Privacy Policy

Last updated: 20 October 2026

This privacy policy explains how personal data is processed when you visit rh-itsec.com, use the associated security blog or contact us.

1. Controller

2. Hosting and server log files

When you access this website, the hosting provider may automatically process technical connection data. This can include the IP address, date and time of access, requested page or file, referrer URL, browser type, operating system and access status.

This processing is necessary to deliver the website, maintain technical stability and detect misuse or attacks. The legal basis is Article 6(1)(f) GDPR. The legitimate interests are the secure and reliable operation of the website. Log data is deleted when it is no longer required for these purposes, unless an identified security incident or a legal obligation requires longer retention.

3. Contact form and email

If you contact us using the contact form or by email, we process the information you provide, in particular your name, email address and message, in order to respond to your request. The contact form sends the information by email and does not itself create a separate database record.

Depending on the nature of your request, the legal basis is Article 6(1)(b) GDPR for pre-contractual or contractual communication or Article 6(1)(f) GDPR for other enquiries. The legitimate interest is responding to requests addressed to us. The data is deleted when the enquiry has been conclusively handled, subject to statutory retention obligations or the establishment, exercise or defence of legal claims.

4. Blog comments

If you submit a comment, WordPress processes the data entered in the comment form as well as technical information such as the IP address and browser user agent. This information is used to display and administer comments, prevent abuse and moderate spam. Your chosen display name and comment may be published; your email address is not published.

The legal basis is Article 6(1)(f) GDPR. The legitimate interests are enabling discussion, protecting the blog against misuse and maintaining the integrity of published content. Comments remain stored for as long as the associated discussion and article are maintained, unless you request deletion and no overriding legal grounds require continued storage.

5. Avatars and Gravatar

The blog can display profile images through the Gravatar service operated by Automattic Inc. When a page containing an avatar is loaded, your browser may connect to Gravatar servers. In connection with comments, a cryptographic hash derived from the email address may be used to check whether a Gravatar exists. The service provider can receive technical data such as the IP address, browser information and the requested image.

The legal basis is Article 6(1)(f) GDPR. The legitimate interest is a consistent and user-friendly presentation of authors and discussions. Processing by Automattic may involve data transfers outside the European Economic Area under the safeguards applicable to the service. Further information is available in the Automattic Privacy Policy.

6. Cookies and local storage

The static home, imprint and privacy pages do not intentionally set non-essential cookies. WordPress may use technically necessary cookies for administrative login, security and basic operation. If you choose the corresponding option when commenting, WordPress can store your name and email address in convenience cookies so that you do not have to enter them again for a later comment.

Technically necessary storage or access is based on Section 25(2) TDDDG and, where personal data is processed, Article 6(1)(f) GDPR. Optional comment convenience cookies are used only following your selection.

7. Recipients and service providers

Personal data may be processed by service providers that support website hosting and email delivery. These providers receive only the data required for their respective task and process it under the applicable data protection requirements. Data is otherwise disclosed only where required by law, necessary for legal claims or expressly authorised by you.

8. External links

This website contains links to external websites. No data is transmitted to the linked provider merely because a standard text link is displayed. When you follow an external link, the destination provider processes data under its own responsibility and privacy policy.

9. Your rights

Subject to the statutory requirements, you have the right to:

• request access to your personal data (Article 15 GDPR);
• request rectification of inaccurate data (Article 16 GDPR);
• request erasure or restriction of processing (Articles 17 and 18 GDPR);
• receive data you provided in a portable format where Article 20 GDPR applies;
• object to processing based on legitimate interests (Article 21 GDPR); and
• withdraw consent at any time for the future where processing is based on consent.

You also have the right to lodge a complaint with a data protection supervisory authority. The authority responsible for the controller is:

10. Security and changes to this policy

Appropriate technical and organisational measures are used to protect personal data against accidental or unlawful loss, alteration, disclosure or access. This policy may be updated when website functions, service providers or legal requirements change. The current version is published on this page.