Privacy Policy

The controller responsible for processing personal data on this website is:

Personal data means information relating to an identified or identifiable person, such as a name, email address or IP address. This notice explains our purposes, legal bases, recipients and your rights when using this website.

Processing is subject to the General Data Protection Regulation (GDPR). Storing information on or accessing information from your device is also subject to Germany's Telecommunications Digital Services Data Protection Act (TDDDG). Providing contact details is not a statutory or contractual requirement, but we cannot answer your inquiry without the necessary information.

The website is hosted by Vercel Inc., 440 N Barranca Avenue #4133, Covina, CA 91723, USA. Delivering pages involves technical connection information, which may include your IP address, requested URL, browser and device information, referrer, date and time. Hosting may also generate operational and security logs.

The purposes are reliable delivery, troubleshooting and abuse prevention. The legal basis is Article 6(1)(f) GDPR, reflecting our legitimate interest in a secure, functioning website. Vercel operates international infrastructure, so processing outside the European Economic Area (EEA), particularly in the USA, is possible. See Vercel's privacy notice.

Our first-party consent manager stores your category choices, timestamp, notice version and configured service identifiers in your browser's localStorage under “main-digital-consent”. A choice is valid for at most 180 days. We ask again if it expires, storage is cleared or the configured identifiers change. Blocked storage prevents persistent saving.

Storing the choice is necessary to manage the privacy preferences you request (section 25(2)(2) TDDDG). Related personal-data processing relies on our legitimate interest in implementing and respecting your choice under Article 6(1)(f) GDPR.

Statistics and Marketing are off on a first visit. You can accept all, reject all or choose settings voluntarily. Optional services load only after consent to their category, under section 25(1) TDDDG and Article 6(1)(a) GDPR. Contact inquiries do not require tracking consent.

Use “Cookie-Einstellungen” in the footer to change or withdraw consent. A page reload stops previously loaded trackers and removes accessible first-party tracking cookies. Unsaved form entries are lost on reload; where a draft exists, the settings offer an explicit clipboard copy before you withdraw. Copying is optional and is not required for withdrawal. Data already processed by providers and third-party cookies cannot be recalled by this interface. Withdrawal does not affect the lawfulness of earlier processing.

With Statistics consent, we use Google Analytics 4, provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, to measure pageviews and website usage. This can involve online identifiers, browser and device information, timestamps, usage events and network information. An IP address is technically required for transmission; Google states that GA4 does not log or store it.

Our explicit Google page parameters omit query strings and URL fragments. Google may use “_ga” cookies. We configure a 180-day lifetime without renewal on later visits; provider event retention is separate and depends on account settings. Our integration does not grant Google Signals or advertising-personalization signals.

The legal bases are Article 6(1)(a) GDPR and section 25(1) TDDDG. No Google script or pre-consent measurement ping is sent without Statistics consent. Withdraw using “Cookie-Einstellungen”. Processing by Google companies in the USA is possible. See Google's privacy policy.

The form processes your name, email address and project message. Service choices and budget are optional. We use these details to answer inquiries, clarify requirements and prepare quotations. Contract-related and precontractual inquiries rely on Article 6(1)(b) GDPR; other business inquiries rely on Article 6(1)(f), reflecting our legitimate interest in communicating with prospective clients.

Our server uses Brevo (Sendinblue SAS, 106 boulevard Haussmann, 75008 Paris, France) exclusively for transactional delivery of contact inquiries. Name, email, chosen services, budget and message are included in the email; your address is used as the reply-to address. Once Brevo accepts the inquiry, we also send an automatic receipt confirmation using a Brevo transactional template to the email address entered in the form. Brevo also processes delivery metadata and logs. According to the account configuration reported by the operator, transactional logs are retained for one month and saving new email previews is disabled. This setting does not automatically delete existing older previews or other copies. Our application does not create Brevo marketing contacts or use Brevo for newsletters. See Brevo's privacy information.

The required acknowledgement confirms that you have read the privacy notice. It is not marketing consent, tracking consent or a blanket legal basis for processing.

