Privacy policy
Courtesy translation. The German Datenschutzerklärung is the authoritative version.
This policy explains which personal data is processed when you visit interim.henk.name. The website is deliberately lean: no cookies, no advertising, no profiling; for audience measurement I use only a cookie-free method.
1. Controller
Dr. Hartmut Henk
Schwester-Klothilde-Weg 1
53894 Mechernich, Germany
Email: interim@henk.name
Phone: +49 2443 3102293
No data protection officer has been appointed, as the legal requirements for doing so are not met.
2. Hosting and server log data
The website is delivered through Azure Static Web Apps. The provider is Microsoft Ireland Operations Limited, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, Ireland. When you access the pages, the provider processes technically necessary data transmitted by your browser: IP address, date and time of the request, requested file, amount of data transferred, referrer URL, and browser and operating system.
This processing is necessary to deliver the website and to ensure its security and stability. The legal basis is my legitimate interest in a secure and functional website (Art. 6(1)(f) GDPR). A data processing agreement under Art. 28 GDPR is in place with the provider (Microsoft Products and Services Data Protection Addendum). I have not set up any logging or analysis of requests; the provider processes log data only for operations and then deletes it.
Processing in the USA by Microsoft Corporation cannot be ruled out. Microsoft Corporation is certified under the EU-US Data Privacy Framework, so an adequacy decision of the European Commission applies to such transfers (Art. 45 GDPR). The EU Commission's standard contractual clauses apply in addition.
3. Encryption
The website is delivered exclusively over an encrypted connection (HTTPS/TLS).
4. Cookies and local storage
This website sets no cookies and uses no advertising or profiling services. Fonts and content are loaded from the site's own server or from your system. The only exception is the script for cookie-free audience measurement (section 5).
If you choose a language with the DE/EN switch, your browser stores this choice locally (localStorage) so the site appears in the same language on your next visit. This information does not leave your device. It is stored at your express request and is strictly necessary for this function (Section 25(2) no. 2 TDDDG). You can delete it at any time in your browser settings.
5. Cookie-free audience measurement with Umami
To understand which content is read, I use the Umami Cloud service of Umami Software, Inc., with data stored in the European Union. Umami sets no cookies, stores no IP addresses and builds no profiles across visits. It records the page viewed, referrer, browser, operating system, device type, screen size and the country derived from the IP address. I also count clicks on the download, email, phone and LinkedIn links. To tell visits apart, Umami creates an anonymous, regularly changing hash value; I cannot identify you from it.
The legal basis is my legitimate interest in a privacy-friendly analysis of how my website is used (Art. 6(1)(f) GDPR). Umami processes the data on my behalf; the data is deleted after six months at the latest. If "Do Not Track" is enabled in your browser, no measurement takes place. You can also object to the measurement at any time by email or block the script with a content blocker.
6. Contact by email or phone
If you contact me by email or phone, I process your details (such as name, contact data, content of the enquiry) to handle your request. The legal basis is Art. 6(1)(b) GDPR where your enquiry relates to an engagement or contract, and otherwise my legitimate interest in answering enquiries (Art. 6(1)(f) GDPR). I delete the data once it is no longer needed to handle the request and no statutory retention obligations apply (for example under Section 147 of the German Fiscal Code for business correspondence).
Contact form
The website offers a contact form (required: name and situation; optional: company, phone number, preferred callback time). The form does not transmit any data to this website's server: when you submit it, your browser merely prepares an email to interim@henk.name, which you review and send yourself in your email programme. Your details reach me only when you send it; sections on contact by email and the email service then apply.
Email service
For emails to interim@henk.name I use the Outlook.com service of Microsoft Ireland Operations Limited (address see section 2). Your message is received and stored there. The domain henk.name and its DNS records are managed at GoDaddy; GoDaddy does not process the content of your messages. For possible processing in the USA, section 2 applies.
Use of AI assistants
To handle and answer enquiries I use AI assistants, currently Claude (Anthropic) and Microsoft 365 Copilot (Microsoft). The content of your enquiry, such as your name, company and request, may be transmitted to these services to create answers, summaries or drafts. I enter only the information needed to handle the request, review every result myself, and make decisions and reply personally. The providers also process data in the USA; transfers are based on the safeguards they provide (EU standard contractual clauses or the EU-US Data Privacy Framework). The legal basis is the same as for handling your enquiry (Art. 6(1)(b) or (f) GDPR); my legitimate interest lies in efficient and careful handling. If you do not want your enquiry handled with AI support, a short note in your message is enough.
Transcription of conversations with Wispr Flow
To document and follow up conversations and online meetings (for example initial calls or coordination within an engagement) I use the transcription service Wispr Flow of Wispr AI, Inc., USA. The spoken word, short voice samples for assigning speakers and the participants' names are transmitted to the provider as audio and converted there into text and a summary. The provider in turn uses third-party AI services as sub-processors. I transcribe only if all participants have been informed beforehand and have agreed. The legal basis is your consent (Art. 6(1)(a) GDPR), which you can withdraw at any time with effect for the future. If you do not agree, the conversation takes place without transcription; this has no disadvantage for you.
According to the provider, meeting audio is deleted after seven days, while the transcript and summary are kept until deleted. I delete them once they are no longer needed for follow-up or for handling an engagement and no retention obligations apply. According to the provider, your content is used to train models only if this is explicitly enabled. Processing also takes place in the USA; a data processing agreement incorporating the EU standard contractual clauses covers the transfer. I may process transcripts further with the assistants named under "Use of AI assistants", for example into meeting notes and tasks; what is stated there applies.
7. Downloading the interim profile
When you download the interim profile (PDF), the log data described in section 2 is processed; Umami counts the download anonymously (section 5). No registration or data entry is required.
8. Links to LinkedIn
The website contains simple links to my LinkedIn profile. Data is transmitted only when you click such a link. LinkedIn Ireland Unlimited Company's privacy terms then apply.
9. Your rights
You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18) and data portability (Art. 20). Where processing is based on legitimate interests, you may object at any time on grounds relating to your particular situation (Art. 21 GDPR). A message to the email address above is sufficient.
You also have the right to lodge a complaint with a data protection supervisory authority. The competent authority is the State Commissioner for Data Protection and Freedom of Information of North Rhine-Westphalia (Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen), Kavalleriestraße 2–4, 40213 Düsseldorf, Germany.
10. No automated decision-making
No automated decision-making, including profiling, takes place.
Last updated: November 2026