. Retention and deletion

We retain personal information only for as long as necessary for the relevant purpose and any applicable legal retention periods. Website logs, consent records, analytics information and emails can have different retention periods.

Must complete: [VERIFY: any additional hosting or application logs beyond the 14-day Apache access logs described above, Complianz consent record lifetime, GA4 event-level data retention, email deletion policy and statutory recordkeeping periods]. Do not publish specific periods without confirming the real configuration.

11. Your GDPR rights

Subject to applicable legal requirements, you may request access to your personal data (Article 15), rectification (Article 16), erasure (Article 17), restriction (Article 18), data portability (Article 20), and object to processing based on legitimate interests (Article 21). You may withdraw consent at any time (Article 7(3)). You also have the right to lodge a complaint with a competent supervisory authority (Article 77).

For our establishment in North Rhine-Westphalia, the competent regional supervisory authority will generally be the Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen (LDI NRW); you may also contact another competent supervisory authority.

12. Security, children and automated decisions

Appropriate technical and organisational measures should protect the website and communications, although no internet transmission is completely risk-free. This website provides general information and is not designed to collect personal data from children. The basic email contact channel is not intended for automated decision-making producing legal or similarly significant effects.

13. Changes to this policy

We update this policy when our services, tools or legal obligations change. Last updated: 9 October 2026.