Privacy policy
Updated 12/09/2026
Transparency and trust matter to us. This page sets out how Haidl & Fast UG (haftungsbeschränkt) handles your personal data.
This is a courtesy translation. Only theGerman version is legally binding.
Alexander Fast Haidl & Fast UG (haftungsbeschränkt), Leopoldsreuterstraße 10, 94145 Haidmühle, Germany
Phone: +49 (0) 8550 2399973
Email: info@haidlfast.com
For data protection matters and to exercise your rights as a data subject, you can reach us at:
Email: info@haidlfast.com
Phone: +49 (0) 8550 2399973
The following overview summarises the types of data we process and the purposes for which we process them.
Types of data processed:
- Contact data
- Content data
- Contract data
- Usage data
- Meta, communication and procedural data
- Consent (Art. 6(1)(a) GDPR)
- Performance of a contract and pre-contractual enquiries (Art. 6(1)(b) GDPR)
- Legitimate interests (Art. 6(1)(f) GDPR)
In line with the statutory requirements we take appropriate technical and organisational measures to ensure a level of protection appropriate to the risk.
Under the GDPR you have the following rights:
- Access (Art. 15 GDPR): to the data we hold about you
- Rectification (Art. 16 GDPR): of inaccurate or incomplete data
- Erasure (Art. 17 GDPR): where no retention obligations apply
- Restriction of processing (Art. 18 GDPR)
- Data portability (Art. 20 GDPR): in a common, machine-readable format
- Withdrawal of consent given (Art. 7(3) GDPR): with effect for the future
An informal message to info@haidlfast.com is enough to exercise them.
Right to object under Art. 21 GDPR
You have the right to object at any time, on grounds relating to your particular situation, to the processing of personal data concerning you that is carried out on the basis of Art. 6(1)(e) or (f) GDPR. Where your data is processed for direct marketing purposes, you may object at any time without giving reasons.
We store personal data only for as long as it is required for the relevant purposes, or for as long as statutory retention periods apply.
- Server log files: generally 14 days, then deleted automatically
- Contact enquiries: deleted once the matter has been finally dealt with, unless retention obligations apply
- Contract and business records: 6 or 10 years under Section 257 HGB and Section 147 AO
- Consents (cookie banner): 12 months, after which you are asked again
Under Art. 77 GDPR you have the right to lodge a complaint with a data protection supervisory authority. The authority responsible for us is:
Bayerisches Landesamt für Datenschutzaufsicht (BayLDA)
Promenade 27, 91522 Ansbach, Germany
Phone: +49 (0) 981 53 1300
Providing personal data is required neither by law nor by contract. Without the details marked as mandatory in the contact form, however, we cannot deal with your enquiry.
No automated decision-making, including profiling, within the meaning of Art. 22 GDPR takes place.
We process users' data in order to make our online services available to them. This includes in particular the IP address, the time of access, the volume of data transferred, the browser type and version, the operating system and the previously visited page (server log files).
Hosting is provided by Vercel Inc., 440 N Barranca Avenue #4133, Covina, CA 91723, USA as a processor on the basis of a data processing agreement pursuant to Art. 28 GDPR.
Delivery runs through Vercel's global content delivery network, so personal data may be transferred to the USA and other third countries. Vercel is certified under the EU-U.S. Data Privacy Framework; an adequacy decision of the European Commission covers the adequacy of the level of protection. In addition, Vercel has entered into the EU standard contractual clauses pursuant to Art. 46(2)(c) GDPR.
The legal basis is Art. 6(1)(f) GDPR (legitimate interest in providing our online offering securely and efficiently). More information: vercel.com/legal/privacy-policy.
The content of this website is managed and delivered through the headless CMS Sanity. The providers are Sanity AS, Trondheimsveien 2K, 0560 Oslo, Norway (org. no. 918 714 529) and Sanity US Inc.
When content and images are retrieved through Sanity's servers (including cdn.sanity.io), your IP address is transmitted to Sanity and processed there in server log files. Because the data may also be processed in the USA, Sanity has entered into the EU standard contractual clauses pursuant to Art. 46(2)(c) GDPR for this purpose. Norway is part of the EEA, so the GDPR applies directly.
