Privacy policy

1. Controller

The controller responsible for processing personal data on this website under the General Data Protection Regulation (GDPR) is:

A data protection officer is not required by law and has not been appointed.

2. Overview

• We use no cookies or similar technologies.
• We use no analytics, tracking or advertising services.
• Fonts, images and scripts are loaded only from our own server. Visiting the website does not send any data to third parties such as Google.
• We only process personal data when you contact us or book a call, and to the extent technically necessary for hosting.

3. Hosting and server logs

This website is hosted on a server we operate at Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany. The server is located in a data centre in Nuremberg, Germany.

To deliver the website to you, the server has to process your IP address for technical reasons. However, we do not store your IP address in the access logs (server log files). Only the following is recorded:

• date and time of access
• page or file requested, status code and amount of data transferred
• referrer URL (the page visited before)
• browser and operating system used

Only in the event of technical errors or attacks may an error log contain the IP address of the request concerned.

This data is technically required to deliver the website and to ensure its stability and security. The legal basis is Art. 6 (1) (f) GDPR; our legitimate interest is the secure and error-free operation of the website. Logs are not combined with other data sources and are deleted automatically after no more than 7 days, unless longer retention is necessary to investigate a specific security incident.

We have a data processing agreement with Hetzner under Art. 28 GDPR. Processing takes place exclusively in Germany.

4. Encryption

For security reasons, this website uses SSL/TLS encryption. You can recognise an encrypted connection by "https://" and the padlock symbol in your browser's address bar.

5. Contact by email and form

If you contact us by email, we process the data you send (such as name, company, email address and the content of your message) in order to answer your enquiry.

The contact form on this website does not send any data to our server. When you submit it, your own email app opens with a pre-filled message, which you send yourself. The same information therefore applies as for a normal email.

The legal basis is Art. 6 (1) (b) GDPR where your enquiry relates to entering into or performing a contract, and otherwise Art. 6 (1) (f) GDPR; our legitimate interest is answering your enquiry.

For our business email we use Microsoft 365, provided by Microsoft Ireland Operations Limited, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, Ireland. Microsoft processes the data as a processor under an agreement pursuant to Art. 28 GDPR. A transfer to the USA cannot be ruled out; Microsoft is certified under the EU-US Data Privacy Framework, for which the EU Commission has issued an adequacy decision (Art. 45 GDPR).

We delete your enquiry once it has been fully dealt with, unless statutory retention obligations apply (in particular commercial and tax retention periods of six or ten years).

6. Booking a call via Microsoft Bookings

To book a free sparring call, we link to Microsoft Bookings, a service of Microsoft Ireland Operations Limited (address above). Only when you click the booking link do you leave this website and open Microsoft's booking page.

There we process the data you enter when booking (usually name, email address, possibly phone number and notes) and the chosen time slot, in order to plan and hold the call. Microsoft processes this data on our behalf under Art. 28 GDPR; in addition, Microsoft collects technical data such as your IP address when you open the booking page. The EU-US Data Privacy Framework applies to any transfer to the USA.

The legal basis is Art. 6 (1) (b) GDPR (pre-contractual measures at your request). For more information, see Microsoft's privacy statement.

7. Links to LinkedIn

This website contains simple links to LinkedIn profiles. These are not embedded plugins: no data is sent to LinkedIn when you visit our website. Only when you click a link are you taken to the website of LinkedIn Ireland Unlimited Company, Wilton Plaza, Wilton Place, Dublin 2, Ireland, where LinkedIn's privacy policy applies.

8. Your rights

You have the following rights regarding your personal data:

• Right of access (Art. 15 GDPR)
• Right to rectification (Art. 16 GDPR)
• Right to erasure (Art. 17 GDPR)
• Right to restriction of processing (Art. 18 GDPR)
• Right to data portability (Art. 20 GDPR)
• Right to withdraw consent at any time with effect for the future (Art. 7 (3) GDPR)

To exercise your rights, a simple email to alessandro.tancredi@tancredi-strategy.com is enough.

Right to lodge a complaint

You have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR). The authority responsible for us is:

9. Right to object

Where we process your data on the basis of legitimate interests (Art. 6 (1) (f) GDPR), you have the right to object to this processing at any time on grounds relating to your particular situation (Art. 21 GDPR). We will then no longer process the data unless we can demonstrate compelling legitimate grounds that override your interests, rights and freedoms, or the processing serves to establish, exercise or defend legal claims.

10. Changes to this policy

We update this privacy policy when the website, our services or the law change. The version published here applies.

Last updated: November 2026