Privacy policy.

1. Controller

The controller within the meaning of the General Data Protection Regulation (GDPR) is:

2. General information

Personal data means any information relating to an identified or identifiable natural person. We process personal data only where permitted by law and only to the extent necessary to provide this website, respond to enquiries, protect our systems and present our business services.

Depending on the specific processing operation, the legal basis is:

• Article 6(1)(a) GDPR for processing based on consent;
• Article 6(1)(b) GDPR for pre-contractual measures or performance of a contract;
• Article 6(1)(c) GDPR for compliance with legal obligations; or
• Article 6(1)(f) GDPR for our legitimate interests in operating a secure, functional and informative company website.

Where information is stored on or read from your terminal device, § 25 TDDDG applies in addition. Consent is required unless the operation is strictly necessary to provide a digital service expressly requested by you.

3. Hosting and server log files

When this website is accessed, the web server or hosting provider may automatically process technical connection data. This may include the IP address, date and time of access, requested file or page, amount of data transferred, referrer URL, browser type and version, operating system and access status.

Processing is necessary to deliver the website, ensure stability, detect misuse and maintain information security. The legal basis is Article 6(1)(f) GDPR. Recipients may include hosting, maintenance and IT security providers acting on our behalf. Log data is erased when it is no longer required for these purposes, unless longer storage is required to investigate a security incident or comply with law.

Hosting provider

This website is hosted by IONOS SE, Elgendorfer Straße 57, 56410 Montabaur, Germany. When you visit the website, IONOS records server log files including your IP address. IONOS processes this data on our behalf; we have concluded a data processing agreement with IONOS as required by Article 28 GDPR, under which IONOS may process our visitors’ personal data only on our instructions. The legal basis for using IONOS is Article 6(1)(f) GDPR and our legitimate interest in a reliable and secure presentation of this website. Further information is available in the IONOS privacy policy.

4. Contact by email, telephone or form

If you contact us, we process the information you provide, such as your name, company, email address, telephone number, message and project details, in order to deal with your enquiry.

The script that handles the form is served from our own server, so no third party is contacted merely by opening the page. Only when you actually submit the form are the survey request and the entered data transmitted to Formspree, Inc., which provides the technical form-processing service on our behalf. Formspree receives the entered form data and technical connection data needed to process, protect against spam, store and deliver the submission to us. Further information is available in the Formspree Privacy Policy and on its security page.

For enquiries concerning a contract or potential assignment, the legal basis is Article 6(1)(b) GDPR. For other business communication, the legal basis is Article 6(1)(f) GDPR. We retain correspondence only as long as needed for the enquiry and any subsequent business relationship, subject to statutory commercial and tax retention obligations.

5. External services and embedded content

Google Fonts (local hosting)

This website uses the typefaces DM Sans and Oswald from Google Fonts to ensure a consistent presentation. These fonts are hosted locally on our own server and are loaded from there. No connection to servers operated by Google is established when you visit this website, and no data is transmitted to Google for this purpose. Further information on Google Fonts is available at https://developers.google.com/fonts/faq.

Google Maps

The About Us section can display a Google Maps map, a service of Google Ireland Limited. The map is not loaded automatically. It remains blocked behind a placeholder until you actively click to load it. Only then does your browser connect to Google, which may receive your IP address, browser and device data, the page viewed and interaction data. Google may store or access cookies and associate the information with a Google account if you are signed in. The map is used to display our headquarters. The legal basis is your consent under Article 6(1)(a) GDPR and § 25(1) TDDDG. You can withdraw your consent at any time with effect for the future under Consent settings below.

SociableKIT and LinkedIn

The Recent Assignments section can display a LinkedIn Page Posts widget supplied by SociableKIT showing current public posts from the COS LinkedIn company page. The widget is not loaded automatically. It remains blocked behind a placeholder until you actively click to load it. Only then are connections to SociableKIT established, which may also load content from LinkedIn. Technical usage data such as IP address, browser and device data, timestamps, referrer information and interactions may then be processed. Cookies or comparable technologies may also be used by these providers.