The legal basis is Art. 6(1)(f) GDPR (legitimate interest in maintaining and delivering our content efficiently). More information: sanity.io/legal/privacy.
When you contact us, the details provided by the enquiring person are processed to the extent necessary to answer the enquiry.
To send the emails triggered by our contact forms we use the Resend service of Plus Five Five, Inc., 2261 Market Street #5039, San Francisco, CA 94114, USA. The data you enter in the form (including name, email address, phone number and message content) is transmitted to Resend and processed there for the purpose of delivery.
A data processing agreement pursuant to Art. 28 GDPR is in place. The transfer to the USA takes place on the basis of the EU standard contractual clauses pursuant to Art. 46(2)(c) GDPR.
The legal basis is Art. 6(1)(b) GDPR (taking steps prior to entering into a contract) or Art. 6(1)(f) GDPR (legitimate interest in answering enquiries). More information: resend.com/legal/privacy-policy.
You can also reach us via the WhatsApp messaging service. The provider for users in the EU is WhatsApp Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland. Contacting us via WhatsApp is voluntary; you can always reach us by phone, email or through the contact form instead.
When you message us on WhatsApp, we process your phone number, your WhatsApp name and the content of your messages in order to answer your enquiry. Message content is end-to-end encrypted; WhatsApp does, however, receive metadata (e.g. sender, recipient, time) and may transfer it to its parent company Meta Platforms, Inc. in the USA. Meta is certified under the EU-US Data Privacy Framework (adequacy decision pursuant to Art. 45 GDPR).
The legal basis is Art. 6(1)(b) GDPR (taking steps prior to entering into a contract) or Art. 6(1)(f) GDPR (legitimate interest in fast communication through the channel you have chosen). More information: whatsapp.com/legal/privacy-policy-eea.
To arrange consultation appointments we embed the Calendly service of Calendly, LLC, 115 E Main St., Ste A1B, Buford, GA 30518, USA. The EU representative under Art. 27 GDPR is DPO Centre Europe, Friedrichstraße 88, Excellent Business Centre, 10117 Berlin, Germany (eurep@calendly.com).
The booking window is only loaded once you actively click a button to arrange an appointment; without that click no connection to Calendly is made. Your IP address and the appointment and contact details you enter are then transmitted to Calendly and processed in the USA. The transfer is based on the EU standard contractual clauses pursuant to Art. 46(2)(c) GDPR.
The legal basis is Art. 6(1)(a) GDPR (consent, given by clicking the button) or Art. 6(1)(b) GDPR (taking steps prior to entering into a contract). More information: calendly.com/legal/privacy-notice.
We use Google Analytics to measure and analyse the use of our online offering on the basis of a pseudonymous user identification number. The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland; the parent company is Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA.
Google Analytics is loaded only after your express consent. The IP address is truncated (IP anonymisation). A transfer to the USA cannot be ruled out; Google LLC is certified under the EU-U.S. Data Privacy Framework, and the EU standard contractual clauses apply in addition.
The legal basis is Art. 6(1)(a) GDPR (consent) together with Section 25(1) TDDDG for storing information on your device. You can withdraw your consent at any time with effect for the future through the cookie settings. More information: policies.google.com/privacy.
Where you have consented, we use Google Ads from Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland to measure the effectiveness of our advertising (conversion tracking). Cookies are set and usage data is transmitted to Google in the process.
The legal basis is Art. 6(1)(a) GDPR (consent) together with Section 25(1) TDDDG. You can withdraw consent at any time through the cookie settings. For third-country transfers, the information under "Web analytics" applies.
To measure the reach and loading performance of our website we use Vercel Web Analytics and Vercel Speed Insights from Vercel Inc., 440 N Barranca Avenue #4133, Covina, CA 91723, USA.
These services work without cookies and without cross-device recognition. Only aggregated, pseudonymised data is collected (including the page visited, referrer, device type, country and technical performance figures); the IP address is not stored permanently. This means we cannot identify individual people.
The legal basis is Art. 6(1)(f) GDPR (legitimate interest in the statistical evaluation and technical optimisation of our online offering). For third-country transfers, the information under "Provision of the online offering and web hosting" applies.
Please check the content of our privacy policy regularly. We adapt the privacy policy as soon as changes to the processing we carry out make this necessary.