Our business mailbox info@main-solutions.de is provided through IONOS Mail Basic by IONOS SE, Elgendorfer Straße 57, 56410 Montabaur, Germany. Incoming contact inquiries and business correspondence are handled and stored in this mailbox. We use IONOS Webmail for communication.

Processing includes names, email addresses, message contents, project-inquiry details and technical communication metadata. Messages sent directly by email may also contain attachments. The purposes are answering inquiries, preparing quotations, precontractual communication and contract performance.

Precontractual and contract-related inquiries rely on Article 6(1)(b) GDPR. Other business communication relies on Article 6(1)(f), reflecting our legitimate interest in handling business matters. Storage required by statutory retention obligations relies on Article 6(1)(c). Retention and deletion criteria are described below. See IONOS's privacy information.

The form uses a hidden honeypot field and server-side request limits. The IP address forwarded by the host is temporarily used as an in-memory counter key on the server instance. The window is ten minutes; expired entries are removed on subsequent requests or when the instance ends. No external CAPTCHA or additional browser cookies are used.

The legal basis is Article 6(1)(f) GDPR: our legitimate interest in preventing spam and misuse. Our application does not log message contents for this purpose.

Recipients include Vercel, Brevo and IONOS for hosting and communication, plus the Statistics/Marketing providers described here if you consent. Mail servers participating in delivery also process communication data. Processing is not confined to the mailbox: Brevo and the host also process the data needed for transmission and operation.

Vercel operates international infrastructure, so processing outside the EEA, particularly in the USA, is possible. Other providers depend on their actual subprocessors and access arrangements. International transfers are subject to Articles 44 et seq. GDPR. Contact info@main-solutions.de for information about the recipients relevant to your data and, where applicable, a copy of the safeguards used.

For inquiries that do not result in a business relationship and are not subject to statutory retention obligations, our deletion policy provides for deletion six months after the last substantive communication. This is an internal operational policy, not a statutory deadline. An unsuccessful quotation is not automatically exempt from legal retention requirements.

Records must be classified according to their actual contents and purpose. Where section 147 of the German Fiscal Code (AO), or section 257 of the Commercial Code (HGB) where applicable, requires retention, business correspondence is generally retained for six years, accounting vouchers for eight years and the specified books, financial statements and other qualifying accounting records for ten years. These periods generally start at the end of the relevant calendar year. Applicable extensions and other legal requirements take priority.

Active inquiries and negotiations are kept for as long as their handling requires. Client records are classified separately for contract performance, correspondence and statutory obligations. Additional retention for the establishment, exercise or defence of legal claims requires a specific, proportionate justification; a single blanket period does not apply to all client information. Legal bases, as applicable, are Article 6(1)(b), (c) and (f) GDPR.

Our deletion procedure provides for a monthly manual review of open and closed inquiries and relevant IONOS mailbox folders. Before deleting an eligible inquiry, its last substantive communication, any statutory retention requirement and any specific legal hold must be checked; existing copies must be considered separately. This procedure does not itself create automatic deletion in IONOS or Brevo. Storage of hosting logs, delivery logs, previews and provider backups also depends on the service and account configuration; the reported Brevo settings are described above.

Your local privacy choice is valid for at most 180 days. The application's short-term abuse limit uses the ten-minute window described above. Requests about your particular data or its deletion can be sent to info@main-solutions.de.

Subject to the statutory conditions, you have rights of access (Article 15 GDPR), rectification (16), erasure (17), restriction (18) and data portability (20). You may withdraw consent for the future at any time under Article 7(3). Contact info@main-solutions.de.

Right to object: You may object to processing based on Article 6(1)(f) on grounds relating to your particular situation (Article 21(1)). You can object to direct marketing at any time (Article 21(2)).

You may complain to a supervisory authority under Article 77, particularly where you live or work or where an alleged infringement occurred. Our competent authority is the Bayerisches Landesamt für Datenschutzaufsicht, Promenade 18, 91522 Ansbach, Germany: www.lda.bayern.de.

The public site is intended to run over HTTPS. The contact endpoint checks inputs and request origin, limits body size and keeps email delivery credentials on the server. Please provide only what is needed for your inquiry and avoid submitting sensitive information unnecessarily.

Revision: 20 October 2026. We update this notice when processing activities or applicable requirements change.