SociableKIT acts as the technical widget provider. LinkedIn services in the EEA are provided by LinkedIn Ireland Unlimited Company, Wilton Plaza, Wilton Place, Dublin 2, Ireland. The legal basis is your consent under Article 6(1)(a) GDPR and § 25(1) TDDDG. You can withdraw your consent at any time with effect for the future under Consent settings below. See the SociableKIT Privacy Policy and the LinkedIn Privacy Policy.

Google Ads

We advertise our surveying services with Google Ads, a service of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. So that we can see whether an advertisement actually led to an enquiry, this website can use the Google advertising tag AW-18435624526. The tag is not loaded automatically. For as long as you have not consented, no request is sent to a Google server and no advertising cookie is stored. Only once you consent does your browser load the tag from googletagmanager.com. Google may then store or read cookies on your device — for example _gcl_au, which holds an advertising click identifier for up to 90 days — and process your IP address, browser and device data, the pages you view and the actions you take on them. If you are signed in to a Google account, Google may associate this information with that account.

We use Google Consent Mode v2. Your choice is passed to the tag as the signals ad_storage, ad_user_data and ad_personalization. Until you consent, each of them is set to denied and no tag is loaded at all. analytics_storage remains denied permanently, because this website uses no web analytics product. If you withdraw your consent, the signals are set back to denied with immediate effect, the advertising cookies stored on this domain are deleted, and the tag is no longer loaded on subsequent page views.

The purpose of the processing is to measure the success of our advertising. The legal basis is your consent under Article 6(1)(a) GDPR and § 25(1) TDDDG. Giving consent is voluntary; it is not a condition of using this website or of contacting us. You can withdraw your consent at any time with effect for the future under Consent settings below. Further information is available in the Google Privacy Policy and under How Google uses cookies in advertising.

Consent settings

External services are blocked by default. Here you can see which of them you have allowed on this device and withdraw that permission at any time. A withdrawal takes effect for future page views and does not affect the lawfulness of processing carried out before it.

Your choice, together with the time at which you made it, is stored locally in your browser (localStorage, key cos-consent) so that we can honour it on your next visit. This storage is strictly necessary to provide the service you requested and is therefore covered by § 25(2) no. 2 TDDDG. It is not transmitted to us or to any third party. Clearing your browser storage resets all services to blocked.

6. International data transfers

Google, LinkedIn, SociableKIT, Formspree or their subprocessors may process personal data outside the European Economic Area, including in the United States or other countries whose level of data protection may differ from that of the EU. Where required, providers rely on an adequacy decision such as the EU-US Data Privacy Framework or appropriate safeguards such as the European Commission’s Standard Contractual Clauses. Formspree states that it relies on Standard Contractual Clauses when acting as a data processor. Residual risks, including access by foreign public authorities, cannot be completely excluded.

7. Storage periods

We retain personal data only for as long as necessary for the relevant purpose. We then erase or anonymise it unless statutory retention periods apply, evidence must be preserved for the establishment, exercise or defence of legal claims, or continued processing is otherwise permitted by law. Commercial correspondence may be subject to retention obligations under German commercial and tax law.

8. Your data protection rights

Subject to the statutory conditions, you have the right to:

• obtain access to your personal data under Article 15 GDPR;
• request rectification under Article 16 GDPR;
• request erasure under Article 17 GDPR;
• request restriction of processing under Article 18 GDPR;
• receive data in a portable format under Article 20 GDPR;
• object to processing based on legitimate interests under Article 21 GDPR; and
• withdraw consent at any time with effect for the future under Article 7(3) GDPR.

Where processing is based on Article 6(1)(f) GDPR, you may object on grounds relating to your particular situation. We will then cease processing unless compelling legitimate grounds override your interests, rights and freedoms, or processing is required for legal claims.

To exercise your rights, contact info@cos-partner.com. We may need to verify your identity before responding.

9. Right to lodge a complaint

You may lodge a complaint with a data protection supervisory authority. The authority responsible for private-sector organisations established in Lower Saxony is:

10. Changes to this policy

We may update this privacy policy when the website, service providers or legal requirements change. The version published on this page applies. Last updated: 11 August 2026.